Engine efficiency audit: render-path cost, DSP/SIMD peak-efficiency, DRY, and crate-boundary findings

[tamashi095]

One-line summary: A read-only audit of the whole workspace at main 4797a544 for render-path
cost, DSP and math efficiency at the frozen numeric contract, SIMD utilisation, duplicated code, and
crate-boundary scope creep, recorded as self-contained, individually closable findings so that
implementation agents can execute each one from this body alone.

This is an audit tracker, not implementation authority. Every finding below is a candidate for
its own smallest-closable issue (or a small batch of same-crate findings). No cross-cutting "apply
the audit" branch is permitted. Findings are ranked; the ranking is advisory. Class-B findings are
flagged for owner ruling and MUST NOT be implemented from this body.

Current execution status — 2026-09-11

Current restart authority; older sections are historical. Astra LOW implements;
Astra XHIGH scopes/verifies. At most two active issues; five attempts maximum.
Lane B owns artifact qualification/pins. All selected #220/#221/#162 are delivered
and closed. #220 corpus differential: PR728/main c476f5b, PR34551686277 and
main34552159920 PASS. #221 ownership-safe fold rejection/identity and #162 compiler
borrowing: PR729/main92684ea9, PR34555264403 and main34555670528 PASS. Independent
Astra XHIGH source, combined-source, artifact and exact-head reviews PASSED.
Qualified pin a24d0cae reproduces; five companion files unchanged. Three delivered
worktrees removed; histories and external evidence retained. Primary is clean/
synchronized to92684ea9. No active issue slots; 47 issues open (50 before selection).
Earlier #387/#211/#376, RT6/RT7 and resident-meter delivery remain earned. Broader
RT10 remains open; #714 remains superseded without retroactive PASS. Preserve
#552/#558/#542 dependency order. No new original-finding or performance credit.

Restart authorities: #559/#560 on origin/codex/audit-349-priority-handoff.
Original finding rows below remain the historical audit snapshot.

Authority and baseline

• Audited tree: main at 4797a544 (merge of fix: make SDK artifact copies portable #346), 2026-09-03.
• Method: seven parallel read-only reviews, one per scope (lane+math; EQ+dynamics; limiter/clip/
  transient/delay+references; render path engine/builtins/rack/graph; control plane compilers/
  session/host-core; protocol/capi/hosts/source; tools/scripts/CI). Each review was required to
  cite exact file:line ranges with verbatim snippets and to check its proposals against the
  standing rulings in docs/rulings/. No benchmark was run; no rendered bit was moved.
• Standing constraints every finding respects (implementers must too):
  • Unfused (a*b)+c everywhere; bit identity across scalar/W4/W8/wasm
    (docs/rulings/unfused-multiply-add-audit.md). Class A = same arithmetic and operation order,
    fewer instructions/loads/stores/copies/branches. Class B = moves a rendered bit; flag only.
  • No runtime SIMD dispatch; only crates/lane names wide or intrinsics
    (scripts/check-lane-policy.sh); unsafe_code = "deny" workspace-wide.
  • Render is zero alloc/free/lock/syscall/I/O/log/panic-path (scripts/check-realtime-policy.sh,
    docs/REALTIME_DEPENDENCY_POLICY.md).
  • Honest-null rulings are not re-proposed without new evidence (docs/rulings/README.md).
  • Already-named floor gap terms (docs/rulings/effect-floor-accounting.md boundaries 2–5):
    (a) bitselect lowering, (b) vbroadcastss re-splat, (c) compressor detector gather,
    (d) lookahead rings > L1, (e) AoSoA transpose round trip per bank, (f) elision-gate integer
    compares, (g) per-node graph dispatch. Findings that locate the code for a gap term say so.

How to use this issue

1. Pick a finding (or a same-crate cluster). Create a numbered spec in .github/ISSUE_SPECS/ and
   a matching GitHub issue whose body is the finding verbatim plus the gates listed under it.
2. Implement only that finding. The verification gate named in the finding is the acceptance gate;
   for class-A render-path findings the standing bit-identity fixtures and
   scripts/check-realtime-policy.sh are mandatory in addition.
3. A finding whose premise turns out false on inspection is closed with a one-paragraph null note
   appended to this tracker, not silently skipped.
4. Do not implement a class-B finding. Open an owner-ruling request that cites it.

Verified in this audit session (facts, not proposals)

• cargo test -p lane --release --test g1_op_identity fails on an AArch64 host at main
4797a544 (g1_random_vectors_are_lane_identical: exp2_int differs from the scalar oracle at
  Simd4 in 7 659 of 8 000 000 lanes, all signalling-NaN inputs, e.g. a=0xff90882d oracle=0x7f000000 actual=0x00800000). The same test passes in debug. The release test
  binary contains fmaxnm/fminnm. No CI job executes tests on aarch64. See LANE-3.
• crates/capi/src/runtime/control.rs:196 types the production controller as
  ProtocolController<MockProvider> and compile.rs:485 constructs it. See IO-4.
• ProtocolQueues::try_dequeue_automation (crates/protocol/src/queue.rs:832) has no caller
  outside crates/protocol and tools/audit; no host or render path drains the accepted-automation
  queue. See IO-5.
• ArenaLease::set_muted/is_muted/wave (crates/engine/src/realtime/disjoint.rs) have no
  production caller; effective() still pays the mute redirect per buffer access. See RT-14.
• BankChain::scatter_tiled (crates/rack/src/lib.rs:2034-2095) writes through a staging block and
  then copies per lane; ArenaMembers::fold_plane (crates/graph/src/runtime.rs:686-697) does one
  master read-modify-write pass per lane; reduce_plane (runtime.rs:88-110) does one pass per
  extra input. See RT-1/2/3.
• tools/bench/src/session.rs:446 defines a private sha256_hex beside
  bench_support::digest::sha256_hex. See TOOL-1.

Executive summary

123 findings across seven scopes. The picture is consistent across scopes:

1. The render-path gap is memory traffic and dispatch, not arithmetic. The floor ruling already
   said this for the compressor and EQ; this audit locates the code for every named gap term and
   finds the same shape in the plumbing rows. The idle row (18 % of floor) and the plumbing row
   (6.7 %) are dominated by: a doubled scatter (RT-1), per-lane master folds (RT-2), per-input
   reduction passes (RT-3), three block passes for six lane-ops of fader+matrix (RT-4), per-block
   register spills in symmetry bookkeeping (RT-5, refresh_channel_symmetry is O(records×lanes) under sustained per-block record traffic #238), dyn walks over cached flags (RT-6, RT-8,
   RT-12/CP-13), and constant splats that lower to a libc memset_pattern16 call on Apple targets
   (LANE-1). All are class A.
2. Gap term (c), the compressor detector gather, is live and has spread. It moved into
   fill_taps/copy_lane (DYN-1) and the gate/expander (DYN-2) and multiband (DYN-3) carry worse
   copies of it. One shared effect_runtime::ring::gather_tap with a uniform-D vector-load arm
   fixes all three. Gap term (b), constant re-splat, is written in source in multiband (DYN-4),
   gate/expander (DYN-6), transient shaper / soft-clip / limiter (FX-4). Gap term (a),
   bitselect→vblendvps, is already closed in code but still priced as open in the floor tables
   and bench constants (LANE-13).
3. Three block-invariant decisions are branched per frame in the limiter (FX-1), delay (FX-11)
   and the mixed builtins chain (RT-7); soft-clip has no stationary split at all (FX-6). All are
   const-generic unswitch fixes with no arithmetic change.
4. Realtime-safety is true but unenforced. No allocation, %, or panic edge was found on the
   render path in rack/builtins/graph/effects, but the gate that would prove it scans only
   crates/engine/src/realtime (RT-16 / IO-14). Live exceptions found: a 2 KB stack zero-fill per
   block in delay (FX-10), a (3T+E)-entry fill(0) per block in host-web (IO-7), 512 B of scratch
   zeroed per bank per block in the EQ (DYN-9), 16 expect edges in the source pull path (IO-13).
5. Crate boundaries are inverted in specific, fixable places: the shipped C ABI's control
   provider is a conformance mock (IO-4); the accepted-automation queue and the effect control lanes
   are two disconnected automation models (IO-5); ~600 lines of transport-neutral console ABI live
   only in the wasm host (IO-18); rack exports the planner's vocabulary (RT-15);
   builtins-compiler holds ten render-path process impls while graph holds the compiler's caps,
   diagnostics and lowering pass (CP-12); effect-package restates ~400 lines of
   effect-contract's descriptor law (CP-8).
6. DRY debt is concentrated and countable: ~430 lines of identical descriptor boilerplate across
   eight effect crates (DYN-12/FX-12), 20 copies of one xorshift generator (LANE-11/FX-15), seven
   near-identical determinism.rs files (FX-16), four hand-rolled counting allocators with
   #![allow(unsafe_code)] (FX-17), four rack enums and two stable-id newtypes (CP-5), three
   diagnostic shapes (CP-6/CP-9), 42 hand-written protocol encoders over one table (IO-2), seven
   spellings of the 17-message registry (IO-3), nine RIFF writers (TOOL-6/IO-20), seven
   MANIFEST.tsv implementations (TOOL-5), 21 gate scripts sharing one skeleton and 35 mutation
   harnesses with 12 verbatim expect_failure copies (TOOL-11/12).
7. The control plane allocates by the tens of thousands per compile because the front half is
   keyed by heap-String ids that the lowering pass interns to u32 at the end (CP-1), lower
   runs three times per plan (CP-2), and the runtime un-flattens the exemplary SoA
   ExecutionProgram back into per-op boxes (CP-14).
8. CI builds cold (zero Rust caching, 27 wasm32 builds per PR, the shipped worklet built three
   times, cargo-fuzz installed from source three times: TOOL-13), tools/audit carries 4 720
   lines no gate invokes (TOOL-3), and the browser artifact ships without wasm-opt (IO-19).

Dependency-ordered program (advisory ranking)

Each wave is independently closable; within a wave, rows are independent unless noted.

Wave 0 — correctness and gate integrity (do first; each is a bounded issue).
LANE-3 (aarch64 D8 max/min fold; add an aarch64 CI execution leg), IO-4 (real control provider in
capi), IO-5 (decide and wire the automation drain, or retire one model), IO-9 (= #292),
RT-16/IO-14 (root-agnostic realtime gate; then add markers to rack/builtins), LANE-9
(vectorization allowlist still requires the retired fused FMA), TOOL-11 (= DRY half of #306),
LANE-13 (floor tables/bench constants still price gap term (a) as open).

Wave 1 — render-path class A against the worst floor rows. Measure each with
scripts/run-console-benchmark.sh on the row the finding names.
RT-1, RT-2, RT-3, RT-4, RT-5 (= #238), RT-14, LANE-1, LANE-2, DYN-1 → DYN-2 → DYN-3 (share one
kernel), DYN-4, DYN-6, FX-1, FX-10, IO-7, RT-7, FX-4.

Wave 2 — remaining render-path and compile-path class A.
RT-6, RT-9, RT-10 (step 1 only; step 2(b) is flagged), RT-11, RT-12/CP-13 (one change),
CP-14, DYN-5, DYN-8, DYN-9, DYN-10, DYN-11, DYN-14, DYN-15, DYN-17, FX-2, FX-6, FX-7, FX-8, FX-9,
FX-11, LANE-4, LANE-5, LANE-6, IO-12, IO-13, IO-16, IO-19, CP-1, CP-2, CP-3, CP-4, CP-18, CP-19.

Wave 3 — boundaries, DRY, dead code, structure. Pure moves and deletions; gate is
cargo test --workspace identical pass count plus the named policy scripts.
RT-13, RT-15, RT-17, CP-5 … CP-12, CP-15 … CP-17, CP-20, DYN-7, DYN-12, DYN-13, DYN-16, FX-5,
FX-12 … FX-19, LANE-7, LANE-8, LANE-10, LANE-11, IO-1, IO-2, IO-3, IO-8, IO-10, IO-11, IO-15,
IO-17, IO-18, IO-20, TOOL-1 … TOOL-10, TOOL-12 … TOOL-16.

Class B — flagged for owner ruling, never implemented from this body.
FX-3 (limiter per-sample div by block-constant window), LANE-12 (soft-clip flushes two
feed-forward FIR history words), RT-10 step 2(b) (an f64 lane type for meter energy), and the
standing compressor-D-in-program-key question from effect-floor-accounting.md.

Cross-references (same defect seen from two scopes — implement once)

pair	note
RT-12 ↔ CP-13	executor block loop double-indexing and observer walk
RT-16 ↔ IO-14	realtime gate scans only engine/src/realtime
RT-5 ↔ #238	symmetry refresh O(records×lanes)
IO-9 ↔ #292	track ids read through the source-id buffer
TOOL-11 ↔ #306	gate-script skeleton duplication is the DRY half of #306's fix
FX-15 ↔ LANE-11	xorshift64* copies (20 total)
FX-12 ↔ DYN-12	effect descriptor id boilerplate
FX-17 ↔ #332	counting allocators; #332 deferred the consolidation
TOOL-6 ↔ IO-20	RIFF/RF64 fixture writers
RT-10 ↔ IO-8	meters / master-peak fold should be one lane-generic kernel
DYN-7 ↔ FX "already fine"	envelope followers are shared; the branching one-poles and detector links are not
LANE-4 ↔ DYN-1	4 of the compressor's 94 floor ops are exp2_int's redundant clamp

Findings index

Full self-contained findings (current code, proposal, expected effect, rulings checked,
verification gate) are in the comments below, one comment set per scope. Each scope's report also
ends with a "Things I checked that are fine" list — read it before re-auditing a crate.

Render path (engine / builtins / rack / graph executor) — RT-*

id	class	sev	location	finding
RT-1	A	high	crates/rack/src/lib.rs:2034-2095	Tiled bank scatter writes every word twice through a staging block; 2 loads + 2 stores per lane-sample where 1 + 1 suffices
RT-2	A	high	crates/graph/src/runtime.rs:686-697	Route fold accumulates into the master once per lane — 8 read-modify-write passes per cohort per plane
RT-3	A	high	crates/graph/src/runtime.rs:88-110	reduce_plane is n−1 block passes; a fan-in-64 output node costs 126 loads + 63 stores per word
RT-4	A	high	crates/builtins/src/lib.rs:1926-1948, 2170-2181	Fader and matrix are three block passes for six lane-ops; fuse the settled arms into one
RT-5	A	high	crates/builtins/src/lib.rs:1036-1044, 1632-1690	refresh_channel_symmetry spills up to 240 SIMD registers per record and per ramping block (issue #238)
RT-6	A	medium	crates/rack/src/lib.rs:1428-1486	Collapse dispatch makes lanes × slots dyn calls per block; publish a [u8; 8] per stage
RT-7	A	medium	crates/lane/src/kernels/builtins.rs:857-916	mixed_chain_block reads its plan-invariant elision plan inside the frame loop
RT-8	A	medium	crates/rack/src/lib.rs:1565, 1684, 1709	Delivered: #478/PR #523 replaced the three invariant walks with prepared packed-mask predicates at merge 70ce3d7b; required/post-main runs 34031771524/34032117797 passed
RT-9	A	medium	crates/graph/src/runtime.rs:2686-2731	One armed observer or send tap declines the chain merge and costs two extra whole-block transposes; tee instead
RT-10	A	medium	crates/builtins/src/lib.rs:3625-3663	Meters are a scalar per-track third pass; meter the resident AoSoA block lane-generically instead
RT-11	A	medium	crates/effect-contract/src/lib.rs:234-250	Tile transpose crosses a 256-byte [[f32;8];8] by-value boundary in both directions; add a [L; W] form
RT-12	A	medium	crates/graph/src/lib.rs:1417-1420, crates/graph/src/runtime.rs:938-953	Block loop double-indexes units and walks every bank member for observers that are not bound
RT-13	N/A	medium	crates/engine/src/realtime/buffer.rs:36-125	BufferArena is allocated, passed to render and never used by the only production executor
RT-14	A	medium	crates/engine/src/realtime/disjoint.rs:208-232	Lease wave/mute machinery is unreachable; the mute redirect costs a load + mask + select per buffer access
RT-15	N/A	medium	crates/rack/src/lib.rs:20-140	RackProgram/BankSlotKey/RackLocation are compiler-only vocabulary living in the render crate
RT-16	N/A	medium	scripts/check-realtime-policy.sh:14-46	The realtime gate scans only engine/src/realtime; the marked regions in graph and all of rack/builtins are ungated
RT-17	N/A	medium	crates/builtins/src/lib.rs, crates/graph/src/lib.rs	Concrete module splits; two thirds of graph/src/lib.rs and program.rs is an inline test module
RT-18	N/A	low	(sweep)	No %, alloc or panic surface found on the render path — reported as a negative result with two caveats

Effects: parametric EQ, compressor, gate/expander, multiband — DYN-*

id	class	sev	location	finding
DYN-1	A	high	crates/compressor/src/kernel.rs:816-878	Per-lane detector gather is W scalar loads + W scalar stores per channel-frame in both fill_taps and gather_detector; a uniform-D arm makes it one vector load.
DYN-2	A	high	crates/gate-expander/src/kernel.rs:259-293	Four tap gathers per frame: two duplicate each other when the channels' taps agree, and two are dead under DualMono.
DYN-3	A	high	crates/multiband-compressor/src/lib.rs:865-880, :1000-1006	detector_tap runs four times per frame with two distinct index sets and no uniform-offset path.
DYN-4	A	high	crates/multiband-compressor/src/lib.rs:902-932	band_amplitude rebuilds GainComputerCoef and re-splats seven constants four times per frame — 28 broadcasts.
DYN-5	A	medium	crates/compressor/src/kernel.rs:906-967, :1066-1074	Link mode and bypass are prepared-time constants spent as per-lane-sample mask selects; const-generic them as the multiband already does.
DYN-6	A	medium	crates/gate-expander/src/kernel.rs:316-357, :392-398	Seven constant splats and three block-invariant mask derivations per channel-sample; no Invariants equivalent.
DYN-7	N/A	medium	compressor/src/kernel.rs:1028, gate-expander/src/kernel.rs:392, multiband-compressor/src/shim.rs:52,:70	Three branching one-poles and three detector links; one kernel each in effect-runtime::dynamics (the shim's own header says so).
DYN-8	A	medium	crates/parametric-eq/src/lib.rs:822-830	Elision gate is a scalar five-int-op-per-word scan; two thirds of it is bank::check_block in the vector domain.
DYN-9	A	medium	crates/parametric-eq/src/lib.rs:1858-1863, :1913-1917	512 bytes of stack scratch zeroed per bank per block for state only read on silent blocks.
DYN-10	A	medium	crates/multiband-compressor/src/lib.rs:694, :1169-1281	Track-major ramp storage costs ~800 strided scalar accesses per block to transpose into and out of lanes.
DYN-11	A	low	crates/compressor/src/kernel.rs:258-264	advance_cursor runs two integer % on the silent fast path, against the crate's own "no %" rule.
DYN-12	N/A	medium	eight crates/*/src/lib.rs descriptor headers	~430 lines of byte-identical effect_id/port_id/parameter_id/parameter boilerplate.
DYN-13	N/A	medium	compressor/src/design.rs:81-118, multiband-compressor/src/lib.rs:425-457, gate-expander/src/lib.rs:326-343	Three ParameterSpec translation tables routing around a predicate that is now public.
DYN-14	A	low	crates/parametric-eq/src/lib.rs:1872-1885, :1923-1932	Open-codes bank::finish_channel, which bank.rs:241-245 names as the divergence it exists to stop.
DYN-15	A	low	crates/compressor/src/kernel.rs:83-104	1 152 bytes of control-plane arrays sit ahead of every render-read word of Channel.
DYN-16	N/A	low	effect-runtime/src/ramp.rs:31-41, gate-expander/src/kernel.rs:66-89, multiband-compressor/src/lib.rs:662-678	Three representations of one D11 ramp law, enforced three different ways.
DYN-17	A	low	crates/parametric-eq/src/lib.rs:1505-1540	Interleave's load/store per pass is fixed by the register ceiling; only the per-pass coefficient gather is takeable.

Effects: true-peak limiter, soft-clip, transient shaper, delay, references, conformance — FX-*

id	class	sev	location	finding
FX-1	A	high	crates/true-peak-limiter/src/lib.rs:1890-1906, :1701-1717, :3086, :3197	The block-invariant stationary hoist is branched per frame inside the innermost loop; make it const STATIONARY: bool
FX-2	A	medium	crates/true-peak-limiter/src/lib.rs:1603-1619	The 79 %-of-kernel detector loads/stores through open-ended slices, keeping ~8 bounds compares per lane-frame
FX-3	B (flag)	medium	crates/true-peak-limiter/src/lib.rs:1551, :1308	box_sum.div(hot.window) is a vdivps per lane-frame by a block-constant — the ruling's named class-B residual
FX-4	A	medium	crates/transient-shaper/src/lib.rs:292,317-331; crates/soft-clip/src/kernel.rs:150-157; crates/true-peak-limiter/src/lib.rs:1528,1543,1545	Loop-invariant constants re-splatted per sample while each crate already has a prepared coefficient struct
FX-5	A	medium	crates/true-peak-limiter/src/lib.rs:3030-3242 vs :1575-1963	The mono-collapse path is a hand-copied 213-line duplicate of the dual block bodies
FX-6	A	medium	crates/soft-clip/src/kernel.rs:188-215	Soft-clip has no stationary split: 9 block-invariant lane-ops per channel-frame, and no settle to pay for the hoist
FX-7	A	medium	crates/soft-clip/src/kernel.rs:194,204; crates/lane/src/kernels/halfband.rs:126-133	The dry history is a 64-row double-written ring where 32 rows and one store suffice
FX-8	A	low	crates/lane/src/kernels/halfband.rs:182-197	halfband2x_decim_even compares a counter against a constant on every one of 30 taps
FX-9	A	medium	crates/transient-shaper/src/lib.rs:333-335, :513-528	The identity mask's bypass/mix == 0 terms are block-invariant on the dominant tail loop
FX-10	A	high	crates/delay/src/lib.rs:1266, :729-746	2 KB of stack tap windows zero-filled on the render thread every block; move into PreparedDelay
FX-11	A	medium	crates/delay/src/lib.rs:1139-1152	tap_sample branches per sample on two chunk-invariant flags, twenty lines after three siblings were hand-unswitched
FX-12	N/A	medium	8 effect crates + crates/effect-package/src/wire.rs:1929	Nine byte-identical effect_id/port_id/parameter_id const panic-wrappers; add them to effect-contract
FX-13	N/A	medium	crates/soft-clip/src/lib.rs:883-890 + 5 more	Six bind_homogeneous_banks hand-roll the check PrepareEffectBankRequest::validate_shape documents as universal
FX-14	N/A	medium	crates/soft-clip/src/lib.rs:903-913	width_is_native re-derives the backend→width law and disagrees with Backend::current() under miso_wasm_simd8
FX-15	N/A	medium	8 corpus.rs modules incl. crates/effect-runtime/src/corpus.rs:57-73	Eight copies of the same frozen xorshift64* that drives every determinism corpus
FX-16	N/A	medium	7 × crates/*/tests/determinism.rs (681 L)	One digest-vs-pins pattern written seven times; make it a macro next to effect_conformance_test!
FX-17	N/A	medium	4 × crates/*/tests/allocation.rs (~950 L) vs tools/bench-support/src/alloc.rs	Four hand-rolled counting GlobalAllocs and four #![allow(unsafe_code)] under crates/; #332 deferred this
FX-18	A	low	crates/delay/src/lib.rs:505-522; crates/lane/src/kernels.rs:527-544; crates/true-peak-limiter/src/lib.rs:1042	Ring segment/wrap arithmetic written three times; the delay ring and the PDC line are correctly not one kernel
FX-19	N/A	low	crates/conformance/src/effect.rs:28-660 vs :661-1562	A mock effect and the conformance harness share one 1 562-line file

SIMD foundation and math (lane / math) — LANE-*

id	class	sev	location	finding
LANE-1	A	high	crates/lane/src/wide_impl.rs:144-148	splat(CONST) emits a memset_pattern16 libc call per use on Apple targets; 2 per frame inside svf_step
LANE-2	A	high	crates/lane/src/kernels.rs:472-491,497-513,563-590	mix kernels carry 4-6 bounds branches per frame because only debug_assert relates the slice lengths
LANE-3	A	high	crates/lane/src/wide_impl.rs:278-330	AArch64 release folds D8 max/min into fmaxnm/fminnm; G1 is red today and no CI job runs on aarch64
LANE-4	A	medium	crates/lane/src/wide_impl.rs:332-340	exp2_int re-clamps an argument both callers already clamped — 4 of the compressor's 94 floor ops
LANE-5	A	medium	crates/lane/src/kernels.rs:450-465	ramp_block evaluates a per-frame vector select of a monotone predicate; split the loop
LANE-6	A	medium	crates/lane/src/kernels.rs:295-322	svf_block_ramped recomputes -c1 and the ramp test on every frame including settled ones
LANE-7	A	medium	crates/lane/src/kernels/builtins.rs:408-1096	six near-identical copies of the input-chain frame body (~330 lines)
LANE-8	N/A	medium	crates/math/src/fast_db.rs:123,128 + 3 crates	20*log10(2) and its inverse declared 4x each in 3 spellings; belongs in math
LANE-9	N/A	medium	tools/audit/vectorization-allowlist.tsv:4,7	the vectorization gate requires fused multiply-add that #163 phase 2 removed; masked by continue-on-error
LANE-10	N/A	low	crates/math/src/lib.rs:38	test-only corpus module compiled into every production consumer of math
LANE-11	N/A	low	crates/math/src/corpus.rs:70-90 + 19 files	one xorshift64* generator copy-pasted twenty times
LANE-12	B (flag)	low	crates/soft-clip/src/kernel.rs:195,199	flush applied to two feed-forward FIR history words; documented but outside the D7 law's wording
LANE-13	N/A	low	docs/rulings/effect-floor-accounting.md:134-136,183-186	gap term (a) is closed in code; the floor tables and bench constants still price it as open

Control plane (session, compilers, graph control half, host-core, effect-package) — CP-*

id	class	sev	location	finding
CP-1	N/A	high	graph-compiler/src/schedule.rs:9-278, ids.rs:50-110	Whole compile front-half keyed by heap-String GraphNodeId; ~15-20k allocations per 64-track compile that lower then interns to u32
CP-2	N/A	high	graph/src/lib.rs:840-868,906,824,1017	program::lower runs 3× per plan; cached program discarded at bind because 8 fields are pub for tests
CP-3	N/A	medium	graph/src/lib.rs:630-716	has_valid_structural_layout re-runs the topological/permutation checks the compiler and lower both already prove
CP-4	N/A	medium	graph/src/lib.rs:958-996	Bind builds six string-keyed BTreeSets and then .clone()s one of them
CP-5	N/A	medium	session/src/model.rs:536, effect-compiler/src/prepare.rs:844, graph/src/lib.rs:28,50, rack/src/lib.rs:42	Four rack enums (two with conflicting Ord), two identical stable-id newtypes, two conversions, two token tables
CP-6	N/A	medium	effect-compiler/src/diagnostic.rs:1-20, builtins-compiler/src/lib.rs:233-250, graph/src/lib.rs:284-303	Three identical {code, path} diagnostic types; the three sorted() copies already disagree about dedup
CP-7	N/A	low	host-core/src/prepare.rs:382,419,568,613,641,716,747	Seven verbatim copies of the same 9-line diagnostic-mapping closure
CP-8	N/A	high	effect-package/src/wire.rs:1303-1633 vs effect-contract/src/lib.rs:460-773	effect-package restates ~400 lines of effect-contract's descriptor law; the _parts fix pattern already exists for one rule
CP-9	N/A	medium	effect-package/src/diagnostic.rs:1-197	Three near-identical #[repr(C)] wire diagnostics; only one has as_str and a frozen-numbering test
CP-10	N/A	medium	effect-package/src/wire.rs:403-470,786-1030	~200 naked wire-offset literals hand-kept in three parallel tables
CP-11	N/A	medium	graph-compiler/src/lib.rs:264-10166 and 3 others	Four giant files (one 97% inline tests); concrete per-item module assignments given
CP-12	N/A	medium	builtins-compiler/src/lib.rs:364-666,2963-3131; graph/src/lib.rs:160-303; graph/src/program.rs:487	Compiler crate holds 10 render process/observe impls; render crate holds the compiler's caps, diagnostics and the lowering pass
CP-13	A	medium	graph/src/lib.rs:1416-1419, graph/src/runtime.rs:890-958	Two bounds checks + two discriminant loads per unit per block; observer walk runs on every unit including unobserved banks
CP-14	A	medium	graph/src/runtime.rs:415-430,2564-2588 vs graph/src/program.rs:106-124	Runtime un-flattens ExecutionProgram's contiguous SoA into three Box<[..]> per op (~900 small allocations)
CP-15	N/A	medium	graph/src/runtime.rs:2618-2637 vs graph/src/program.rs:1624-1643	Property-test "independent oracle" is a verbatim copy of the implementation it checks
CP-16	N/A	low	session/src/compile.rs:17-243, graph/src/lib.rs:250-283, host-core/src/prepare.rs:732	4/6 CompileCaps fields documented-inert; 8/11 GraphCompileCaps fields always u64::MAX; unused _session params; speculative active_mask
CP-17	N/A	medium	graph-compiler/src/ids.rs:108-138, compile.rs:354-411	Total functions returning Option; three unreachable graph.port.unknown branches; the real failure is a .expect() panic
CP-18	N/A	low	host-core/src/prepare.rs:656-698,900-906	session_structural_symmetry computed twice per prepare; each track id heap-allocated three times
CP-19	N/A	medium	graph-compiler/src/compile.rs:169,553,572,652	294 KB CompiledSession deep-cloned per structural compile (tracked #162); GraphResourceEstimate is 23 u64s but not Copy
CP-20	N/A	low	graph-compiler/src/canonical.rs:27-91,363-372 + 12 sites	14 hex encoders in 3 styles; node_text/node_text_len twin kept in step by a test when a fmt::Write sink already exists in the file

Boundaries and I/O (protocol, capi, hosts, source, flac sidecar) — IO-*

id	class	sev	location	finding
IO-1	N/A	medium	crates/protocol/src/{lib.rs:74-77,conformance.rs:1-487,controller.rs:618-810}	conformance corpus + MockProvider ship inside the library; 33.8 % of the crate is inline tests
IO-2	N/A	medium	crates/protocol/src/message_wire.rs:862-1980	42 encode entry points repeat one three-statement body; one generic codec + the existing MessageSpec table replaces ~350 lines
IO-3	N/A	medium	wire.rs:98-165, typed_frame.rs:41-106, controller.rs:1036-1080, :2340-2402, schema.rs:259+	the 17-message registry is spelled out in seven hand-maintained tables
IO-4	N/A	high	crates/capi/src/runtime/compile.rs:485-508, control.rs:196	the shipped C ABI uses protocol::MockProvider — a conformance fixture — as its production control provider
IO-5	N/A	high	crates/protocol/src/queue.rs:196-283, controller.rs:3643-3675, crates/effect-contract/src/live.rs:44-90	the accepted-automation queue has no render-side drain; two disconnected automation models exist
IO-6	N/A	medium	crates/protocol/src/queue.rs:243-278, :1098-1211	admission is ~5.3 M iterations per 256-record batch and validates every batch twice
IO-7	A	high	hosts/host-web/src/lib.rs:1244	(3T + E)-entry fill(0) on the render thread every block, unconditionally
IO-8	A	medium	crates/capi/src/ffi.rs:823-837, hosts/host-web/src/lib.rs:1252-1269	two scalar master-peak folds; one lane-generic host-core kernel replaces both
IO-9	N/A	high	crates/host-core/src/shape.rs:26-28, hosts/host-web/src/lib.rs:1091-1109	issue #292: track IDs read through the source-ID buffer; silent RESULT_INTERNAL
IO-10	N/A	medium	crates/capi/src/abi.rs:11-29, hosts/host-web/src/lib.rs:69-100, sidecars/flac-decoder/src/lib.rs:23-39	codes 3 and 5 mean different things natively and in the browser with no test saying so; capi discards PrepareRejection; two ungenerated JS copies
IO-11	N/A	medium	effect-contract/src/lib.rs:133-142, session/src/model.rs:327-357, protocol/src/message_wire.rs:183-350	six parameter vocabularies declared 2-3× plus ~180 lines of conversions between the copies
IO-12	A	medium	crates/source/src/native_source.rs:1690-1695, crates/source/src/lib.rs:849-854	the decode worker memcpys a whole planar quantum into the ring slot it could decode into
IO-13	A	medium	crates/source/src/lib.rs:1160-1210, :1074-1100	16 expect panic edges and plan-invariant shape re-derivation in the render pull path
IO-14	N/A	medium	scripts/check-realtime-policy.sh:12-48	three files' REALTIME_POLICY markers are never scanned by the gate that owns them
IO-15	N/A	medium	crates/capi/src/runtime/compile.rs:106-205, hosts/host-web/src/lib.rs:2362-2434	two hand-maintained resource projections that must each track every allocation
IO-16	N/A	medium	crates/protocol/src/controller.rs:2407-2418, typed_frame.rs:278-314	every response zeroes a max_response_bytes Vec and is serialised twice
IO-17	N/A	low	crates/engine/src/realtime/spsc.rs:456-556, crates/target-smoke/src/lib.rs:31-41	LocalRing is unused by any host and keeps two unsafe blocks alive for a smoke test
IO-18	N/A	high	hosts/host-web/src/lib.rs:1594-2190	~600 lines of transport-neutral console-command ABI live in the wasm host; the C ABI cannot reach it
IO-19	A	medium	scripts/build-web-audioworklet.sh:37-60	the 1.94 MB browser artifact ships without any wasm-opt pass
IO-20	N/A	low	5 sites, ~361 lines (see finding)	the RIFF/RF64 test-fixture writer is reimplemented five times
IO-21	N/A	low	crates/host-core/src/prepare.rs:36, :129-133, crates/host-core/src/diagnostics.rs:15	host-core re-checks the launch rate with its own array on a path where the check provably cannot fire

Tools, scripts, CI, artifacts — TOOL-*

id	class	sev	location	finding
TOOL-1	N/A	high	tools/bench/src/session.rs:446-585	140-line hand-written SHA-256 beside bench_support::digest::sha256_hex; the policy gate's regex cannot see it
TOOL-2	N/A	medium	tools/audit/src/vectorization.rs:293-295	a tenth JSON escaper, and one of the invalid kind (control chars raw); six json_string* copies the gate's anchor misses
TOOL-3	N/A	medium	tools/audit/src/main.rs:31-50	six audit subjects (4,720 lines, 31% of the crate) invoked by no script, workflow or doc
TOOL-4	N/A	medium	tools/audit/src/fixture_builtins.rs:2675-2870	two JSON readers in one 6,025-line file for the same records; neither is the workspace's
TOOL-5	N/A	medium	scripts/check-effect-runtime-fixtures.sh:5-24	MANIFEST.tsv has 4 Rust owners + 3 shell verifiers; the LC_ALL=C fix exists in only one copy
TOOL-6	N/A	medium	tools/audit/src/source_duration.rs:231-248	nine hand-rolled RIFF/WAVE writers; crates/source owns the reader and nothing owns the writer
TOOL-7	N/A	medium	tools/native-pcm-runner/src/lib.rs:393-431	re-implements stem-hasher's wave→canonical-PCM→SHA-256 and the launch bit-depth set without depending on it
TOOL-8	N/A	medium	tools/bench/src/floor.rs:47-131 ↔ scripts/console-benchmark-record-lib.jq:53-72	the two floor tables are compared only in an operator-only run, never in CI, and never by key set
TOOL-9	N/A	medium	tools/bench/src/console.rs:1678-1712	7 Metadata structs, 4 Percentiles, 4× three formatters, 18 mega format! record templates
TOOL-10	N/A	low	tools/wasm-gates/src/lib.rs:251-262 ↔ tools/wasm-console/src/main.rs:299-325	two wasmtime embeddings, two digest-word protocols, two runtime pins; the 5-crate split itself is justified
TOOL-11	N/A	high	scripts/check-workspace-policy.sh:20-50	scan_forbidden fixes #306's bug and 20 sibling gates re-implement the broken form; 5 copies of one awk
TOOL-12	N/A	medium	scripts/test-rack-policy.sh:20	35 mutation harnesses / 5,610 lines with 12 verbatim expect_failure copies and no shared harness
TOOL-13	N/A	high	.github/workflows/ci.yml:68-70,376-388,440	zero Rust caching, 12 cold jobs, 27 wasm32 builds/PR, shipped worklet built 3×, cargo-fuzz built 3×
TOOL-14	N/A	medium	fixtures/flac-delivery/v1/generate.py:92,124	3 uninvoked binaries, 2 dead crate names breaking a generator, an orphan validator, a deleted sweep.sh cited 24×
TOOL-15	N/A	low	artifacts/ (scripts/run-console-benchmark.sh:266-268)	70/70 raw/accepted jsonl pairs byte-identical: ~4.5 MB of the 9.85 MB is a second copy
TOOL-16	N/A	medium	sdk/src/internal/session-json.ts:13-62	the canonical-JSON leaf-type tables are hand-transcribed from Rust beside a working Rust→TS codegen pipeline

Non-goals

• No rendered bit moves under any class-A row; a row that turns out to need one is re-classed B and
  stops.
• No new crate names, no renames for their own sake, no runtime SIMD dispatch, no unsafe outside
  the existing allowlist without a ruling.
• No benchmark-driven tuning loops: one measurement per row on the named workload, recorded, not
  chased.
• Multicore render, f64 lanes, ADAA, reciprocal divides, and any change to a frozen operation
  order are outside this tracker.

Evidence requirements per implemented row

1. The finding's own verification gate, green.
2. For render-path rows: scripts/check-realtime-policy.sh and the workspace fixture bit-identity
   suite green; the named console-benchmark row re-measured once (descriptive).
3. A one-paragraph note on this tracker: row id, commit, measured before/after where applicable, or
   the null result if the premise did not hold.

https://claude.ai/code/session_01LkmW681maQhUqEVSA6vZSj

Active/passive lanes

Active: #220 route-fold coverage and #162 compiler borrowing; #221 queued. #387/#211/#376 delivered and closed. See current
#559/#560 checkpoint before selecting the next bounded issue. Broader audit and
program trackers remain open until their own closure conditions are satisfied.

[tamashi095]

Audit report — Render path: engine / builtins / rack / graph executor (RT-*), part 1/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

Render-path audit — engine, builtins, rack, graph render half

Scope: crates/engine/src/realtime/*, crates/rack/src/lib.rs, crates/builtins/src/lib.rs,
crates/lane/src/kernels/builtins.rs (the builtins section kernels), and the render half of
crates/graph (src/lib.rs GraphExecutor, src/runtime.rs).

Docs read: AGENTS.md (product principles, approved audio architecture), docs/REALTIME_MEMORY.md,
docs/rulings/effect-floor-accounting.md (boundaries 2–5, inventories, class-B table),
docs/rulings/builtins-input-liveness-d2.md, docs/rulings/cross-bank-interleave.md,
docs/rulings/simd-wrapper-around-scalar-inner-loop.md,
docs/rulings/stationary-smoother-hoist-boundary.md, issue #238.

Anchor facts used throughout, from effect-floor-accounting.md:

• Three things are deliberately outside the floor and are the named gap terms: loads and stores,
  "the AoSoA transpose the rack performs around every bank", and "the graph's per-node dispatch".
• Boundary 5 (sixty_four_track_idle): 12.978 cycles/lane-sample against a floor of 2.331 —
  18.0 %, the worst standing row. "What the idle row costs is almost entirely the AoSoA
  transposes and the graph dispatch that the fixed points cannot skip."
• sixty_four_track_plumbing_only (route mix2x2 3 ops + output reduction 1 op = 4-op floor)
  measures 6.7 % of floor — the worst number in the table by nearly five times, attributed to
  "64 individually dispatched route ops + unfolded 64-buffer reduction".
• Identity inventory (dispatch-only, 22 lane-ops/lane-sample): sanitise/trim 7, collapsed identity
  run 1, output boundary scan 4, fader 2, pan matrix 4, route mix2x2 3,
  output reduction 1.

Findings RT-1 … RT-4 and RT-9 are all against those two rows: the arithmetic in them is tiny and
essentially all of the measured cost is transposes, redundant block passes and dispatch.

---

RT-1: the tiled bank scatter writes every word twice — the AoSoA round trip costs 2 stores + 2 loads per lane-sample where 1 + 1 suffices

• Category: perf
• Class: A (bit-identical — a transpose is a pure permutation of 32-bit words; no arithmetic changes)
• Severity: high
• Location: crates/rack/src/lib.rs:2034-2095 (BankChain::scatter_tiled), with the staging
  block declared at crates/rack/src/lib.rs:1200-1210 and allocated at
  crates/rack/src/lib.rs:1304-1305; the trait method that forces it is
  crates/rack/src/lib.rs:1070-1071 (BankMembers::plane_mut); the tiled kernel is
  crates/rack/src/lib.rs:281-300 (tile_scatter).
• Current code:

        tile_scatter(
            &self.scratch.left[..tiled * W],
            &mut self.staging_left,
            stride,
            transpose,
        );
        tile_scatter(
            &self.scratch.right[..tiled * W],
            &mut self.staging_right,
            stride,
            transpose,
        );
        // The ragged tail, word by word, straight into the same staging block: one contiguous copy
        // per lane below then still covers the whole block.
        for frame in tiled..frames_used { /* ... */ }
        if self.fold.is_empty() {
            for lane in 0..W {
                let (left, right) = members.plane_mut(lane);
                left.copy_from_slice(
                    &self.staging_left[lane * stride..lane * stride + frames_used],
                );
                right.copy_from_slice(
                    &self.staging_right[lane * stride..lane * stride + frames_used],
                );
            }
            return;
        }

• Problem: the gather (gather_tiled, crates/rack/src/lib.rs:1945-1988) is optimal — one
  vector load per planar lane, one whole-tile shuffle, one vector store into the resident block:
  1 load + 1 store per lane-sample per plane. The scatter is not. tile_scatter writes the
  transposed rows into an engine-owned staging block, and then a second loop copies staging into
  each lane's planar buffer. That is 2 loads + 2 stores per lane-sample per plane — exactly
  double the gather, and double what the operation needs. At the intended fixture's shape
  (8 cohorts × 8 lanes × 2 planes × 128 frames) the redundant half is 16 384 extra loads and
  16 384 extra stores per block, 128 KiB of traffic that exists only because of a borrow-checker
  shape. The code says so itself at crates/rack/src/lib.rs:281-289: "a gather may hold every
  lane's planar view at once (plane takes &self), but plane_mut hands out one lane at a time,
  so the transpose lands in engine-owned staging". This is the concrete, locatable half of the
  named gap term "the AoSoA transpose the rack performs around every bank", and it is the single
  largest thing in the 18.0 %-of-floor idle row.
• Proposed change: give BankMembers a multi-lane mutable accessor so tile_scatter can store
  the transposed rows straight into the lanes' planar buffers, and keep the staging block only for
  the fold path and the partial-bank path.

// crates/rack/src/lib.rs, trait BankMembers
/// Every active lane's planar view at once, for the tiled scatter. `false` means the implementor
/// cannot prove pairwise distinctness and the chain must take the staging path.
/// `left`/`right` are caller-owned stack arrays of `lanes` entries, filled in lane order.
fn take_planes_mut<'a>(
    &'a mut self,
    left: &mut [Option<&'a mut [f32]>],
    right: &mut [Option<&'a mut [f32]>],
) -> bool { let _ = (left, right); false }

ArenaMembers (crates/graph/src/runtime.rs:634-642) can implement it soundly and trivially:
its outputs are already proven pairwise distinct at bind — BankChain::new requires it and
scatter_redirects declines every redirect whose targets collide
(crates/rack/src/lib.rs:1071-1082 states the invariant) — and ArenaLease::write_stereo
already builds each slice from raw parts under exactly that invariant
(crates/engine/src/realtime/disjoint.rs:268-289). Add
ArenaLease::take_write_stereo_set(&mut self, buffers: &[u32], out_l: &mut [Option<&mut [f32]>], out_r: &mut [Option<&mut [f32]>])
beside write_stereo, with the same SAFETY note plus the distinctness debug_assert.
Then scatter_tiled's non-fold arm becomes: fill the two [Option<&mut [f32]>; 8] stack arrays,
run tile_scatter_direct::<W>(&scratch.left[..tiled*W], &mut planes_l, transpose) writing each
transposed row at plane[base..base+W], and finish the ragged tail per lane. The staging block
stays for fold-armed chains and for the partial-bank scalar path, unchanged.

• Expected effect: halves the scatter half of every bank round trip: −1 load and −1 store per
  lane-sample per plane per cohort per block, i.e. −32 768 memory ops per block on the 64-track
  fixture, and removes the staging_left/staging_right allocation for every unfolded chain
  (2 × quantum × lanes f32 per chain). This attacks the dominant term of boundary 5 directly.
• Rulings / constraints checked: class A by effect_contract::transpose_tile_4's own argument
  (crates/effect-contract/src/lib.rs:221-238): "a transpose is a pure permutation of 32-bit
  words — no arithmetic, no rounding, no canonicalisation". Not the cross-bank-interleave.md
  candidate (that is fusing different banks' frame loops; this is one bank's own scatter). Not
  simd-wrapper-around-scalar-inner-loop.md (no scalar inner loop is being wrapped). Uses the
  existing unsafe allowlist file disjoint.rs rather than introducing a new one.
• Verification gate: cargo test -p rack — gather_scatter_round_trip_is_bit_exact
  (crates/rack/src/lib.rs:2717) and tiled_transpose_matches_the_scalar_path_bit_for_bit;
  cargo test -p graph; then scripts/run-console-benchmark.sh and compare the
  sixty_four_track_idle row's isolated_cycles_per_lane_sample against the 12.978 in
  artifacts/issue184. scripts/check-realtime-policy.sh for the new disjoint.rs method.

---

RT-2: the route fold accumulates into the master buffer once per lane — 8 read-modify-write passes over the master block per cohort per block

• Category: perf
• Class: A (the per-word operation order m = t0; m += t1; …; m += t7 is preserved exactly)
• Severity: high
• Location: crates/graph/src/runtime.rs:686-697 (ArenaMembers::fold_plane), called per lane
  from crates/rack/src/lib.rs:2007-2012 and crates/rack/src/lib.rs:2106-2113.
• Current code:

    fn fold_plane(&mut self, lane: usize, left: &mut [f32], right: &mut [f32]) {
        let fold = self.fold[lane];
        mix2x2_block::<FrameLane>(left, right, fold.coefficients);
        let (master_left, master_right) = self.lease.write_stereo(self.master);
        if fold.store {
            master_left.copy_from_slice(left);
            master_right.copy_from_slice(right);
        } else {
            sum_into_block::<FrameLane>(master_left, left);
            sum_into_block::<FrameLane>(master_right, right);
        }
    }

• Problem: fold_plane is invoked once per folded lane, and each invocation runs a whole
  sum_into_block pass over the master buffer: acc = load(acc) + load(x); store(acc)
  (crates/lane/src/kernels.rs:498-514). For a W = 8 cohort that is 8 passes over the master
  block per plane, costing 8 master loads + 8 master stores + 8 tile loads per master word,
  where a single fused pass needs 1 master store + 8 tile loads (the first contributor's
  store arm means no initial master load at all). Per plane per master word that is 8 loads and
  7 stores of wasted traffic; on the 64-track fixture with 8 cohorts folding into one master, the
  master block is read and written 64 times per plane per block instead of once. The floor charges
  the output reduction 1 lane-op; this is why plumbing_only measures 6.7 % of floor. The
  master buffer is 2 × 128 × 4 B = 1 KiB, so it stays in L1, but the 64 dependent
  read-modify-write chains on the same cache lines serialise on store-to-load forwarding — the
  same mechanism effect-floor-accounting.md blames for the compressor's detector gather.
• Proposed change: replace the per-lane call with a whole-epilogue call that the chain makes
  once, after every lane's tile has been transposed and matrixed. In crates/rack/src/lib.rs:

// BankMembers
/// The whole cohort's folded epilogue, in lane order. `tiles[i]` is lane `i`'s transposed
/// planar tile, already mutable; the implementor owns what happens to them.
/// Default: fall back to one `fold_plane` per lane, so nothing that does not override changes.
fn fold_planes(&mut self, tiles: &mut [(&mut [f32], &mut [f32])]) {
    for (lane, (l, r)) in tiles.iter_mut().enumerate() { self.fold_plane(lane, l, r); }
}

ArenaMembers::fold_planes then runs mix2x2_block per lane exactly as now (the route is
irreducibly per-lane, D3), and finishes with one master pass through a new lane-generic
kernel in crates/lane/src/kernels.rs:

/// `acc = xs[0]; acc += xs[1]; … ` per word, left to right — the D9 accumulation of a whole
/// cohort in one pass. Identical per-word operation order to `sum2_block` + `sum_into_block`.
#[inline(always)]
pub fn store_sum_n_block<L: Lane>(acc: &mut [f32], xs: &[&[f32]]) { /* … */ }

Because the tiles already live in staging_left/staging_right at a fixed stride
(crates/rack/src/lib.rs:2038), the fused pass reads 8 contiguous streams, which the hardware
prefetcher handles.

• Expected effect: master-bus traffic drops from 8 loads + 8 stores per master word per cohort
  per plane to 0 loads + 1 store. On the 64-track fixture: from 64 master-block read-modify-write
  passes per plane per block to 8 (one per cohort), and the remaining 8 could be fused further by
  handing the master op the cohort list. Directly targets the plumbing_only 6.7 % row.
• Rulings / constraints checked: fold_plane's own doc (crates/graph/src/runtime.rs:645-656)
  freezes the association as "the first contributor writes the master and every later one adds
  into it… Writing then adding computes in0 + in1 with the same operation and the same rounding
  sum2_block does". A fused left-to-right per-word sum computes the identical expression tree, so
  no bit moves and the -0.0 argument in that comment survives unchanged. Not a reassociation.
• Verification gate: cargo test -p graph (the route-fold and D9 reduction fixtures),
  cargo test -p rack, plus the workspace fixture bit-identity suite; then
  scripts/run-console-benchmark.sh and compare sixty_four_track_plumbing_only and
  sixty_four_track_gain_pan_only.

---

RT-3: reduce_plane runs one whole block pass per extra input — a fan-in-n node costs 2(n−1) loads and n−1 stores per word instead of n and 1

• Category: perf
• Class: A (the ((a+b)+c)+d order is preserved word by word)
• Severity: high
• Location: crates/graph/src/runtime.rs:88-110 (reduce_plane); kernels at
  crates/lane/src/kernels.rs:473-514 (sum2_block, sum_into_block); called twice per op at
  crates/graph/src/runtime.rs:1052-1055.
• Current code:

fn reduce_plane(lease: &mut ArenaLease, plane: usize, out: u32, inputs: &[u32]) {
    match inputs {
        [] => lease.write(plane, out).fill(0.0),
        [single] => {
            if *single != out {
                let (output, input) = lease.write_read(plane, out, *single);
                output.copy_from_slice(input);
            }
        }
        [first, second, rest @ ..] => {
            {
                let (output, a, b) = lease.write_read2(plane, out, *first, *second);
                sum2_block::<FrameLane>(output, a, b);
            }
            for next in rest {
                let (output, input) = lease.write_read(plane, out, *next);
                sum_into_block::<FrameLane>(output, input);
            }
        }
    }
}

• Problem: every additional input is a separate full traversal of the output block that reloads
  what the previous traversal just stored. A submix or session output with fan-in n costs
  2(n−1) loads and n−1 stores per output word per plane; the arithmetic is n−1 adds. For the
  64-input output node of sixty_four_track_plumbing_only that is 126 loads and 63 stores per
  word per plane where 64 loads and 1 store are required — a 3× overshoot on a row whose whole
  floor is 4 lane-ops. It also re-enters the lease (write_read) once per input, paying
  effective()'s bounds check + mute test (see RT-14) n−1 times.
• Proposed change: add a variadic reduction kernel to crates/lane/src/kernels.rs beside
  sum2_block, and have reduce_plane resolve the input slices once:

/// D9 reduction of `n >= 2` inputs in **one** pass: per word,
/// `out = in[0] + in[1]`, then `out += in[k]` for k in 2.. — the same expression tree
/// `sum2_block` + repeated `sum_into_block` builds, with the intermediate held in a register.
#[inline(always)]
pub fn sum_n_block<L: Lane>(out: &mut [f32], inputs: &[&[f32]]) { /* vector body + f32 tail */ }

ArenaLease needs a matching read_set(&self, plane, buffers, out: &mut [Option<&[f32]>])
(shared references only, so it is strictly easier to justify than RT-1's mutable form). Keep the
[] and [single] arms exactly as they are — the -0.0-preserving copy and the fill(0.0)
semantics are load-bearing and documented.

• Expected effect: fan-in n drops from 2(n−1) loads + n−1 stores to n loads + 1 store
  per word per plane. On a 64-input output node: 126→64 loads, 63→1 store, per word, per plane.
  Also removes n−2 lease re-entries per node per plane per block.
• Rulings / constraints checked: the frozen arithmetic note at
  crates/graph/src/runtime.rs:28-31 fixes fan-in-0 / fan-in-1 / fan-in-n semantics; sum_n_block
  reproduces the fan-in-n case word for word (same operations, same order, intermediate in a
  register — the identical argument input_chain_block's "why the bits do not move" section makes
  at crates/lane/src/kernels/builtins.rs:387-395). Not reassociation, not FMA.
• Verification gate: cargo test -p graph (D9 reduction order fixtures and
  reduce_left_to_right oracle at crates/graph/src/lib.rs:320), cargo test -p lane, the
  workspace fixture bit-identity suite, then sixty_four_track_plumbing_only in
  scripts/run-console-benchmark.sh.

---

RT-4: fader and matrix are two bank slots and three block passes where one fused pass is bit-identical

• Category: perf
• Class: A (per-frame op order and rounding unchanged; both channels' fader is applied before
  the matrix reads either, exactly as today)
• Severity: high
• Location: crates/builtins/src/lib.rs:1926-1930 (FaderRampStage::process),
  crates/builtins/src/lib.rs:1932-1948 (process_plane, settled arm),
  crates/builtins/src/lib.rs:2170-2181 (MatrixStage::process, settled arm); the two are
  separate BankSlots built at crates/graph/src/runtime.rs:1286-1299 from separate
  GraphPreparedBuiltinBanks.
• Current code:

    // FaderRampStage::process
    fn process(&mut self, left: &mut [f32], right: &mut [f32], frames: usize) {
        self.process_plane(0, left, frames);
        self.process_plane(1, right, frames);
    }
    // FaderRampStage::process_plane, settled arm
        if maximum == 0 {
            gain_mute_block::<L>(plane, frames, self.ramp[channel].current, self.ramp[channel].mute);
            return;
        }
    // MatrixStage::process, settled arm
        if maximum == 0 {
            matrix2x2_block::<L>(left, right, frames, &self.coef);
            return;
        }

• Problem: in the steady state (nothing ramping, which is every block of a session that is not
  mid-move) the fader/matrix tail of the strip traverses the resident block three times:
  gain_mute_block(left) (1 load + 1 store per word), gain_mute_block(right) (1 + 1), then
  matrix2x2_block(left, right) (2 loads + 2 stores per frame). Total 4 loads + 4 stores per
  frame-pair for 6 lane-ops of arithmetic (fader 2 + pan matrix 4 in the identity inventory).
  A fused kernel needs 2 loads + 2 stores. On the dispatch_only/gain_pan_only rows — 22
  lane-ops of arithmetic measuring 31.9 % / 32.4 % of floor — that is 4 of the 8 memory ops
  removed from a row whose problem is precisely memory ops. Both stages are SeamSide::PostFader
  / PostMatrix, i.e. both seam-side, so the mono collapse never separates them, and since Signal-path architecture audit: one byte through EQ → compressor → limiter #202
  rec 2 they are consecutive slots of the same merged chain on every intended-strip cohort.
• Proposed change: add one kernel to crates/lane/src/kernels/builtins.rs:

/// The settled fader/mute + settled 2x2, in one frame loop. Frozen order, per frame:
/// 1. `l = load(left)`, `r = load(right)`
/// 2. `l = andnot(mul(l, g0), mute0)`   // gain_mute_block's exact body, channel 0
/// 3. `r = andnot(mul(r, g1), mute1)`   // channel 1
/// 4. `left'  = fma(lr, r, mul(ll, l))` // matrix2x2_block's exact body
///    `right' = fma(rr, r, mul(rl, l))`
/// 5. `store(left, left')`, `store(right, right')`
#[inline(always)]
pub fn fader_matrix_block<L: Lane>(
    left: &mut [f32], right: &mut [f32], frames: usize,
    g: [L; 2], mute: [L::Mask; 2], c: &Matrix2x2Coef<L>,
) { /* … */ }

Then add a fused builtin bank (builtins::BuiltinFaderMatrixBank) that the graph binds as one
BankSlot when (a) neither stage is ramping and (b) nothing observes or taps the post-fader
node — condition (b) is already computed at bind by chains_into
(crates/graph/src/runtime.rs:2686-2731), which declines the merge on exactly those cases.
Keep the two separate stages as the fallback arm, dispatched by the same maximum == 0 gate the
two stages already use, so a ramping block runs byte-identical work to today.

• Expected effect: −2 loads and −2 stores per frame per cohort per block (−1 load, −1 store per
  lane-sample per channel), and one fewer dyn BankStage dispatch and one fewer enum match per
  cohort per block. Against a 6-lane-op arithmetic budget this is the dominant term.
• Rulings / constraints checked: the fader's andnot mute and the matrix's
  fma(lr, r, ll.mul(l)) are copied verbatim; each channel's fader is independent per frame and
  the matrix reads both post-fader values from the same frame, which is what the two-pass form
  already computes. BankChain::run's seam comment (crates/rack/src/lib.rs:1694-1701) explicitly
  forbids rewriting ll*l + lr*r as (ll+lr)*l — this proposal does not touch that expression.
  Not cross-bank-interleave.md (that is two independent banks; these are producer/consumer in
  one chain). Not stationary-smoother-hoist-boundary.md (no ramp arithmetic is skipped).
• Verification gate: cargo test -p builtins (tests/fader_ramp.rs, tests/matrix.rs,
  tests/stage.rs, tests/mono_collapse.rs), cargo test -p rack --test console_bank,
  cargo test -p graph, workspace fixture bit-identity; then
  sixty_four_track_gain_pan_only and sixty_four_track_dispatch_only in
  scripts/run-console-benchmark.sh.

---

RT-5: refresh_channel_symmetry spills up to 240 SIMD registers to the stack per drained record and on every ramping block (issue #238)

• Category: perf
• Class: A (control-plane bookkeeping; compares stored words, moves no rendered bit)
• Severity: high
• Location: crates/builtins/src/lib.rs:1036-1044 (refresh_channel_symmetry),
  crates/builtins/src/lib.rs:1632-1690 (compute_lane_channel_symmetry),
  crates/builtins/src/lib.rs:817-822 (lane_read); callers at
  crates/builtins/src/lib.rs:1027, 1095, 1256, 1337, 1516.
• Current code:

    fn refresh_channel_symmetry(&mut self) {
        let mut symmetry = 0_u8;
        for lane in 0..MAX_BANK_LANES {
            if self.compute_lane_channel_symmetry(lane) {
                symmetry |= 1 << lane;
            }
        }
        self.symmetry = symmetry;
    }
    // …
    fn compute_lane_channel_symmetry(&self, lane: usize) -> bool {
        if lane >= self.members || lane >= L::WIDTH { return false; }
        for (left_word, right_word) in [
            (self.coef.trim[0], self.coef.trim[1]),
            (self.ramp.target[0], self.ramp.target[1]),
            (self.ramp.step[0], self.ramp.step[1]),
        ] {
            if lane_read::<L>(left_word)[lane].to_bits()
                != lane_read::<L>(right_word)[lane].to_bits() { return false; }
        }
        // … then 2 sections x 6 coefficient words, each two more `lane_read` calls
    }

• Problem: lane_read::<L>(value) is value.store(&mut words[..L::WIDTH]) — a whole SIMD
  register spilled to a stack array so that one lane can be indexed out of it
  (crates/builtins/src/lib.rs:817-822). compute_lane_channel_symmetry performs up to 30 such
  spills for one lane (3 ramp word pairs + 2 sections × 6 coefficient pairs = 15 pairs), and
  refresh_channel_symmetry repeats the whole thing for all 8 lanes — re-spilling the very same
  30 registers eight times over. Worst case 240 vector stores + 240 scalar loads + 240 compares
  per call. It is called (a) once per drained trim/polarity record via set_trim_signed
  (crates/builtins/src/lib.rs:1095), and (b) once per bank per block on every ramping block
  (crates/builtins/src/lib.rs:1256, 1337). Issue refresh_channel_symmetry is O(records×lanes) under sustained per-block record traffic #238 measures the record path at +51 % on an
  8-track probe (8.46 vs 5.60 µs/block) and ~20 µs worst-case at 64 tracks. The comment at
  crates/builtins/src/lib.rs:922-932 correctly identifies the spill as the reason the flag is
  cached at all, but the maintenance path itself pays the full cost.
• Proposed change: two independent fixes, both in crates/builtins/src/lib.rs.
  1. O(changed) refresh. set_trim_signed(lane, …) writes exactly one lane's words. Replace the
     whole-bank walk with self.refresh_lane_symmetry(lane), which recomputes one bit:

     fn refresh_lane_symmetry(&mut self, lane: usize) {
         let bit = 1_u8 << lane;
         if self.compute_lane_channel_symmetry(lane) { self.symmetry |= bit }
         else { self.symmetry &= !bit }
     }

     This is the repair shape issue refresh_channel_symmetry is O(records×lanes) under sustained per-block record traffic #238's verifier names. Same for settle/mirror_trim_ramp:
     only lanes with a nonzero countdown can change, so the ramping-block refresh becomes a walk
     over the ramping lane set, not all eight.
  2. Spill each register once, not once per lane. Restructure
     compute_lane_channel_symmetry into a whole-bank compute_symmetry_mask(&self) -> u8 that
     lane_reads each of the 30 words once into [f32; 8] arrays and then derives all eight
     bits from those arrays. 30 spills instead of 240. Keep the per-lane function as a
     #[cfg(debug_assertions)] oracle so lane_channel_symmetry's existing staleness assertion
     (crates/builtins/src/lib.rs:1572-1580) still re-derives the definition independently.
• Expected effect: the record path drops from O(records × lanes × 30 spills) to
  O(records × 30 spills) — an 8× reduction, retiring refresh_channel_symmetry is O(records×lanes) under sustained per-block record traffic #238's measured +51 %. The ramping-block path
  drops from 240 spills per bank per block to 30 (or to zero for non-ramping lanes).
• Rulings / constraints checked: builtins-input-liveness-d2.md requires the witness to compare
  the live trim word, not the prepared one, and to be refreshed by all five writers — both
  fixes preserve that (fix 1 refreshes at the same call sites, fix 2 changes only how the same
  words are read). The symmetry: u8 bitmask must stay a u8: crates/builtins/src/lib.rs:970-976
  records that size_of::<InputStage<L>>() is sealed accounting in the builtin-compiler mutation
  matrix. Neither fix adds a field.
• Verification gate: cargo test -p builtins --test input_liveness --test input_liveness_mono --test mono_collapse (the debug staleness assertion re-proves the cache on every block every
  test renders), cargo test -p rack --test mono_reengage, then re-run refresh_channel_symmetry is O(records×lanes) under sustained per-block record traffic #238's synthetic
  dense-automation probe and compare against 8.46 µs/block.

---

RT-6: the per-block collapse dispatch makes lanes × slots dyn calls where slots byte loads would do

• Category: perf
• Class: A (non-arithmetic dispatch bookkeeping)
• Severity: medium
• Location: crates/rack/src/lib.rs:1428-1441 (BankChain::lane_symmetry),
  crates/rack/src/lib.rs:1465-1470 (all_lanes_symmetric),
  crates/rack/src/lib.rs:1481-1486 (all_lanes_preserve_agreement); read from
  crates/rack/src/lib.rs:1590 and 1615.
• Current code:

    pub fn lane_symmetry(&self, lane: usize) -> ChannelSymmetryWitness {
        if !self.active.get(lane).copied().unwrap_or(false) {
            return ChannelSymmetryWitness::DECLINED;
        }
        let mut witness = ChannelSymmetryWitness::SYMMETRIC;
        for slot in &self.slots {
            if slot.active_lanes.get(lane).copied().unwrap_or(false) {
                witness = witness.and(slot.stage.lane_symmetry(lane));
            }
        }
        witness
    }
    pub fn all_lanes_symmetric(&self) -> bool {
        (0..self.lanes).filter(|lane| self.active[*lane])
            .all(|lane| self.lane_symmetry(lane).eligible())
    }

• Problem: the doc at crates/rack/src/lib.rs:1413-1417 claims "the per-block cost of the whole
  witness is an and over slots * lanes cached flags plus one stored byte per console-driven
  lane" — the flags are cached, but each one is reached through a virtual call
  slot.stage.lane_symmetry(lane) on Box<dyn BankStage>. For a 5-slot, 8-lane cohort that is
  40 indirect calls per chain per block (80 when the M3 agreement walk also runs), each with
  two bounds-checked .get() calls around it. Eight cohorts → 320–640 indirect calls per block,
  all to functions that return a byte. Note that M3's dispatch reads an uncached symmetry witness: +39-42% on dispatch-dominated rows, +4.5% on the dual mono arm (#230 regression) #235 already had to repair a regression on this
  exact path ("+39–42 % on the dispatch-dominated rows", crates/rack/src/lib.rs:1578-1587), which
  is evidence that this walk is measurable.
• Proposed change: add one method to BankStage in crates/rack/src/lib.rs, defaulted so no
  implementor is forced to change:

/// This stage's witness for every lane at once, as `[u8; 8]` of `ChannelSymmetryWitness` terms.
/// `MAX_BANK_LANES` is 8, so lane `l` is index `l`. Default derives it from `lane_symmetry`.
fn lane_symmetry_terms(&self) -> [u8; 8] {
    core::array::from_fn(|lane| self.lane_symmetry(lane).terms())
}

EffectBankStage and ConsoleEffectBankStage already hold designed: Box<[bool]> and the
per-lane EffectControlLane::symmetry() byte, so both can fill the array with no extra work;
BuiltinStage forwards to InputStage::symmetry, which is already the u8 mask this wants
(RT-5). all_lanes_symmetric then becomes: one dyn call per slot, an and of slots arrays,
and one masked compare against the active-lane mask. Fold the active-lane test into a
precomputed active_mask: u8 on BankChain (see RT-8).

• Expected effect: 40 indirect calls per chain per block → 5; the bounds-checked .get() pairs
  disappear entirely. On the dispatch-dominated rows this is the same class of work M3's dispatch reads an uncached symmetry witness: +39-42% on dispatch-dominated rows, +4.5% on the dual mono arm (#230 regression) #235 measured
  at ±40 %.
• Rulings / constraints checked: the declining default (ChannelSymmetryWitness::DECLINED) must
  survive — from_fn over the existing lane_symmetry preserves it exactly, and an implementor
  that does not override behaves identically. Terms are already a u8 bitset
  (crates/effect-contract/src/symmetry.rs:130-146).
• Verification gate: cargo test -p rack --test mono_reengage --test console_bank,
  cargo test -p builtins --test mono_collapse; bank_collapse_counters and
  bank_collapse_transitions on the console fixture must be unchanged; then the
  sixty_four_track_dispatch_only row.

---

RT-7: the mixed input-chain kernel reads its plan-invariant elision plan inside the frame loop

• Category: perf
• Class: A
• Severity: medium
• Location: crates/lane/src/kernels/builtins.rs:857-916 (mixed_chain_block), dispatched from
  crates/lane/src/kernels/builtins.rs:796-808 (input_chain_block_elided).
• Current code:

        for (channel, frame) in [left_frame, right_frame].into_iter().enumerate() {
            let x = L::load(frame);
            let bad = L::mask_not(x.abs().lt(limit));
            count[channel] = count[channel].add(one.andnot(L::mask_not(bad)));
            let mut v = x.andnot(bad).mul(c.trim[channel]);
            let mut run = false;
            for section in 0..2 {
                if plan.elided[channel][section] {
                    run = true;
                    continue;
                }
                if run { v = v.add(zero); run = false; }
                let coefficient = &c.section[channel][section];
                let v0 = v;
                let (v1, v2) = svf_step(v0, nc1[channel][section],
                    coefficient.a2, coefficient.a3, &mut state[channel][section]);
                v = coefficient.m2.fma(v2, coefficient.m1.fma(v1, coefficient.m0.mul(v0)));
            }
            if run { v = v.add(zero); }

• Problem: plan is decided once at construction and cannot change for the life of a settled
  bank (crates/lane/src/kernels/builtins.rs:716-745 argues this at length). Yet the frame body
  loads plan.elided[channel][section] and branches on it 4 times per frame (2 channels × 2
  sections), plus maintains the run flag with 2 more tests per channel per frame. The
  all-elided and none-elided shapes are already specialised into their own bodies
  (identity_chain_block, input_chain_block); the mixed shape — which is the ordinary
  configuration of a track with an HPF and no LPF, or vice versa — is not. plan is behind a
  &InputChainPlan shared reference while left/right are &mut [f32], so LLVM may unswitch
  the loop, but nothing forces it and nothing tests that it did. This is the builtins analogue of
  the named gap term "the block elision gate's five integer comparisons per lane-sample" that
  effect-floor-accounting.md charges against the EQ row.
• Proposed change: monomorphise the mixed body over the two per-channel patterns and dispatch
  once per block:

#[inline(always)]
fn mixed_chain_block_const<L: Lane, const E00: bool, const E01: bool,
                                   const E10: bool, const E11: bool>(
    left: &mut [f32], right: &mut [f32], frames: usize,
    c: &InputChainCoef<L>, s: &mut InputChainState<L>,
) -> InputChainReport<L> { /* same body, `plan.elided[ch][sec]` replaced by the const */ }

and in input_chain_block_elided, match the 16 [[bool;2];2] patterns (the two already
special-cased plus the 14 mixed ones) to the right instantiation. The body stays one source
text; only the branch source changes from a memory load to a const. The same treatment applies
to input_chain_block_mono_elided (crates/lane/src/kernels/builtins.rs:1098).

• Expected effect: removes 4 loads + 4 well-predicted branches + 4 flag updates per frame per
  bank in the mixed shape (the common one-filter-enabled configuration), and lets the compiler
  hoist the now-dead nc1/state slots of the elided section out of the loop entirely.
• Rulings / constraints checked: class A by input_chain_block_elided's own derivation
  (crates/lane/src/kernels/builtins.rs:779-793): the emitted arithmetic per frame is unchanged,
  only the branch source moves. The elision plan's staleness argument
  (crates/lane/src/kernels/builtins.rs:722-737) is untouched — the plan is still read once, just
  outside the loop. Watch the code-size cost: 14 extra instantiations of a #[inline(always)] body
  per width; if that is unacceptable, instantiate only over the four reachable section patterns
  the compiler emits ([hpf on, lpf off], [hpf off, lpf on] × 2 channels).
• Verification gate: cargo test -p lane --test input_chain_elision (which already sweeps
  every section pattern at every width) and --test sanitise_counter;
  cargo test -p builtins --test stage --test response; then
  objdump -d the mixed_chain_block instantiation and confirm no plan load remains inside the
  frame loop; then sixty_four_track_builtins_only.

---

RT-8: BankChain::run re-derives three plan-invariant any() walks over every slot's lane mask on every block

• Category: perf
• Class: A
• Severity: medium
• Location: crates/rack/src/lib.rs:1565, 1684, 1709 (all slot.active_lanes.iter().any(|lane| *lane));
  the mask is fixed at construction (crates/rack/src/lib.rs:1277-1281, 1356).
• Current code:

        for slot in &mut self.slots {
            if slot.active_lanes.iter().any(|lane| *lane) {
                slot.stage.begin_block(first_sample)?;
            }
        }
        // …
        for slot in &mut self.slots[..prefix] {
            if slot.active_lanes.iter().any(|lane| *lane) {
                let block = BankBlock { /* … */ };

• Problem: active_lanes is a Box<[bool]> validated once in BankChain::new and never
  written afterwards — crates/rack/src/lib.rs:1356 asserts every slot's mask equals the chain's
  active. The any() walk is therefore a plan-invariant answer re-derived up to three times per
  slot per block (the begin_block loop, the main slot loop, and the collapsed seam-side loop),
  each walk being up to 8 byte loads plus a branch, through a Box<[bool]> indirection that costs
  a pointer chase per slot. For 8 cohorts × 5 slots that is ~120 pointer chases and up to 960 byte
  loads per block, for a value that is true on essentially every slot the engine builds.
• Proposed change: store the answer once. Add active: bool (or better, active_mask: u8,
  which RT-6 also wants) to BankSlot in crates/rack/src/lib.rs:1063-1067, computed in
  BankChain::new where the mask is already being validated, and replace all three sites with
  if slot.active { … }. The Box<[bool]> stays for lane_symmetry's per-lane query, or is
  replaced outright by the u8 mask (MAX_BANK_LANES is 8, so a u8 indexes it exactly — the
  same argument InputStage::symmetry already makes at crates/builtins/src/lib.rs:970-976).
• Expected effect: −3 pointer chases and up to −24 byte loads + −3 branches per slot per block;
  ~1 000 memory ops per block on the 64-track fixture. Zero risk.
• Rulings / constraints checked: pure bookkeeping; no kernel, no coefficient, no dispatch
  decision changes. inactive_lanes_are_never_gathered_or_scattered
  (crates/rack/src/lib.rs:3021) is the existing gate on the semantics.
• Verification gate: cargo test -p rack; bank_shape and qualification_counters on the
  console fixture unchanged.

---

RT-9: a single armed observer or send tap forces two extra whole-block transposes per cohort, because the chain merge declines instead of teeing

• Category: architecture / perf
• Class: A
• Severity: medium
• Location: crates/graph/src/runtime.rs:2686-2731 (chains_into),
  crates/graph/src/runtime.rs:2770-2838 (cohort_runs).
• Current code:

        if readers[*before].len() != 1 || readers[*before][0] != *after {
            return false;
        }
        if producer.output == program.output { return false; }
        let node = &spec.nodes[producer.node as usize].id;
        if parts.observers.contains_key(node) { return false; }
        if program.taps.iter().filter(|tap| tap.after_op as usize == *before)
            .any(|tap| parts.observers.contains_key(&spec.nodes[tap.node as usize].id))
        { return false; }

• Problem: Signal-path architecture audit: one byte through EQ → compressor → limiter #202 rec 2 reduced the intended fixture from "8 groups × {builtins, simd1, simd2} =
  24 chains where 8 will do" to 8 merged chains — but only for cohorts where every boundary is
  invisible. Any one of: a bound meter observer on a stage node, an armed send tap, a second reader
  of the intermediate buffer, or the node being the session output, declines the merge for that
  boundary and reinstates a full planar round trip: the upstream chain scatters all lanes to
  planar, and the downstream chain immediately gathers them all back. That is 2 loads + 2 stores
  per lane-sample per plane (4 with RT-1 unfixed) for information that never leaves AoSoA. Given
  that AGENTS.md makes send taps first-class at seven documented boundaries and "meters may
  observe any boundary without changing signal flow", the declining case is not exotic — it is
  what a mixing session looks like. Boundary 5 measured 18.0 % of floor with these round trips as
  the named cause.
• Proposed change: the observer/tap clause does not need a round trip — it needs the
  intermediate to be readable in planar form. Add a tee scatter to BankChain: a slot
  boundary may be marked as observed, and after that slot the chain scatters the resident block to
  the lanes' planar buffers and keeps going on the resident block, with no re-gather.

// crates/rack/src/lib.rs
/// Slot indices after which this chain also writes its lanes' planar buffers, for a reader that
/// is not the chain (a meter, a send route). Empty on every chain that has none, tested once per
/// block with `is_empty` exactly as `fold`/`aux` are.
tee: Box<[u32]>,
pub fn arm_tee(&mut self, after_slots: Box<[u32]>) { … }

chains_into then splits into two verdicts: mergeable (as today) and mergeable with a tee
(the observer/tap clause and the "second reader" clause, provided every second reader only
reads). The delayed-input, sidechain and multi-input clauses stay hard declines.

• Expected effect: an observed or tapped boundary costs one scatter instead of one scatter plus
  one gather — halves that boundary's transpose cost, and on the intended strip turns a
  metered session from 24 chains back toward 8-plus-tees. Honest caveat: I have not measured how
  often the decline actually fires on the shipped console fixtures; the estimate is structural.
• Rulings / constraints checked: cross-bank-interleave.md is a different candidate (fusing
  independent banks' frame loops); this is about dependent slots already in one cohort, which
  Graph layer builds single-slot bank chains — the multi-slot transpose saving exists and is not taken #181/Signal-path architecture audit: one byte through EQ → compressor → limiter #202 established as the right shape. The tee writes exactly the words the declined merge's
  scatter would have written, so an observer sees identical bits. BankMembers::fold_plane's
  contract note (crates/rack/src/lib.rs:1104-1120) — "a chain that arms this is asserting that
  nothing reads the lane's planar buffer" — is the inverse obligation and stays intact: a tee is
  the case where something does read it.
• Verification gate: cargo test -p graph (the chains_into/cohort_runs unit tests around
  crates/graph/src/runtime.rs:2839+), cargo test -p rack --test console_bank;
  bank_transposes() on a metered fixture must fall while rendered PCM is bit-identical
  (cargo test -p conformance); then sixty_four_track_idle.

---

RT-10: meters are a fully scalar per-track third pass over the audio; the AoSoA block they could read is thrown away first

• Category: perf / architecture
• Class: A for the lane-generic rewrite (each track keeps its own left-to-right f64 energy
  accumulation); N/A for the placement change
• Severity: medium
• Location: crates/builtins/src/lib.rs:3625-3663 (observe_segment),
  crates/builtins/src/lib.rs:3430-3524 (MeterAccumulator::observe); reached per node from
  crates/graph/src/runtime.rs:1187-1201 (observe).
• Current code:

    for sample in samples.iter().copied() {
        let invalid = !normal_or_zero(sample);
        let sample = if invalid { 0.0 } else { sample };
        sanitized += u64::from(invalid);
        let absolute = sample.abs();
        peak = if absolute > peak { absolute } else { peak };
        energy += f64::from(sample) * f64::from(sample);
        clipped += u64::from(absolute >= 1.0);
        if absolute >= held {
            held = absolute;
            hold_remaining = window.hold_frames;
        } else if hold_remaining > 0 {
            hold_remaining -= 1;
        } else if window.decay_enabled {
            held = flush_subnormal(held * window.decay);
        }
    }

• Problem: one armed meter on a banked track costs a scalar loop over the whole planar block,
  twice (left, right), on top of the kernel's own store and D7's boundary scan — the comment at
  crates/builtins/src/lib.rs:3471-3474 names it "a third full read of the same audio… with a
  serial f64 energy dependency and four branches per sample per channel". Eight metered lanes in
  a cohort run eight independent scalar loops where the audio was, moments earlier, sitting in an
  AoSoA block in which all eight lanes are one vector. The silence early-out
  (crates/builtins/src/lib.rs:3486-3492) makes an idle session cheap but does nothing for a
  session carrying signal, which is every session being mixed. f32::abs, the > select, the
  >= 1.0 count and the held-peak state machine are all per-lane-independent and therefore
  vectorise across tracks with no change to any track's own operation order.
• Proposed change: two steps, the second optional.
  1. Placement. Meter the resident AoSoA block rather than the scattered planes, as a
     BankStage (or as part of the tee of RT-9), so the load is the one the scatter is doing
     anyway. Add builtins::BuiltinMeterBank implementing
     GraphPreparedBuiltinBankProcessor, holding one MeterLane state set per lane in
     Lane-typed words (peak: L, held: L, hold_remaining: L, plus per-lane exact-integer
     f32 counters for clipped/sanitized — the same representation
     input_chain_block already uses for its sanitized count at
     crates/lane/src/kernels/builtins.rs:435).
  2. Vectorise. All of peak, held, hold_remaining, clipped, sanitized become
     L-typed with select/andnot, exactly as observe_segment's doc already demands
     (peak is "the D8 select form select(a > p, a, p), never f32::max"). energy is the
     only blocker: it is f64 and its left-to-right order per track is fixed. Options, in
     increasing cost: (a) leave energy as a scalar per-lane loop and vectorise the rest — the
     f64 chain is 8 lanes × 1 add of ~4-cycle latency, which then overlaps with vector work
     instead of serialising against 10 other scalar ops; (b) add an f64 lane type to
     crates/lane (wide::f64x4) — that is a new backend surface and a width-identity obligation,
     so flag it, do not do it under this finding.
• Expected effect: step 1 removes one full block load per channel per metered track per block.
  Step 2(a) removes roughly 9 of the ~11 scalar ops per sample per channel per metered track,
  replacing them with 1/W of a vector op. Honest caveat: no measurement exists for the metered
  rows — effect-floor-accounting.md has no meter inventory at all, which is itself worth fixing.
• Rulings / constraints checked: vectorising across tracks is exactly the banking premise
  AGENTS.md states ("banking regroups lanes; it never changes per-lane arithmetic"), so each
  track's peak/held/energy sequence is bit-identical. simd-wrapper-around-scalar-inner-loop.md
  is not a bar here: this replaces the scalar inner loop, it does not wrap it. f32::max remains
  forbidden; the select form is preserved. No true-peak or LUFS meter exists in builtins
  today, so there is no duplication with true-peak-limiter's Annex-2 estimator to remove — but
  when one is added, the 12-tap × 4-phase filter in crates/true-peak-limiter/src/lib.rs must be
  the shared kernel, not a second copy.
• Verification gate: cargo test -p builtins --test meter (which pins peak/hold/decay/RMS
  semantics), plus a new width-sweep test in the shape of
  crates/lane/tests/input_chain_elision.rs proving Scalar/Simd4/Simd8 produce identical
  MeterSnapshot words; then a metered console-benchmark row.

---

RT-11: the tile transpose crosses an [[f32; W]; W] by-value boundary in both directions

• Category: simd
• Class: A
• Severity: medium
• Location: crates/effect-contract/src/lib.rs:234-250 (transpose_tile_4, transpose_tile_8),
  consumed by crates/rack/src/lib.rs:256-278 (tile_gather) and
  crates/rack/src/lib.rs:281-300 (tile_scatter).
• Current code:

#[inline(always)]
pub fn transpose_tile_8(rows: [[f32; 8]; 8]) -> [[f32; 8]; 8] {
    Simd8::transpose(rows.map(Simd8::new)).map(Simd8::to_array)
}
// tile_gather:
    for (tile, block) in destination.chunks_exact_mut(W * W).enumerate() {
        let base = tile * W;
        let mut rows = [[0.0_f32; W]; W];
        for (row, plane) in rows.iter_mut().zip(planes.iter()) {
            row.copy_from_slice(&plane[base..base + W]);
        }
        for (chunk, row) in block.chunks_exact_mut(W).zip(transpose(rows)) {
            chunk.copy_from_slice(&row);
        }
    }

• Problem: the transpose's natural type is eight vector registers; its declared type is a
  256-byte stack array, entered via [[f32;8];8] and left via .map(to_array) into another
  256-byte stack array. Everything is #[inline(always)], so LLVM usually forwards the loads and
  keeps the tile in ymm0-7 — but the 8×8 case needs all 16 architectural ymm registers to hold
  input and output simultaneously, which is precisely the register-pressure ceiling
  cross-bank-interleave.md documents ("SVF_CASCADE_DEPTH = 2 is at the 16-ymm register
  ceiling"). Any spill here costs 64 stack words per tile per plane, and nothing in the tree tests
  that it does not happen.
• Proposed change: publish a lane-typed transpose beside the array one in
  crates/effect-contract/src/lib.rs, and let the rack use it:

/// `out[k][lane] == rows[lane][k]`, in registers. The array form calls this.
#[inline(always)]
pub fn transpose_lanes_8(rows: [Simd8; 8]) -> [Simd8; 8] { Simd8::transpose(rows) }

tile_gather then does rows[i] = L::load(&plane[base..]) and
transpose_lanes(rows)[k].store(&mut block[k*W..]); tile_scatter likewise. No [[f32;W];W]
is ever materialised. Keep transpose_tile_4/_8 as the array-typed wrapper for the existing
tests and for #[must_use] callers.

• Expected effect: unknown until measured, and I am explicit about that: if LLVM was already
  forwarding, this is zero; if it was spilling the 8×8 case, it is 128 stack words per tile per
  plane. The point is that the current shape leaves it to the inliner and the tree has no gate on
  the answer. Cheap to measure, cheap to do.
• Rulings / constraints checked: stays inside crates/effect-contract, which already owns the
  SIMD vocabulary for the tile ("the SIMD vocabulary is the contract's dependency, not the
  rack's", crates/effect-contract/src/lib.rs:230-232) and already names Simd4/Simd8 through
  the lane crate's neutral re-export. No new unsafe, no intrinsics, no runtime dispatch.
• Verification gate: objdump -d the gather_tiled::<ArenaMembers, 8> and
  scatter_tiled::<ArenaMembers, 8> instantiations before and after and count vmovups
  to/from rsp; cargo test -p rack (tiled_transpose_matches_the_scalar_path_bit_for_bit);
  sixty_four_track_idle.

---

RT-12: the executor's block loop indexes units twice per unit and walks every bank member looking for observers that are not there

• Category: perf
• Class: A
• Severity: medium
• Location: crates/graph/src/lib.rs:1417-1420 (the loop),
  crates/graph/src/runtime.rs:889-935 (Runtime::execute),
  crates/graph/src/runtime.rs:938-953 (Runtime::observe_unit),
  crates/graph/src/runtime.rs:1187-1201 (observe).
• Current code:

        for unit in 0..runtime.units.len() {
            runtime.execute(unit, time.absolute_sample)?;
            runtime.observe_unit(unit, time.absolute_sample)?;
        }

    pub(crate) fn observe_unit(&mut self, index: usize, first_sample: u64) -> Result<(), RenderError> {
        let Self { lease, units, .. } = self;
        match &mut units[index] {
            RuntimeUnit::Op(op) => observe(op, lease, first_sample),
            RuntimeUnit::Bank { members, .. } => {
                for member in members.iter_mut() { observe(member, lease, first_sample)?; }
                Ok(())
            }
        }
    }

• Problem: this is the concrete shape of the named gap term "the graph's per-node dispatch".
  Per unit per block the loop pays: two bounds-checked units[index] indexings, two
  re-destructurings of Runtime (re-loading lease, delays, track_delays, bank_inputs,
  bank_outputs from memory), and two RuntimeUnit enum matches. Worse, observe_unit on a bank
  walks every member op — slots × lanes, up to 40 for a 5-slot 8-lane cohort — calling
  observe, which loads op.observers' pointer and length and returns. On an unobserved plan
  (the common case) that is ~320 pointless calls plus 640 pointer loads per block on the 64-track
  fixture, for a question whose answer was fixed at bind. The enum match itself is fine and cheap;
  the redundant indexing and the observer walk are not.
• Proposed change: destructure Runtime once, iterate by reference, and cache the observer
  question at bind:

// crates/graph/src/runtime.rs
pub(crate) struct Runtime { /* … */ observed: Box<[bool]>, /* one per unit, set in `new` */ }

pub(crate) fn render_block(&mut self, first_sample: u64) -> Result<(), RenderError> {
    let Self { lease, delays, track_delays, units, bank_inputs, bank_outputs, observed, .. } = self;
    for (index, unit) in units.iter_mut().enumerate() {
        execute_unit(unit, lease, delays, track_delays, bank_inputs, bank_outputs, first_sample)?;
        if observed[index] { observe_unit_inner(unit, lease, first_sample)?; }
    }
    Ok(())
}

GraphExecutor::render then calls runtime.render_block(time.absolute_sample)?.
observed[i] is any member has a non-empty observers list, computed in Runtime::new, which
already walks the units to find widest (crates/graph/src/runtime.rs:855-866).

• Expected effect: −2 bounds checks and −1 struct re-load per unit per block; the entire
  observer walk disappears from unobserved plans (−320 calls, −640 loads per block on the 64-track
  fixture). Also, PreparedPlanExecutor::render's per-block output.plane_mut(0)? /
  plane_mut(1)? pair (crates/graph/src/lib.rs:1421-1423) copies the whole master block out of
  the arena into the host planes every block; binding the output node's buffer to the host's planes
  would remove 2 × quantum words of copying per block, but that is a larger ownership change and
  I flag it rather than propose it here.
• Rulings / constraints checked: no arithmetic, no ordering, no dispatch decision changes; the
  units are still executed in the same order, and observers still run after their unit's execute.
  REALTIME_POLICY_BEGIN/END markers move with the code.
• Verification gate: cargo test -p graph, cargo test -p engine --test observation_transport;
  observation_binding_counts() unchanged on an observed fixture; then
  sixty_four_track_dispatch_only and sixty_four_track_idle.

---

RT-13: BufferArena is allocated per plan, threaded through the render signature, and never touched by the only production executor

• Category: dead-code / architecture
• Class: N/A
• Severity: medium
• Location: crates/engine/src/realtime/buffer.rs:36-125 (the whole type),
  crates/engine/src/realtime/plan.rs:176-184 (PreparedPlanExecutor::render's arena parameter),
  crates/engine/src/realtime/plan.rs:427 (the arena: BufferArena field),
  crates/graph/src/lib.rs:1396-1400 (the only production implementor, which names it _arena),
  crates/graph/src/lib.rs:1037 (scratch: &[] — the graph passes an empty spec list).
• Current code:

// crates/graph/src/lib.rs
    fn render(
        &mut self,
        _arena: &mut BufferArena,
        _input: Option<PlanarBufferRef<'_>>,
        mut output: PlanarBufferMut<'_>,
        time: engine::realtime::RenderTime,
    ) -> Result<(), RenderError> {

• Problem: the render graph's audio lives in DisjointArena, reached through ArenaLease
  (crates/graph/src/runtime.rs:14-22). BufferArena is a second, unrelated planar-storage type
  that survives from issue 003's reference renderer. The graph plan constructs its
  PreparedRenderPlan with scratch: &[], so the allocation is zero-length, but the type, its
  BufferIndex/PlanarBufferSpec/BufferArenaError vocabulary, its range/plane/plane_mut
  checked accessors and the &mut BufferArena parameter on the render trait are all carried by
  every plan and every executor for nothing. The only implementors are GraphExecutor (ignores it)
  and a test HandoverExecutor (crates/engine/src/realtime/mod.rs:224-232, also ignores it).
  RenderError::Buffer(BufferArenaError) keeps a whole error variant alive for it.
  docs/REALTIME_MEMORY.md still describes BufferArena as the prepared PCM storage, so the
  document and the code disagree.
• Proposed change: delete the arena parameter from PreparedPlanExecutor::render and the
  arena: BufferArena field from PreparedRenderPlan; keep PlanarBufferRef/PlanarBufferMut
  (they are the host I/O boundary and are genuinely used) and move them to their own
  crates/engine/src/realtime/planar.rs; delete BufferArena, BufferIndex and
  PlanarBufferSpec, or — if the reference silence renderer is still wanted — reduce it to filling
  io.output directly, which is what render_inner's else arm already does
  (crates/engine/src/realtime/plan.rs:761-767). Update docs/REALTIME_MEMORY.md's "Prepared
  memory" section to describe DisjointArena as the render storage.
• Expected effect: ~130 lines of buffer.rs deleted, one parameter off the render hot
  signature, one field off every plan, one error variant retired, and the memory document made true.
• Rulings / constraints checked: none apply — this is removal of unreachable code, not a
  behaviour change. PrepareRenderPlan::scratch is a public field, so the C ABI
  (crates/capi) must be checked for callers that pass a non-empty spec list before deleting.
• Verification gate: cargo check --workspace --all-targets; cargo test -p engine;
  scripts/check-capi-abi.sh; scripts/check-realtime-policy.sh.

---

[tamashi095]

Audit report — Render path: engine / builtins / rack / graph executor (RT-*), part 2/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

RT-14: the arena lease's wave/mute machinery is unreachable, and its mute redirect costs a load, a mask and a select on every buffer access

• Category: dead-code / perf
• Class: A
• Severity: medium
• Location: crates/engine/src/realtime/disjoint.rs:208-232 (effective, checked_write),
  crates/engine/src/realtime/disjoint.rs:166-206 (wave, set_muted, is_muted); the single
  lease is built at crates/graph/src/runtime.rs:1774-1784.
• Current code:

    #[inline]
    fn effective(&self, buffer: u32) -> usize {
        let index = buffer as usize;
        debug_assert!(index < self.arena.buffers, "read of an unreserved buffer");
        if self.access[index] & ACCESS_MUTED == 0 {
            index
        } else {
            ARENA_SILENCE_BUFFER as usize
        }
    }

• Problem: ArenaLease::set_muted and is_muted have zero production callers anywhere in
  crates/, hosts/, tools/ or sidecars/ — I grepped. wave() likewise. They exist for the
  native dependency-wave scheduler, which AGENTS.md records as removed: "the native
  dependency-wave scheduler that once justified a single Thread::unpark per block has been
  removed". build_sequential reserves every buffer into one lease
  (builder.lease(0, buffers.clone(), buffers)), so I1/I2 are trivially satisfied and
  ACCESS_MUTED can never be set. Yet every read, write_read, write_read2 and
  write_read_stereo still pays, per buffer per call, a bounds-checked self.access[index] load,
  an & ACCESS_MUTED, and a select — including inside reduce_plane's per-input loop (RT-3),
  where it is paid n times per node per plane per block. It also keeps a 771-line unsafe module
  (one of only two allowlisted in scripts/check-realtime-policy.sh:26) carrying an aliasing proof
  for a concurrency model that no longer runs.
• Proposed change: delete wave, set_muted, is_muted, the ACCESS_MUTED bit and the
  effective() redirect; effective becomes debug_assert!(index < self.arena.buffers); index.
  Keep ARENA_SILENCE_BUFFER — it is a real, reserved, never-written buffer that the lowering
  points fan-in-zero reads at. Keep ArenaLeaseSetBuilder's I1 overlap proof (it is what makes the
  unsafe sound even for one lease) and its MUTATIONS.md red tests
  (crates/graph/tests/MUTATIONS.md:57-58); drop the I2 "read not earlier" wave check only if the
  builder is simultaneously narrowed to one lease, and record that in a ruling rather than
  silently. unsafe impl Sync for DisjointArena can go with the wave model — the lease is already
  !Sync by intent.
• Expected effect: −1 bounds-checked load, −1 mask, −1 select per buffer access on every op of
  every block; on a fan-in-64 output node that is 64 of each per plane per block. Deletes ~80 lines
  of unreachable API and shrinks the standing unsafe surface's justification to something that
  matches the shipped execution model.
• Rulings / constraints checked: docs/REALTIME_DEPENDENCY_POLICY.md owns the unsafe-ownership
  argument and must be amended in the same change. AGENTS.md states that reviving multicore
  render "requires a new issue that re-earns it, not a revival", so removing its scaffolding is in
  line with the standing decision rather than a bet against it.
• Verification gate: cargo test -p engine, cargo test -p graph;
  scripts/check-realtime-policy.sh (the unsafe allowlist and the marked-region scan);
  cargo check --workspace --all-targets.

---

RT-15: rack carries the cohort planner's vocabulary — RackProgram, BankSlotKey, RackLocation — which only the compilers use

• Category: crate-boundary
• Class: N/A
• Severity: medium
• Location: crates/rack/src/lib.rs:20-140 (RackError's planning variants, RackLocation,
  BankSlotKey, RackProgram and its subsequence_mask); consumers are
  crates/rack-compiler/src/lib.rs:26, crates/graph-compiler/src/banks.rs:92,
  crates/graph-compiler/src/lib.rs:30, crates/builtins-compiler/src/lib.rs:40.
• Current code:

    pub fn subsequence_mask(&self, leader: &Self) -> Option<Box<[bool]>> {
        // …
        let mut cursor = 0usize;
        let mut mask = vec![false; leader.slots.len()];
        for slot in &self.slots {
            while cursor < leader.slots.len() && leader.slots[cursor] != *slot { cursor += 1; }
            if cursor == leader.slots.len() { return None; }
            mask[cursor] = true;
            cursor += 1;
        }
        Some(mask.into_boxed_slice())
    }

• Problem: crates/rack is the render-time bank-chain crate: AoSoaScratch, BankChain,
  BankStage, BankMembers, EffectBankStage, ConsoleEffectBankStage. RackProgram and its
  friends are a compile-time description of which effect-program slots a cohort's members share,
  used to decide bank membership — an allocating, Vec-based subsequence match. Nothing in
  crates/rack's own render path, and nothing in crates/graph's render path
  (runtime.rs/lib.rs reference RackLocation only in doc comments), reads any of it. The
  rack-compiler crate exists and already depends on rack for exactly these types.
• Proposed change: move RackLocation, BankSlotKey, RackProgram and the planning-only
  RackError variants (WidthMismatch stays — EffectBankStage::new returns it) into
  crates/rack-compiler/src/lib.rs (or a new crates/rack-compiler/src/program.rs), and have
  graph-compiler and builtins-compiler depend on rack-compiler for them. crates/rack is
  then a render-only crate whose public surface is the chain, the stages and the AoSoA scratch —
  which is what its name claims and what scripts/check-rack-policy.sh polices.
• Expected effect: ~120 lines move; rack's public surface stops mixing a render contract with
  a planner data structure; the render crate stops exporting a Vec-allocating method. No
  behaviour change. Second, smaller instance of the same shape: crates/builtins/src/lib.rs:216-460
  (BuiltinParameterDescriptor, BUILTIN_PARAMETER_DESCRIPTORS, BuiltinLatticePoints,
  builtin_parameter_lattice_points, validate_builtin_filter_cutoff) is 245 lines of
  control-plane parameter ABI and lattice metadata inside the render crate — same argument,
  destination crates/builtins-compiler; note that the descriptor table is pinned by
  scripts/check-parameter-metadata-v1.py, which would need its path updated.
• Rulings / constraints checked: AGENTS.md's crate-naming rule ("short, unprefixed"; the
  directory basename equals the package name) is unaffected; no rename is proposed, only a move.
  de-versioning-inventory.md/prefix-strip-inventory.md do not touch these names.
• Verification gate: cargo check --workspace --all-targets; scripts/check-rack-policy.sh;
  scripts/check-workspace-policy.sh; scripts/check-parameter-metadata-v1.py if the second half
  is taken.

---

RT-16: check-realtime-policy.sh scans only crates/engine/src/realtime — every marked region outside it, and all of rack/builtins, is ungated

• Category: architecture
• Class: N/A
• Severity: medium
• Location: scripts/check-realtime-policy.sh:14-15 (realtime_root="crates/engine/src/realtime"),
  scripts/check-realtime-policy.sh:38-46 (the find "$realtime_root" walk feeding the forbidden-
  surface regex); the unscanned marked regions are in crates/graph/src/lib.rs,
  crates/graph/src/runtime.rs and crates/effect-contract/src/live.rs.
• Current code:

realtime_root="crates/engine/src/realtime"
[[ -d "$realtime_root" ]] || fail "missing realtime module"
# …
done < <(find "$realtime_root" -name '*.rs' -type f | sort)

• Problem: the forbidden-surface regex (Vec::|vec!|Box::|…|\.unwrap\(|panic!\() is applied
  only to files under crates/engine/src/realtime. crates/graph/src/runtime.rs — which contains
  execute_op, reduce_plane, CompensationDelay::process, TrackDelayLine::process and
  publish_observations, i.e. the actual per-block render body — writes
  REALTIME_POLICY_BEGIN/END markers around exactly those functions and nothing checks them.
  crates/rack/src/lib.rs and crates/builtins/src/lib.rs carry no markers at all, so
  BankChain::run, InputStage::process and every bank stage are outside the gate entirely. I ran
  the script's own regex over the three unscanned marked files by hand and they are clean today
  (625 marked lines, zero hits) — so this is a gate gap, not a live violation. That is exactly the
  moment to close it, before a .unwrap() lands in execute_op.
• Proposed change: make the marker walk root-agnostic. Replace the find "$realtime_root" walk
  with a walk over every file in crates hosts tools sidecars that contains
  REALTIME_POLICY_BEGIN, keep the existing marker_count >= 4 floor (raise it to the current
  count), and keep the crates/engine/src/realtime directory-existence check as its own assertion.
  Then add markers to crates/rack/src/lib.rs around BankChain::run, gather*, scatter*,
  accumulate_aux and the three BankStage::process bodies, and to crates/builtins/src/lib.rs
  around InputStage::process/process_mono, FaderRampStage::process, MatrixStage::process
  and MeterAccumulator::observe. Two of those will need small edits to pass: the
  .expect("validated bank shape") at crates/graph/src/runtime.rs:1298 is bind-time and outside
  a marker, but EffectBankProcessBlock::new(...).map_err(...) patterns should be re-read against
  the regex before markers go in.
• Expected effect: the render-path no-alloc/no-panic rule becomes enforced where the render
  path actually is, rather than where issue 003 left it. No runtime change.
• Rulings / constraints checked: docs/REALTIME_DEPENDENCY_POLICY.md and
  AGENTS.md's "Render must perform zero allocations… with no exception" already assert the
  property for the whole render plane; this only makes the gate match the assertion.
• Verification gate: run the amended scripts/check-realtime-policy.sh and confirm it fails on
  a deliberate let _ = vec![0u8; 1]; inserted inside execute_op's marked region, then passes
  once removed (record it as a red mutation in crates/graph/tests/MUTATIONS.md).

---

RT-17: the two giant files split along seams that are already there — and two thirds of graph/src/lib.rs is an inline test module

• Category: architecture / dry

• Class: N/A

• Severity: medium

• Location: crates/builtins/src/lib.rs (3 858 lines, 156 K, no inline test module),
  crates/graph/src/lib.rs (4 660 lines, 179 K, mod tests at line 1586 → 3 074 lines of
  tests, 66 %), crates/graph/src/program.rs (2 503 lines, mod tests at 853 → 1 650 lines,
  66 %), crates/graph/src/runtime.rs (3 463 lines, mod tests at 2 839 → 624 lines),
  crates/rack/src/lib.rs (3 499 lines, mod tests at 2 164 → 1 335 lines, 38 %).

• Problem: the two files are giant for different reasons and want different treatment. graph
  is mostly tests inside src/ — its production code is 1 585 lines in lib.rs, 852 in
  program.rs, 2 838 in runtime.rs. builtins is 3 858 lines of production code with no tests
  at all in src/ (they live in crates/builtins/tests/), and it genuinely mixes six unrelated
  concerns in one file.

• Proposed change:

  crates/builtins/src/lib.rs → seven modules (line ranges are current; each is a clean cut at
  a top-level item boundary):

  new file	current lines	contents
  src/params.rs	47-215	ChannelLinkMode, BuiltinResetKind, Matrix2x2, BuiltinParameterError, BuiltinProcessReport, DualMonoBlock, ChannelParameters, BuiltinParameters
  src/descriptors.rs	210-460	BuiltinTail, BuiltinParameterDescriptor + its five enums, BUILTIN_PARAMETER_DESCRIPTORS, BuiltinLatticePoints, builtin_parameter_lattice_points, builtin_filter_cutoff_maximum_hz, validate_builtin_filter_cutoff — and see RT-15: this is control-plane and arguably belongs in builtins-compiler
  src/design.rs	691-856	SvfSection (+design, words), InputLane, PreparedInputTrack, FaderLane, lane_words, lane_read, MAX_BANK_LANES, BUTTERWORTH_K, svf_coef
  src/input.rs	858-1712	InputStage<L> and its whole impl (855 lines — the biggest single unit)
  src/fader.rs	1713-2001	FaderStage<L>, FaderRampStage<L>, FADER_RAMP_COUNTDOWN_MAXIMUM
  src/matrix.rs	2002-2226	MatrixStage<L>, MATRIX_RAMP_COUNTDOWN_MAXIMUM
  src/chain.rs	2227-2475, 3045-3292	InputBuiltins, FaderMuteBuiltins, MatrixBuiltins, BuiltinChain, prepare_sections, BuiltinLaneSelector, FaderMuteRampBuiltins, checked_fader_gain, checked_trim_gain, fader_lanes, pan_matrix, balance_matrix
  src/bank.rs	2476-3044	InputStageKernel/BuiltinInputBank, FaderStageKernel/BuiltinFaderBank, MatrixStageKernel/BuiltinMatrixBank
  src/meter.rs	3293-3676	the whole meter surface: MeterTap…lane_snapshot

  lib.rs keeps the crate doc, the imports, db_gain/normal_or_zero/flush_subnormal/zero
  (3 677-3 709) as pub(crate) helpers, and pub mod corpus; pub mod test_support;.

  crates/graph/src/lib.rs → move the tests out first, then split what remains:
  #[cfg(test)] mod tests; with the body in src/tests/ (child modules keep access to
  pub(crate)/private items through super::, which a crates/graph/tests/ integration test
  would not). Then the remaining 1 585 lines split as:
  src/spec.rs (28-160: StableGraphId, RackId, TrackStage, EffectNodeId, GraphNodeId,
  GraphPortKind/Id, GraphEdgeId, GraphNode, GraphEdge, GraphSpec, DependencyLevel,
  RouteTiming, InsertedDelay, ReductionRecord, BufferAssignment);
  src/estimate.rs (160-304: GraphResourceEstimate, GraphBuiltinBankResourceEstimate,
  GraphBuiltinBankAttachError, GraphCompileCaps, GraphDiagnostic, GraphDiagnosticSet);
  src/prepared.rs (305-618 + 1300-1330: RouteTransform, reduce_left_to_right,
  PreparedGraphPlan, GraphPreparedEffect/Bank/BuiltinBank + the processor trait,
  GraphBankCohort, bank_member_nodes, is_bankable_track_stage, PreparedRoute,
  PreparedTrackDelay);
  src/bind.rs (619-1298: impl PreparedGraphPlan, PreparedGraphPlanParts,
  GraphRuntimeBindings, the source-set types and the binding/observer traits);
  src/executor.rs (1331-1531: GraphExecutor and its PreparedPlanExecutor impl — the only
  render-path file in the crate root, which is the point);
  src/accounting.rs (1533-1585: observation_size_accounting, quantum_samples).
  Apply the same #[cfg(test)] mod tests; extraction to program.rs (−1 650) and
  runtime.rs (−624) and crates/rack/src/lib.rs (−1 335).

• Expected effect: no file over ~900 lines; graph's render path becomes one 200-line
  executor.rs plus runtime.rs, which is what a reader looking for the block loop needs.
  ~6 700 lines of test code move out of src/ without losing private-item access.

• Rulings / constraints checked: AGENTS.md's naming rules apply to packages, not modules;
  no crate is renamed or added. prefix-strip-inventory.md and de-versioning-inventory.md do not
  touch module paths.

• Verification gate: cargo check --workspace --all-targets; cargo test --workspace with an
  identical pass count before and after; scripts/check-workspace-policy.sh;
  git diff --stat should show pure moves (use git log --follow-friendly single-commit moves).

---

RT-18: % on non-constant integers, allocation and panic surface in the render path — a clean sweep, with two caveats

• Category: realtime-safety
• Class: N/A
• Severity: low (reported as a negative result, with the two things that are not clean)
• Location: swept crates/graph/src/runtime.rs, crates/graph/src/lib.rs,
  crates/rack/src/lib.rs, crates/builtins/src/lib.rs, crates/lane/src/kernels*.rs,
  crates/engine/src/realtime/*.
• Findings:
  • No % on a non-constant integer anywhere in a marked render region. count % L::WIDTH in
    crates/lane/src/kernels.rs:477, :502, :568 is a per-instantiation constant.
    pdc_delay_block (crates/lane/src/kernels.rs:527-545) is a two-segment swap_with_slice with
    an explicit if advanced >= length { advanced - length } in place of a remainder, and
    spsc::wrap_increment (crates/engine/src/realtime/spsc.rs:59-62) is a compare, both as
    docs/REALTIME_MEMORY.md describes. channel % 2 at crates/builtins/src/lib.rs:2878 and
    :3163 is a constant and is control-plane.
  • No allocation on the render path in rack. Every vec!/.collect() in
    crates/rack/src/lib.rs (lines 122, 160-161, 484-489, 698-713, 1304-1305, 1455, 1536-1537) is
    in new, arm_fold or an evidence-only accessor.
  • PDC delay lines are correct and cheap. CompensationDelay::process
    (crates/graph/src/runtime.rs:146-166) and TrackDelayLine/delay_lane
    (crates/graph/src/runtime.rs:225-263) are slice-only two-segment swaps with an early
    if samples == 0 { return; }, and a zero-delay track is never lowered to NodeKind::TrackDelay
    at all (crates/graph/src/runtime.rs:281-285) — the elision is structural, not a branch.
  • Caveat 1 — every counter in the render path is saturating_add on a u64, per block, not
    per sample. I checked transposes, collapses, transitions, lifetime_recovered,
    rendered_blocks, dropped, unbound, successes. The one per-sample counter is the
    meter's clipped/sanitized (crates/builtins/src/lib.rs:3648-3650), which are plain += on
    block-local u64s folded once per segment — correct, and RT-10 would vectorise them into
    exact-integer f32 lane words.
  • Caveat 2 — the marked-region gate does not cover most of this (RT-16), so none of the above
    is currently enforced, only true.
• Verification gate: scripts/check-realtime-policy.sh after RT-16's widening; the existing
  allocation-audit executable (issue 003) over 1 M blocks.

---

Summary table

id	category	class	severity	location	one-line
RT-1	perf	A	high	crates/rack/src/lib.rs:2034-2095	Tiled bank scatter writes every word twice through a staging block; 2 loads + 2 stores per lane-sample where 1 + 1 suffices
RT-2	perf	A	high	crates/graph/src/runtime.rs:686-697	Route fold accumulates into the master once per lane — 8 read-modify-write passes per cohort per plane
RT-3	perf	A	high	crates/graph/src/runtime.rs:88-110	reduce_plane is n−1 block passes; a fan-in-64 output node costs 126 loads + 63 stores per word
RT-4	perf	A	high	crates/builtins/src/lib.rs:1926-1948, 2170-2181	Fader and matrix are three block passes for six lane-ops; fuse the settled arms into one
RT-5	perf	A	high	crates/builtins/src/lib.rs:1036-1044, 1632-1690	refresh_channel_symmetry spills up to 240 SIMD registers per record and per ramping block (issue #238)
RT-6	perf	A	medium	crates/rack/src/lib.rs:1428-1486	Collapse dispatch makes lanes × slots dyn calls per block; publish a [u8; 8] per stage
RT-7	perf	A	medium	crates/lane/src/kernels/builtins.rs:857-916	mixed_chain_block reads its plan-invariant elision plan inside the frame loop
RT-8	perf	A	medium	crates/rack/src/lib.rs:1565, 1684, 1709	BankChain::run re-derives three plan-invariant any() walks over every slot's lane mask per block
RT-9	architecture	A	medium	crates/graph/src/runtime.rs:2686-2731	One armed observer or send tap declines the chain merge and costs two extra whole-block transposes; tee instead
RT-10	perf	A	medium	crates/builtins/src/lib.rs:3625-3663	Meters are a scalar per-track third pass; meter the resident AoSoA block lane-generically instead
RT-11	simd	A	medium	crates/effect-contract/src/lib.rs:234-250	Tile transpose crosses a 256-byte [[f32;8];8] by-value boundary in both directions; add a [L; W] form
RT-12	perf	A	medium	crates/graph/src/lib.rs:1417-1420, crates/graph/src/runtime.rs:938-953	Block loop double-indexes units and walks every bank member for observers that are not bound
RT-13	dead-code	N/A	medium	crates/engine/src/realtime/buffer.rs:36-125	BufferArena is allocated, passed to render and never used by the only production executor
RT-14	dead-code	A	medium	crates/engine/src/realtime/disjoint.rs:208-232	Lease wave/mute machinery is unreachable; the mute redirect costs a load + mask + select per buffer access
RT-15	crate-boundary	N/A	medium	crates/rack/src/lib.rs:20-140	RackProgram/BankSlotKey/RackLocation are compiler-only vocabulary living in the render crate
RT-16	architecture	N/A	medium	scripts/check-realtime-policy.sh:14-46	The realtime gate scans only engine/src/realtime; the marked regions in graph and all of rack/builtins are ungated
RT-17	architecture	N/A	medium	crates/builtins/src/lib.rs, crates/graph/src/lib.rs	Concrete module splits; two thirds of graph/src/lib.rs and program.rs is an inline test module
RT-18	realtime-safety	N/A	low	(sweep)	No %, alloc or panic surface found on the render path — reported as a negative result with two caveats

---

Things I checked that are fine

• Trim and polarity are already one multiply. InputLane::trim_signed
  (crates/builtins/src/lib.rs:783-793) folds the polarity inversion into the trim magnitude at
  prepare, so the render path has no sign branch and no second multiply. A polarity flip is the same
  ramp through zero.
• HPF + LPF are already one cascaded pass with one load and one store per sample.
  input_chain_block (crates/lane/src/kernels/builtins.rs:408-461) runs sanitise, trim, both
  sections, both channels and the boundary scan in a single frame loop with the four integrator
  pairs held in registers; its "why one loop" section measures better than 2:1 at WIDTH = 1 and
  ~1.5:1 at WIDTH = 8. Nothing to fuse here.
• The prepared-identity section elision is real and correctly gated.
  input_chain_block_elided's three shapes (crates/lane/src/kernels/builtins.rs:796-808) and the
  InputChainPlan staleness derivation are sound; only the mixed shape's in-loop branch is worth
  changing (RT-7). The top-level match plan.elided is 4 byte compares per block, not per sample.
• PDC. Two-segment slice exchange, no %, no per-sample loop, a block longer than the ring is
  walked in ring-sized takes, zero-delay lines are structurally elided (not branched around), and
  per-lane track delay correctly gets independent rings and cursors rather than loosening
  CompensationDelay's shared-cursor invariant.
• mix2x2_block is already the folded-gain D3 form — the route gain is multiplied into the
  four coefficients once at bind, so render spends two multiplies and one unfused fma per output
  word, four roundings per frame instead of five.
• bank_gather_source (crates/graph/src/runtime.rs:966-1002) already removes the first bank
  member's dedication memcpy by pointing the gather at the producer, with a correct three-clause
  guard. scatter_redirects and route_fold similarly already remove real copies.
• The SPSC ring. Cursors are #[repr(align(64))] cache-padded, each endpoint caches the peer
  cursor and reloads only when the queue looks full/empty, wrap_increment is a compare not a
  remainder, and the LocalRing wasm fallback uses MaybeUninit<T> with no discriminant and no
  expect inside a marked region. Matches docs/REALTIME_MEMORY.md exactly.
• Plan swap. render_inner (crates/engine/src/realtime/plan.rs:735-778) does shape
  validation, a checked_add on the sample clock, one executor call and one saturating_add; the
  exchange reserves a retirement slot before displacing the active plan, so a full retirement queue
  defers rather than dropping on render. ExecutorHandover moves a Box<dyn Any> without
  allocating.
• Observation gating. ObservationLane::any_armed is O(1) per lane and gates the per-tap
  wants walk at both the per-node (crates/graph/src/runtime.rs:394-402) and per-bank
  (crates/rack/src/lib.rs:980-990) level; an unsubscribed plan pays one predicted branch.
• Bypass shunt. capture_dry = bypassed || shunt.feeds_line()
  (crates/graph/src/runtime.rs:1130-1136) and any_bypassed
  (crates/rack/src/lib.rs:911-914) already skip the quantum × lanes two-plane dry copy for an
  un-bypassed cohort.
• InputStage::members_sum spills two SIMD registers per bank per block to fold the sanitised
  counts. It is ~0.06 ops per lane-sample; not worth a finding, but if RT-5's whole-bank spill
  rewrite happens, folding a "any lane sanitised" mask into InputChainReport would let both calls
  be skipped on a clean block.
• No LUFS or true-peak meter exists in builtins, so there is no duplication with
  crates/true-peak-limiter's Annex-2 estimator to remove today. Flagging it forward: when one is
  added it must reuse that kernel rather than grow a second one.
• cross-bank-interleave.md's rejected candidate is respected. Nothing here proposes fusing
  independent same-kernel banks' frame loops or raising SVF_CASCADE_DEPTH; RT-4 and RT-9 are
  about dependent slots inside one cohort chain, which is a different axis and one the register
  file does not constrain the same way.

[tamashi095]

Audit report — Effects: parametric EQ, compressor, gate/expander, multiband (DYN-*), part 1/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

DYN — dynamics effects and parametric EQ audit

Scope: crates/{parametric-eq,compressor,gate-expander,multiband-compressor},
crates/effect-runtime/src/{bank,dynamics,envelope,params,ramp,state_payload,lib}.rs,
crates/effect-contract. Line numbers are as of 4797a544 (main, clean tree).

Three facts established before the findings, because several depend on them:

• The compressor's standing configuration takes the staged idle body, not frames_loop.
  COMPRESSOR_PARAMETERS[7] ("lookahead") defaults to 5.0 ms, so at 48 kHz
  L = 240, N = 960, D = N - L = 720, and segment_is_stageable (D >= len, len <= 128)
  is true. The staged body landed at 4a85eb57 (2026-08-26); the floor-accounting ruling's
  objdump is dated 2026-08-28. The staged body did not remove the scalar gather — it relocated
  it from gather_detector into fill_taps/copy_lane, where the instruction count is
  identical (W scalar loads + W scalar stores per channel-frame) and only the
  store-to-load-forwarding stall moved out of the recurrence's dependency chain. Boundary 2's
  "141 scalar instructions per channel-frame" term is therefore still live, in a different
  function. Findings DYN-1 covers both sites.
• Ring depths are a latency contract, not an oversight. Compressor ring_length = N + 1 = 961
  at 48 kHz (crates/compressor/src/lib.rs:257-279), multiband ring_len = Fs/50 + 1 = 961
  (crates/multiband-compressor/src/lib.rs:814-817). At W = 8 that is
  961 * 8 * 4 = 30_752 bytes per ring; the compressor holds 2 rings x 2 channels and the
  multiband 2 rings x 2 sides, so each bank's ring working set is 123 KiB, four times a
  32 KiB L1. Both depths are set by the declared fixed latency (Fs/50), which is in
  QUALITIES and in the 24 + 2B / 48 + 2B word state-payload layout. Shrinking them is a
  descriptor and state_layout_version change, i.e. not class A, and I do not propose it.
  What is class A is the access shape, which DYN-1/2/3 address.
• Lane-major ("transposed") rings are a dead end here and are deliberately not proposed. Both
  rings are written one frame at a time (main_left.store(&mut channel.main[write * width..]),
  low_near.store(&mut near.low_ring[slot..])). A lane-major ring makes that write a W-way
  scatter — trading W scalar loads on the read side for W scalar stores on the write side,
  which happen on every frame including bypassed and silent ones. The winning restructuring is
  the uniform-tap vector load, below.

---

DYN-1: compressor per-lane detector gather — W scalar loads + W scalar stores per channel-frame, in two places, where one aligned vector load suffices

• Category: simd
• Class: A (bit-identical)
• Severity: high
• Location: crates/compressor/src/kernel.rs:816-878 (fill_taps, copy_lane, gather_detector); call sites crates/compressor/src/kernel.rs:520-521, :729-730, :1216, :1252
• Current code:

#[inline]
fn fill_taps<L: Lane>(channel: &Channel<L>, write: usize, len: usize, scratch: &mut [f32]) {
    let width = L::WIDTH;
    let ring_length = channel.ring_length as usize;
    let scratch = &mut scratch[..len * width];
    for lane in 0..width {
        let delay = channel.delay[lane] as usize;
        let row = if write >= delay { write - delay } else { write + ring_length - delay };
        let first = (ring_length - row).min(len);
        copy_lane(&channel.detector[row * width..(row + first) * width],
                  &mut scratch[..first * width], lane, width);
        copy_lane(&channel.detector[..(len - first) * width],
                  &mut scratch[first * width..], lane, width);
    }
}

#[inline(always)]
fn copy_lane(source: &[f32], destination: &mut [f32], lane: usize, width: usize) {
    for (to, from) in destination.chunks_exact_mut(width).zip(source.chunks_exact(width)) {
        to[lane] = from[lane];
    }
}

• Problem: copy_lane moves exactly one f32 per frame per lane, so fill_taps costs
  len * W scalar load/store pairs per channel per segment — at len = 128, W = 8 that is
  1 024 load/store pairs per channel per block, i.e. 8 loads + 8 stores per channel-frame,
  and the staged body then reads the scratch back with L::load(tap_left) in pass A
  (:762). gather_detector (:861-878) is the same shape per frame for the non-staged path:
  8 scalar loads, 8 scalar stores into [f32; MAX_WIDTH], one L::load of the buffer it just
  wrote — the store-to-load-forwarding stall the floor ruling's Boundary 2 names, and the bulk
  of its "141 scalar instructions per channel-frame, more than the arithmetic". The predicate
  that forces the scalar shape is per-lane D, but D is derived once at prepare from
  lookahead_ms (design.rs:190-199), and a bank whose lanes were cohorted from one console
  strip normally has one lookahead value for all eight — the standing default is 5.0 ms on
  every track.
• Proposed change: add a uniform-tap fast path, keyed on a cached flag maintained wherever
  Channel::delay is written (seed_from_defaults :175-193, state::commit_channel).

// crates/compressor/src/kernel.rs, on Channel<L>
/// `Some(d)` when `delay[0..L::WIDTH]` are all `d`. Recomputed only where `delay` is written.
pub(crate) uniform_delay: Option<u32>,

// fill_taps, uniform arm — two contiguous copies, no scalar loop at all:
if let Some(d) = channel.uniform_delay {
    let row = if write >= d as usize { write - d as usize } else { write + ring_length - d as usize };
    let first = (ring_length - row).min(len);
    scratch[..first * width].copy_from_slice(&channel.detector[row * width..(row + first) * width]);
    scratch[first * width..len * width].copy_from_slice(&channel.detector[..(len - first) * width]);
    return;
}

Better still for the staged body: with uniform_delay the scratch is not needed at all —
pass A can carry a tap_row alongside write, advanced by the same if next == ring_length { 0 } compare-select, and read L::load(&channel.detector[tap_row * width..]) directly.
segment_is_stageable already proves no lane taps a row this segment writes, so the read is
the same f32 word the per-frame body reads. Do the same in gather_detector: on the uniform
arm return L::load(&channel.detector[tap * width..]) with tap computed once.
The general (ragged-D) arm stays exactly as written; it must, and it stays exercised.
Lift the uniform arm into effect-runtime as a new module effect_runtime::ring, because
gate-expander and multiband-compressor have the identical problem (DYN-2, DYN-3):

// crates/effect-runtime/src/ring.rs  (new)
pub struct LaneTaps<const N: usize> { pub distance: [u32; N], pub uniform: Option<u32> }
impl<const N: usize> LaneTaps<N> { pub fn refresh(&mut self, width: usize); }

/// One frame of every lane's tap, read `distance[lane]` slots behind `write` in a row-major ring.
#[inline(always)]
pub fn gather_tap<L: Lane, const N: usize>(
    ring: &[f32], ring_len: usize, write: usize, taps: &LaneTaps<N>, scratch: &mut [f32; N],
) -> L;

/// `len` consecutive frames of every lane's tap, frame-major, into `scratch`.
/// Requires `taps.distance[k] >= len` for every live lane (the caller's staging condition).
pub fn gather_tap_block<L: Lane, const N: usize>(
    ring: &[f32], ring_len: usize, write: usize, len: usize, taps: &LaneTaps<N>, scratch: &mut [f32],
);

• Expected effect: on the uniform path the staged body drops from 1 024 scalar load/store
  pairs per channel per block to zero (direct-load form) or to two copy_from_slice calls
  (scratch form); the per-frame body drops from ~64 scalar instructions per channel-frame to
  ~4 (one compare-select, one shift, one vector load), removing the store-to-load-forwarding
  stall by construction. Against Boundary 2's decomposition (315 instructions per channel-frame,
  of which 141 are scalar and "more than the arithmetic"), this removes the single largest
  non-arithmetic term. The IPC half of the 5.255x gap — 2.359 against the probe's 3.7 — is
  attributed by the ruling to exactly this stall.
• Rulings / constraints checked: docs/rulings/effect-floor-accounting.md Boundary 2 names
  this gap term ((c) in the preamble list) and states explicitly that "a different way of writing
  the same computation would remove it without moving a rendered bit". Not the rejected
  simd-wrapper-around-scalar-inner-loop.md candidate: that ruling is about wrapping a scalar
  inner loop in a bank API; this removes the scalar loop. No new arithmetic, no reassociation, no
  FMA: the same f32 words reach the same lanes, so Lane::fma's unfused contract is untouched.
• Verification gate: cargo test -p compressor — tests/staged_idle.rs already pins that the
  staged and per-frame bodies agree bit for bit, tests/lane_identity.rs and
  tests/cross_target.rs pin scalar/W4/W8 identity, tests/partition.rs pins block-boundary
  invariance. Add a case with a deliberately ragged delay array to keep both arms exercised.
  Then scripts/run-console-benchmark.sh paired against baseline, and
  objdump -d on compressor::kernel::idle_frames_staged::<f32x8> to confirm the scalar
  load/store pairs are gone.

---

DYN-2: gate-expander gathers four tap arrays per frame; two are bit-identical duplicates whenever the two channels' taps agree, and two are dead in DualMono

• Category: simd
• Class: A (bit-identical)
• Severity: high
• Location: crates/gate-expander/src/kernel.rs:259-293
• Current code:

        // Per-lane lookahead is a `PerLane` parameter, so the detector tap differs per lane and
        // the read is a gather: `WIDTH` scalar loads per source, no arithmetic, so the rounding
        // sequence each lane sees is still the scalar one.
        let (source_left, source_right) = if CONNECTED {
            (&*ring_left.detector, &*ring_right.detector)
        } else {
            (&*ring_left.main, &*ring_right.main)
        };
        #[allow(clippy::needless_range_loop)]
        for lane in 0..width {
            let own = ((now.wrapping_sub(ring_left.tap[lane]) & slot_mask) as usize) * width + lane;
            let partner =
                ((now.wrapping_sub(ring_right.tap[lane]) & slot_mask) as usize) * width + lane;
            taps[0][lane] = source_left[own];
            taps[1][lane] = source_right[own];
            taps[2][lane] = source_right[partner];
            taps[3][lane] = source_left[partner];
        }

• Problem: three separate wastes stacked on one loop.
  1. Duplicates. taps[0] and taps[3] read source_left; taps[1] and taps[2] read
     source_right. When ring_left.tap[lane] == ring_right.tap[lane] — the normal case for a
     dual-mono track whose two channels carry the same lookahead — own == partner, so
     taps[0] == taps[3] and taps[1] == taps[2] word for word. Half the gather is recomputing
     values it already has.
  2. Dead work under DualMono. channel_step uses partner only inside
     L::select(coef.link_max.gt(zero), ...) and L::select(coef.link_avg.gt(zero), ...)
     (:343-350). link_max/link_avg are splatted once at prepare from
     metadata.link_mode (crates/gate-expander/src/lib.rs:473-474), so under DualMono both
     are +0.0 for the whole life of the instance and the partner tap is gathered, absolute-
     valued, maxed, halved, added and then discarded by two selects, every frame. The
     compiler cannot elide it: link_max is a runtime lane word, not a constant.
  3. No uniform arm. As DYN-1: when the taps are lane-uniform the whole gather is one
     L::load per source.
     Cost at W = 8: 32 scalar loads + 32 scalar stores + 8 x (2 subs, 2 ands, 2 muls, 2 adds)
     per frame, then four L::loads of the just-written buffers — four store-to-load-forwarding
     hazards per frame instead of the compressor's two.
• Proposed change: add const LINK: u8 to gate_block alongside the existing CONNECTED
  and RAMPING const generics (:216), dispatched once per block exactly as
  multiband_compressor::render already dispatches (crates/multiband-compressor/src/lib.rs:1135-1166),
  and use effect_runtime::dynamics::detector_link::<L, LINK> (DYN-7) instead of the two lane
  selects. Then:
  • LINK == DUAL_MONO: gather taps[0] and taps[2] only, at each channel's own tap. Two of
    the four arrays disappear together with abs, max, two mul, one add and two select
    per lane-sample per channel.
  • LINK != DUAL_MONO: keep four gathers, but hoist a block-level
    same_tap = ring_left.tap[..width] == ring_right.tap[..width] (W compares once per block)
    and, when true, fill taps[3] = taps[0] and taps[2] = taps[1] by copy instead of by gather.
  • Both: route the gather through effect_runtime::ring::gather_tap (DYN-1) so the
    lane-uniform case becomes one L::load per source.
• Expected effect: under DualMono + uniform taps the per-frame gather goes from 32 scalar
  loads + 32 scalar stores + ~64 index instructions to two vector loads, and channel_step
  loses 7 lane-ops per lane-sample per channel (abs, max, 2 mul, add, 2 select; each
  select lowers to three bitwise ops per Boundary 2, so ~11 instructions). Under a linked mode
  with matching taps the gather halves.
• Rulings / constraints checked: same Boundary 2 gap term (c) as DYN-1, and gap term (a)
  (bitselect lowering to three bitwise ops) for the removed selects. The const-generic link
  dispatch is not novel in this workspace — multiband-compressor already ships
  LINK_DUAL_MONO/LINK_MAXIMUM/LINK_AVERAGE as a const MODE: u8
  (crates/multiband-compressor/src/shim.rs:24-31) with a once-per-block match. Bit identity is
  structural: the DualMono arm computes own.abs(), which is exactly what the two selects
  return when both masks are false.
  Caveat for the implementer: scripts/check-web-audioworklet-callgraph.py rule 1 requires
  each KERNEL_ROSTER regex to match exactly one arithmetic-carrying function; gate_block is
  #[inline(always)], so the new instantiations must stay inlined into the single
  gate_expander.*4wide6f32x4 body, as the multiband's already do.
• Verification gate: cargo test -p gate-expander (tests/identity.rs, tests/oracle.rs,
  tests/contract.rs, tests/state.rs), then scripts/check-web-audioworklet.sh for the roster
  rule, then a paired scripts/run-console-benchmark.sh.

---

DYN-3: multiband calls detector_tap four times per frame with only two distinct index sets, and has no uniform-offset path

• Category: simd
• Class: A (bit-identical)
• Severity: high
• Location: crates/multiband-compressor/src/lib.rs:865-880 (detector_tap), call sites :1000-1006
• Current code:

#[inline(always)]
fn detector_tap<L: Lane, const W: usize>(
    ring: &[f32], cursor: usize, offsets: &[usize; W], ring_len: usize,
) -> L {
    let mut values = [0.0f32; 8];
    for track in 0..W {
        values[track] = ring[wrap(cursor + offsets[track], ring_len) * W + track];
    }
    L::load(&values[..W])
}
// ... in run_segment, per frame:
        let detector_near_low =
            detector_tap::<L, W>(&near.low_ring, position, &near.detector_offset, ring_len);
        let detector_near_high =
            detector_tap::<L, W>(&near.high_ring, position, &near.detector_offset, ring_len);
        let detector_far_low =
            detector_tap::<L, W>(&far.low_ring, position, &far.detector_offset, ring_len);
        let detector_far_high =
            detector_tap::<L, W>(&far.high_ring, position, &far.detector_offset, ring_len);

• Problem: four calls per frame, each doing W scalar loads into a [f32; 8] local followed
  by an L::load of that local — at W = 8, 32 scalar loads, 32 scalar stores and four
  store-to-load-forwarding hazards per frame, twice the compressor's and matching the gate's.
  Worse, near.low_ring and near.high_ring are indexed with the same near.detector_offset,
  so wrap(cursor + offsets[track], ring_len) * W + track — an add, a compare, a conditional
  subtract, a shift and an add, five integer ops — is computed twice per lane per side, 16
  redundant index computations per frame at W = 8. detector_offset is derived at prepare
  (detector_offset, :599-614) and is uniform across lanes whenever a bank's tracks share a
  lookahead, which is the console case.
• Proposed change: compute the row index array once per side per frame and index both rings
  with it; and add the effect_runtime::ring::gather_tap uniform arm from DYN-1.

// per side, per frame — one index pass, two ring reads
#[inline(always)]
fn detector_pair<L: Lane, const W: usize>(
    low: &[f32], high: &[f32], cursor: usize, taps: &LaneTaps<W>, ring_len: usize,
) -> (L, L) {
    if let Some(off) = taps.uniform {
        let row = wrap(cursor + off, ring_len) * W;
        return (L::load(&low[row..]), L::load(&high[row..]));
    }
    let mut lo = [0.0f32; 8];
    let mut hi = [0.0f32; 8];
    for track in 0..W {
        let at = wrap(cursor + taps.distance[track], ring_len) * W + track;
        lo[track] = low[at];
        hi[track] = high[at];
    }
    (L::load(&lo[..W]), L::load(&hi[..W]))
}

Store detector_offset on Side as a LaneTaps<W> so uniform is refreshed only where the
offsets are written (Side::new, rederive, restore).

• Expected effect: ragged case: index arithmetic per frame halves (32 -> 16 wrap
  computations at W = 8); uniform case: 32 scalar loads + 32 scalar stores + 4 forwarding
  hazards per frame become 4 vector loads and nothing else. The multiband ruling records that
  the split removed 2 560 lane additions from a 128-frame block for a 6.4 % bank win; this
  removes an order more integer instructions from the same loop.
• Rulings / constraints checked: docs/rulings/multiband-ramping-split-boundary.md "What
  would justify reopening what was left" lists per-segment overhead but not this; it is new.
  Boundary 2 gap term (c) generalised. The values loaded are unchanged, so class A.
• Verification gate: cargo test -p multiband-compressor — tests/identity.rs,
  tests/product.rs, tests/determinism.rs, tests/cross_target_digest.rs, and
  crates/multiband-compressor/src/split.rs's bit-identity arms; tests/no_alloc_render.rs for
  the allocation gate. tests/descriptive_frame_cost.rs for the descriptive number.

---

DYN-4: multiband rebuilds a whole GainComputerCoef and re-splats seven constants per band per channel per frame — 28 splats and 4 struct builds per frame

• Category: simd
• Class: A (bit-identical)
• Severity: high
• Location: crates/multiband-compressor/src/lib.rs:902-932 (band_amplitude), called four times per frame at :1010-1035
• Current code:

fn band_amplitude<L: Lane>(
    detector: L, threshold: L, makeup: L, coefficients: &BandCoef<L>, state: &mut L,
) -> L {
    let level = fast_level_db(detector.max(L::splat(DETECTOR_FLOOR)))
        .max(L::splat(-160.0))
        .min(L::splat(24.0));
    let curve = GainComputerCoef {
        threshold_db: threshold,
        inv_ratio_minus_one: coefficients.inv_ratio_minus_one,
        half_knee_db: L::splat(0.5 * KNEE_DB),
        inv_two_knee: L::splat(1.0 / (2.0 * KNEE_DB)),
    };
    let target = gain_delta_db(level, &curve)
        .max(L::splat(-100.0))
        .min(L::zero());
    let smoothed = flush(branching_smooth(
        *state, target, coefficients.attack, coefficients.release,
    ));
    *state = smoothed;
    fast_gain_from_db(smoothed.add(makeup))
}

• Problem: seven L::splat/L::zero per call and four calls per frame = 28 broadcasts of
  loop-invariant constants per frame, plus four GainComputerCoef<L> constructions (4 lane
  words each = 16 lane words written per frame). KNEE_DB is a crate constant (6.0,
  :96), so half_knee_db and inv_two_knee are compile-time values; inv_ratio_minus_one
  is per-segment (band_coefficients, :1204-1233); threshold is segments[c].current[0/5],
  which is per-segment too on the RAMPING == false path — the production path for every block
  with no automation in flight. This is Boundary 2's named gap term (b) —
  "vbroadcastss re-splatting loop-invariant constants that sixteen ymm registers cannot all
  hold" — written out in the source rather than merely emitted by the compiler, and it is
  precisely the shape the compressor already fixed with its Invariants
  (crates/compressor/src/kernel.rs:885-933) and Coef::load
  (:338-367, ruled a real native win by
  docs/rulings/compressor-identity-mask-hoist-wasm-null.md).
• Proposed change: move the whole curve into BandCoef<L>, built once per segment in
  Side::band_coefficients, and add a per-segment Invariants<L> for the five clamps:

// crates/multiband-compressor/src/lib.rs
struct BandCoef<L: Lane> {
    curve: GainComputerCoef<L>,   // threshold_db + inv_ratio_minus_one + the two constant knee words
    attack: L,
    release: L,
    makeup: L,
}
struct Clamps<L: Lane> {          // one per segment, exactly the compressor's `Invariants`
    detector_floor: L, level_min: L, level_max: L, reduction_min: L, zero: L,
}

#[inline(always)]
fn band_amplitude<L: Lane>(detector: L, c: &BandCoef<L>, k: &Clamps<L>, state: &mut L) -> L {
    let level = fast_level_db(detector.max(k.detector_floor)).max(k.level_min).min(k.level_max);
    let target = gain_delta_db(level, &c.curve).max(k.reduction_min).min(k.zero);
    let smoothed = flush(branching_smooth(*state, target, c.attack, c.release));
    *state = smoothed;
    fast_gain_from_db(smoothed.add(c.makeup))
}

On the RAMPING == true arm only, assign c.curve.threshold_db and c.makeup from
segments[..].current[..] at the top of the frame — one lane-word move each, replacing four
splats plus a struct build.

• Expected effect: 28 splats + 16 lane-word struct writes per frame become 0 on the flat path
  and 8 lane-word moves on the ramped path. Directly comparable to
  docs/rulings/compressor-identity-mask-hoist-wasm-null.md, which measured a −2.2 % native
  compressor-only saving for hoisting three mask compares out of the same kind of loop; this
  hoists twenty-eight broadcasts and four struct builds.
• Rulings / constraints checked: the identity-mask ruling's boundary is that no wasm
  improvement may be claimed for a hoist of this shape (Cranelift already sinks compares);
  claim only the native arm. Bit identity is structural, as it was there: the same constants,
  built by the same expressions, consumed in the same order.
• Verification gate: cargo test -p multiband-compressor + crates/multiband-compressor/src/split.rs
  bit-identity arms (they compare every rendered sample and the whole instance by bit pattern
  across all three widths, three link modes and bypass); then
  cargo test -p multiband-compressor --test cross_target_digest; then a paired
  scripts/run-console-benchmark.sh noting Boundary 1 of
  docs/rulings/multiband-ramping-split-boundary.md: no console fixture contains a multiband, so
  quote the bank-boundary number, not a console one.

---

DYN-5: the compressor's link mode and bypass are prepared-time constants but are spent as per-lane-sample mask selects

• Category: simd
• Class: A (bit-identical)
• Severity: medium
• Location: crates/compressor/src/kernel.rs:906-967 (Invariants::new, link_frame), :1066-1074 (the bypass mask in gain_mix)
• Current code:

    let magnitude_left = source_left.abs();
    let magnitude_right = source_right.abs();
    let maximum = magnitude_left.max(magnitude_right);
    let average = magnitude_left
        .mul(invariants.half)
        .add(magnitude_right.mul(invariants.half));
    let combined = L::select(invariants.averaged, average, maximum);
    (
        L::select(invariants.linked, combined, magnitude_left),
        L::select(invariants.linked, combined, magnitude_right),
    )

• Problem: Invariants::linked and averaged are derived from metadata.link_mode, and
  bypassed from metadata.bypass — both fixed for the life of the prepared instance and
  identical on every lane. The floor inventory charges this block 5 lane-ops per lane-sample
  ("link, halved between the two channels: abs x2, max, two mul and an add, three
  select"); under DualMono — the default for dual-mono tracks — the whole thing is
  magnitude_left / magnitude_right, i.e. 1 op per lane-sample. Under Maximum it is
  abs x2 + max halved = 1.5. The three selects alone cost nine instructions per
  channel-frame at Boundary 2's bitselect-to-three-bitwise-ops lowering; the bypassed
mask_or in gain_mix costs one more.
• Proposed change: thread const LINK: u8 and const BYPASS: bool through
  frames_loop/idle_frames_staged/link_frame/gain_mix, dispatched once at the top of
  process_block (:374-451) — the shape multiband_compressor::render already uses. Replace
  link_frame's body with the shared effect_runtime::dynamics::detector_link::<L, LINK> of
  DYN-7. Keep Invariants for the numeric constants only.
• Expected effect: on DualMono the compressor's arithmetic floor drops from 94 to 90
  lane-ops per lane-sample (−4.3 %), and the emitted instruction count by roughly ten per
  channel-frame (three bitselects at three bitwise ops each, plus the bypass mask_or)
  against Boundary 2's 315. On Maximum the saving is ~3 lane-ops. Honest caveat: the floor is
  not where the compressor's 5.255x gap lives, so this is the smaller of the two compressor
  findings; DYN-1 is the load-bearing one.
• Rulings / constraints checked: docs/rulings/effect-floor-accounting.md gap term (a).
  The mono-collapse bodies note (:1093-1101) that
  Average must stay 0.5*p + 0.5*p on a collapsed plane rather than p, because the two
  products round differently for a subnormal — the const-generic arms must preserve that
  exactly, i.e. LINK_AVERAGE keeps both products even when the two planes are the same vector.
  Caveat: scripts/check-web-audioworklet-callgraph.py roster rule 1 matches
  compressor6kernel13process_block.*4wide6f32x4 exactly once; frames_loop is
  #[inline(always)] and must stay so, and the four idle_frames_staged instantiations are
  outside that regex (they match no roster entry) so rule 1 is unaffected — confirm with
  scripts/check-web-audioworklet.sh before landing.
• Verification gate: cargo test -p compressor (tests/identity.rs, tests/mono_collapse.rs,
  tests/lane_identity.rs, tests/cross_target.rs, tests/static_curve.rs),
  scripts/check-web-audioworklet.sh, then paired scripts/run-console-benchmark.sh — the
  standing console fixture carries a compressor on all 64 tracks, so this row can see it.

---

DYN-6: gate-expander re-splats seven constants and re-derives three block-invariant masks inside its per-sample body

• Category: simd
• Class: A (bit-identical)
• Severity: medium
• Location: crates/gate-expander/src/kernel.rs:316-357, :392-398
• Current code:

    let zero = L::zero();
    let one = L::splat(1.0);
    ...
    let mut level = own_abs;
    level = L::select(coef.link_max.gt(zero), own_abs.max(partner_abs), level);
    level = L::select(
        coef.link_avg.gt(zero),
        L::splat(0.5).mul(own_abs).add(L::splat(0.5).mul(partner_abs)),
        level,
    );
    let level_db = fast_level_db(level.max(L::splat(LEVEL_FLOOR)))
        .min(L::splat(LEVEL_MAX_DB))
        .max(L::splat(LEVEL_MIN_DB));
    ...
    let identity = L::mask_or(gain_db.eq(zero), coef.bypass.gt(zero));

• Problem: channel_step runs once per channel per frame and constructs
  L::zero(), L::splat(1.0), L::splat(0.5) twice, L::splat(LEVEL_FLOOR),
  L::splat(LEVEL_MAX_DB), L::splat(LEVEL_MIN_DB) — seven broadcasts per channel-sample,
  fourteen per frame — and three compares against zero (link_max.gt, link_avg.gt,
  bypass.gt) whose operands are set once at prepare
  (crates/gate-expander/src/lib.rs:470-475) and never move. The compressor has an
  Invariants struct for exactly this and it was measured as a real native win; the gate has
  no equivalent. This is Boundary 2 gap term (b) and (a) together.
• Proposed change: build a GateInvariants<L> in gate_block before the frame loop, holding
  zero, one, half, level_floor, level_min, level_max and the three masks
  linked_max, linked_avg, bypassed; pass &GateInvariants<L> into channel_step. Combine
  with DYN-2's const LINK: u8 so the two link masks disappear entirely rather than being
  hoisted.
• Expected effect: 14 broadcasts and 6 mask derivations per frame removed. Comparable in kind
  to the compressor's step-8 hoist (−2.2 % native compressor-only, −1.9 % console strip) but
  larger in count: that hoisted three compares, this hoists fourteen broadcasts plus six
  compares.
• Rulings / constraints checked: docs/rulings/compressor-identity-mask-hoist-wasm-null.md
  — claim a native win only; that ruling's wasm arm was a null for the same class of hoist and
  its boundary explicitly covers "lane-mask hoisting in general" only as not ruled null, not
  as proven. Bit identity is structural (same constants, same order).
• Verification gate: cargo test -p gate-expander (tests/identity.rs, tests/oracle.rs —
  the gate has an independent scalar oracle — tests/contract.rs), then paired
  scripts/run-console-benchmark.sh noting the gate is absent from the standing console fixture,
  so quote a bank-boundary number.

---

DYN-7: three branching one-pole smoothers and three detector-link implementations; one lane-generic kernel each belongs in effect-runtime::dynamics

• Category: dry
• Class: N/A (non-render restructuring; the arms stay bit-distinct)
• Severity: medium
• Location:
  • smoothers: crates/compressor/src/kernel.rs:1028-1034,
    crates/gate-expander/src/kernel.rs:392-394,
    crates/multiband-compressor/src/shim.rs:52-56
  • links: crates/compressor/src/kernel.rs:940-967,
    crates/gate-expander/src/kernel.rs:340-350,
    crates/multiband-compressor/src/shim.rs:70-84
• Current code:

// compressor/src/kernel.rs:1029 — rate-coefficient form, attack on `target < y`
fn ballistic<L: Lane>(target: L, gain_reduction_db: &mut L, coef: &Coef<L>) -> L {
    let coefficient = L::select(target.lt(*gain_reduction_db), coef.attack, coef.release);
    let smoothed = flush(rms_follow(target, *gain_reduction_db, coefficient));
    *gain_reduction_db = smoothed;
    smoothed
}
// gate-expander/src/kernel.rs:392 — the same rate form, opposite sign convention, open-coded
    let rate = L::select(target.gt(state.gain_db), coef.attack, coef.release);
    let gain_db = flush(rate.fma(target.sub(state.gain_db), state.gain_db));
// multiband-compressor/src/shim.rs:52 — retention-coefficient form
pub(crate) fn branching_smooth<L: Lane>(y: L, target: L, attack: L, release: L) -> L {
    let c = L::select(target.lt(y), attack, release);
    let d = y.sub(target);
    c.fma(d, target)
}

• Problem: crates/multiband-compressor/src/shim.rs:1-21 states the debt itself: "Two
  lane-generic pieces that belong in effect-runtime and are not there yet ... Both functions
  below are therefore shims ... and they are the first thing to delete when 088 Audit: miso-engine-compressor #88's version is on
  main." Meanwhile effect_runtime::envelope already ships rms_follow (the rate form),
  peak_follow and ar_one_pole_step (a two-product switched one-pole) — so the workspace has
  five switched/one-pole followers across two crates, three of them branching smoothers that
  differ only in coefficient convention and compare direction. The gate open-codes the same
  expression rms_follow already is. There are also three transcriptions of the identical
  (|l|, |r|) -> max | 0.5l + 0.5r | passthrough link law, one of which
  (link_levels) is already the const-generic shape the other two want (DYN-2, DYN-5).
• Proposed change: add to crates/effect-runtime/src/dynamics.rs:

/// One sample of a branching one-pole on a *rate* coefficient: `flush(fma(c, target - y, y))`,
/// with `c = select(cmp(target, y), attack, release)`. `ATTACK_ON_FALL` selects the compressor's
/// convention (`target < y`); `false` selects the gate's (`target > y`).
#[inline(always)]
pub fn branching_rate_pole<L: Lane, const ATTACK_ON_FALL: bool>(
    target: L, y: L, attack: L, release: L,
) -> L;

/// One sample of a branching one-pole on a *retention* coefficient: `fma(c, y - target, target)`,
/// with `c = select(target < y, attack, release)`. The caller applies `flush`.
#[inline(always)]
pub fn branching_retention_pole<L: Lane>(y: L, target: L, attack: L, release: L) -> L;

/// The detector link, as a compile-time mode. `MODE` is `LINK_DUAL_MONO | LINK_MAXIMUM |
/// LINK_AVERAGE`; the average is `0.5*|l| + 0.5*|r|`, two products and an add, never `0.5*(l+r)`.
#[inline(always)]
pub fn detector_link<L: Lane, const MODE: u8>(left: L, right: L) -> (L, L);
pub const LINK_DUAL_MONO: u8 = 0;
pub const LINK_MAXIMUM: u8 = 1;
pub const LINK_AVERAGE: u8 = 2;

Delete crates/multiband-compressor/src/shim.rs (273 lines including its tests). Point
compressor::kernel::ballistic and gate_expander::kernel::channel_step at
branching_rate_pole. The two coefficient conventions stay two functions on purpose — they
round differently and the shim's own header says a shared helper "must not paper over" the
direction.

• Expected effect: −273 lines (shim.rs) plus ~20 lines across the two kernels; three
  smoother transcriptions become two, three link transcriptions become one; enables DYN-2 and
  DYN-5. Zero render-path effect on its own.
• Rulings / constraints checked: this is the explicitly-recorded W2-D3 / issue 088 Audit: miso-engine-compressor #88 debt, not
  a new proposal. effect-runtime already owns GainComputerCoef for exactly this reason
  (crates/compressor/src/design.rs:151-154: "so this crate and multiband-compressor cannot
  drift apart on the knee").
• Verification gate: cargo test -p effect-runtime --test dynamics --test envelope,
  cargo test -p multiband-compressor (its tests/dynamics_shims.rs equivalents and
  src/split.rs arms), cargo test -p compressor -p gate-expander,
  scripts/check-effect-runtime-policy.sh.

---

DYN-8: the EQ's block elision gate is a scalar five-integer-op-per-word scan of both planes where the workspace's own vector check_block covers two thirds of it

• Category: perf
• Class: A (bit-identical; the gate is a refusal predicate, and refusing more never moves a bit)
• Severity: medium
• Location: crates/parametric-eq/src/lib.rs:822-830, called at :1457 and :1282
• Current code:

#[inline]
#[must_use]
fn block_admits_elision(io: &[f32]) -> bool {
    let mut rejected = 0_u32;
    for value in io {
        let bits = value.to_bits();
        rejected |= u32::from(bits == NEGATIVE_ZERO_BITS);
        rejected |= u32::from((bits & MAGNITUDE_MASK) > ELISION_MAGNITUDE_CEILING);
    }
    rejected == 0
}

• Problem: five integer operations per word (and, two compares, two ors) over
  frames * W words, twice per block — at 128 frames and W = 8 that is 2 048 words and
  ~10 240 integer operations per bank per block, and it is Boundary 3's named term ("the block
  elision gate's five integer comparisons per lane-sample"). The magnitude leg
  (bits & 0x7fff_ffff) > 1e30.to_bits() is the complement of effect_runtime::bank::check_block
  (crates/effect-runtime/src/bank.rs:80-89), which does the same job in the vector domain at
  three lane-ops per frame (load, abs+lt, mask_and) with a single mask_any at the end —
  and parametric-eq already imports check_block (:47) and calls it on the output of the
  very same block (:1877). The crate also carries its own copies of the constants
  (MAGNITUDE_MASK, ELISION_MAGNITUDE_CEILING, :745-754) that only exist to restate
  BLOCK_LIMIT in the integer domain.
• Proposed change:

#[inline]
#[must_use]
fn block_admits_elision<L: Lane>(io: &[f32]) -> bool {
    // Magnitude, finiteness and the §4.4 bound: the workspace's one vector scan.
    if !effect_runtime::bank::check_block::<L>(io) {
        return false;
    }
    // The only leg `check_block` does not carry: no word may be the `-0.0` bit pattern.
    let mut negative_zero = 0_u32;
    for value in io {
        negative_zero |= u32::from(value.to_bits() == NEGATIVE_ZERO_BITS);
    }
    negative_zero == 0
}

and delete MAGNITUDE_MASK / ELISION_MAGNITUDE_CEILING.

• Expected effect: per lane-sample the gate goes from 5 integer ops to 2 integer ops plus
  3/W lane-ops — roughly 2.4 at W = 8, a little over half. Boundary 3 puts 65 % of the EQ
  row's isolated cost outside the section arithmetic and names this term as part of it. Two
  constants and their documentation (~12 lines) also go.
• Rulings / constraints checked: the engagement set narrows by exactly one boundary case —
  check_block uses strict |x| < 1e30 where the integer form used > 1e30.to_bits(), so a
  plane containing exactly ±1e30 now declines elision instead of admitting it. That is safe
  and costs nothing but speed on an input no console produces:
  cascade_sections' own documentation states "Every leg is a refusal: any doubt returns all
  four sections and the block renders exactly as it did before this function existed", and
  elision is proven bit-identical to non-elision, so a stricter gate cannot move a rendered bit.
  docs/rulings/cross-bank-interleave.md is untouched: SVF_CASCADE_DEPTH does not move.
• Verification gate: cargo test -p parametric-eq — tests/bank.rs, tests/silent_fixed_point.rs,
  tests/analytic.rs, tests/time_domain.rs and the in-crate mod elision
  (crates/parametric-eq/src/lib.rs:2695+) which renders elided against un-elided; add a case
  pinning that a plane containing 1e30 declines. Then paired scripts/run-console-benchmark.sh
  — the standing fixture declares band 1 only, so kept = 2 < 4 and the gate is live on it.

---

DYN-9: the EQ zeroes 512 bytes of stack scratch on every non-silent block to hold state it only reads when the block is silent

• Category: realtime-safety
• Class: A (bit-identical)
• Severity: medium
• Location: crates/parametric-eq/src/lib.rs:1858-1863, and the mono twin at :1913-1917
• Current code:

        let mut before_left = [0_u32; EQ_SECTION_COUNT * 2 * MAX_LANES];
        let mut before_right = [0_u32; EQ_SECTION_COUNT * 2 * MAX_LANES];
        if quiet {
            self.left.state_bits(&mut before_left);
            self.right.state_bits(&mut before_right);
        }

• Problem: EQ_SECTION_COUNT * 2 * MAX_LANES is 4 * 2 * 8 = 64 u32, so this is two
  256-byte arrays zeroed unconditionally — 512 bytes of memset per bank per block — whose
  contents are dead unless quiet is true, i.e. dead on every block a console rendering music
  produces. At 64 tracks (8 banks) and a 128-frame quantum at 48 kHz that is 4 KiB per block,
  1.5 MB/s of writes to memory nothing reads. This is the identical defect the compressor's
  Staged documentation records having fixed
  (crates/compressor/src/kernel.rs:565-573: "four memset calls of 4 KiB each, once per bank
  per block, and every byte of them dead"), and the compressor's own render already uses the
  right idiom — let before = quiet.then(|| (...)) (crates/compressor/src/lib.rs:571).
• Proposed change:

        let before = quiet.then(|| {
            let mut left_bits = [0_u32; EQ_SECTION_COUNT * 2 * MAX_LANES];
            let mut right_bits = [0_u32; EQ_SECTION_COUNT * 2 * MAX_LANES];
            self.left.state_bits(&mut left_bits);
            self.right.state_bits(&mut right_bits);
            (left_bits, right_bits)
        });
        // ... later
        self.silent_fixed_point = match before {
            Some((left_before, right_before)) => { /* the existing conjunction */ }
            None => false,
        };

— exactly the compressor's shape, so the two crates stop diverging on the same fast path.

• Expected effect: 512 bytes of zeroing per bank per block removed on every rendering block
  (and 256 in render_mono); no change on the silent path. check-realtime-policy.sh counts no
  allocation here either way — this is stack traffic, not heap — but it is dead-store traffic in
  the render path, which the workspace already treats as a defect.
• Rulings / constraints checked: no ruling covers it; issue Floor pass: resource usage to the theoretical floor (plan, phases 0-5) #163 phase 4 item 1 introduced
  the fast path and the compressor's twin already carries the fix, so this is a divergence
  between two implementations of the same feature rather than a new idea.
• Verification gate: cargo test -p parametric-eq --test silent_fixed_point (which pins both
  the earn and the lose legs, including
  a_negative_zero_input_block_is_not_treated_as_silence), cargo test -p parametric-eq,
  paired scripts/run-console-benchmark.sh.

---

DYN-10: multiband ramp state is stored track-major, so every segment pays ~800 scalar accesses to transpose it into and out of lanes

• Category: perf
• Class: A (bit-identical)
• Severity: medium
• Location: crates/multiband-compressor/src/lib.rs:694 (ramps: [[LinearRamp; RAMP_COUNT]; W]), :1169-1183 (segment), :1191-1201 (store_segment), :1204-1233 (band_coefficients), :1253-1281 (plan_segment)
• Current code:

    fn segment(&self) -> Segment<L> {
        let mut current = [L::zero(); RAMP_COUNT];
        let mut step = [L::zero(); RAMP_COUNT];
        for index in 0..RAMP_COUNT {
            let mut values = [0.0f32; 8];
            let mut steps = [0.0f32; 8];
            for track in 0..W {
                values[track] = self.ramps[track][index].current;
                steps[track] = self.ramps[track][index].step;
            }
            current[index] = L::load(&values[..W]);
            step[index] = L::load(&steps[..W]);
        }
        Segment { current, step }
    }

• Problem: LinearRamp is 16 bytes, so self.ramps[track][index].current is a stride-16
  scalar load. Per block, per side: segment() does RAMP_COUNT * W * 2 = 160 strided scalar
  loads and 160 scalar stores; band_coefficients does 2 * W * 3 = 48 more plus 48 stores;
  plan_segment walks 2 sides * W * RAMP_COUNT = 160 ramps twice (a snap pass and a
  ramping pass), each visit a stride-16 u32 read. That is on the order of 800 scalar memory
  accesses per block before a single sample is rendered — and it is exactly what
  docs/rulings/multiband-ramping-split-boundary.md records as unfinished: "A quiet block
  still gathers twenty lane vectors in Side::segment, still scans a hundred and sixty counters
  in plan_segment ... it is what is left, and it is where the next measurable thing would be."
• Proposed change: store the ramps lane-transposed, as a shared type in effect-runtime
  (the compressor and gate want it too — DYN-16):

// crates/effect-runtime/src/ramp.rs
/// `N` linear ramps of `W` lanes, stored parameter-major and lane-contiguous so that one
/// `L::load` fills one lane vector and the counter scans vectorise.
pub struct LaneRampBank<const N: usize, const W: usize> {
    pub current:   [[f32; W]; N],
    pub target:    [[f32; W]; N],
    pub step:      [[f32; W]; N],
    pub remaining: [[u32; W]; N],
}
impl<const N: usize, const W: usize> LaneRampBank<N, W> {
    pub fn set_target(&mut self, parameter: usize, lane: usize, target: f32, samples: u32);
    pub fn snap_arrivals(&mut self) -> bool;          // the `remaining == 1` pass
    pub fn shortest_flight(&self) -> Option<u32>;     // the `min(remaining - 1)` pass
    pub fn load<L: Lane>(&self, parameter: usize) -> (L, L);  // (current, step)
    pub fn store_current<L: Lane>(&mut self, parameter: usize, value: L, advanced: u32);
}

Then Side::segment() is RAMP_COUNT pairs of L::load with no scalar gather at all,
store_segment is RAMP_COUNT L::stores plus a saturating_sub over a contiguous
[[u32; W]; N] (which auto-vectorises), and plan_segment's two passes walk 640 contiguous
bytes instead of 2 560 strided ones. LinearRamp's scalar API stays for the control plane
and for the crates that address one lane at a time.

• Expected effect: roughly 800 strided scalar accesses per block replaced by ~40 vector
  loads/stores and two vectorisable contiguous scans. Same values, same order, so class A. The
  ramping split it complements was worth 6.4 % of the multiband bank's block cost at W = 8;
  this is the per-segment residual that split explicitly did not remove.
• Rulings / constraints checked: docs/rulings/multiband-ramping-split-boundary.md
  "What would justify reopening what was left", first two bullets, name this exactly.
  docs/rulings/stationary-smoother-hoist-boundary.md Boundary 2 rejects skipping ramp
  arithmetic without re-preparation — that is a different change and is not what this is; this
  changes only where the same words live. Its reopening condition ("settle stopped writing
  more lane words than start_ramp") is not invoked.
• Verification gate: crates/multiband-compressor/src/split.rs runs both FORCE_RAMPING
  arms over seven ramp-boundary scenarios at all three widths, under all three link modes and
  bypassed, comparing every rendered sample and the whole instance by bit pattern — that is
  the gate. Plus cargo test -p multiband-compressor and
  cargo test -p effect-runtime --test ramp --test stationary_hoist.

---

DYN-11: Channel::advance_cursor runs two integer % on the compressor's silent render fast path, contradicting the kernel's own "no %" contract

• Category: realtime-safety
• Class: A (bit-identical)
• Severity: low
• Location: crates/compressor/src/kernel.rs:258-264; called at crates/compressor/src/lib.rs:563-564 and :629
• Current code:

    /// Advance the shared write cursor by a whole block, as `frames` per-sample steps would.
    pub(crate) fn advance_cursor(&mut self, frames: u32) {
        if self.ring_length == 0 {
            return;
        }
        self.cursor = (self.cursor + frames % self.ring_length) % self.ring_length;
    }

• Problem: crates/compressor/src/kernel.rs:13-14 states the crate's own rule: "No %. The
  ring wrap is if next == B { 0 }, and the detector tap is if w >= D { w - D } else { w + B - D } — integer compare-select (F2)." This function breaks it twice, on the
  silent_fixed_point fast path — which is the hot path of the sixty_four_track_idle
  console row, taken once per channel per block on every silent bank. Two 32-bit divisions is
  ~40 cycles of latency on the critical path of a function whose whole point is to cost nothing.
  Also a rule-consistency defect: a reader who trusts the module header will not find this.
• Proposed change:

    pub(crate) fn advance_cursor(&mut self, frames: u32) {
        let length = self.ring_length;
        if length == 0 {
            return;
        }
        // `frames` is the prepared quantum and `cursor < length`, so one reduction and one
        // compare-select suffice; the reduction is kept for a quantum larger than the ring.
        let step = if frames < length { frames } else { frames % length };
        let advanced = self.cursor + step;
        self.cursor = if advanced >= length { advanced - length } else { advanced };
    }

At the launch quanta (frames <= 128, length = 883..1921) the % is never executed.

• Expected effect: two divisions per channel per silent block become one compare and one
  compare-select. Small in absolute terms; it is on the row the floor ruling calls "the worst
  standing in the table" (Boundary 5, 18.0 % of floor), where every removed instruction is a
  larger fraction than elsewhere.
• Rulings / constraints checked: the crate's own F2 rule (kernel.rs:13-14). Bit identity is
  arithmetic identity on u32: cursor < length is an invariant maintained by every writer of
  cursor, and step < length, so cursor + step < 2 * length.
• Verification gate: cargo test -p compressor --test silent_fixed_point --test partition
  (partition-invariance is what pins that the fast path leaves the cursor where the slow path
  would), plus cargo test -p compressor; scripts/check-realtime-policy.sh.

---

DYN-12: ~430 lines of byte-identical descriptor boilerplate copied into eight effect crates

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/compressor/src/lib.rs:68-140, crates/gate-expander/src/lib.rs:63-135,
  crates/multiband-compressor/src/lib.rs:110-170, crates/parametric-eq/src/lib.rs:151-172,
  crates/true-peak-limiter/src/lib.rs:106-180, crates/transient-shaper/src/lib.rs:65-135,
  crates/delay/src/lib.rs:99-170, crates/soft-clip/src/lib.rs:102-175
• Current code:

const fn effect_id(value: &'static str) -> effect_contract::EffectId {
    match effect_contract::EffectId::new(value) {
        Ok(value) => value,
        Err(_) => panic!("valid static effect id"),          // gate: "valid static effect identifier"
    }
}
const fn port_id(value: &'static str) -> PortId {
    match PortId::new(value) { Ok(value) => value, Err(_) => panic!("valid static port id") }
}
const fn parameter_id(value: u32) -> ParameterId {
    match ParameterId::new(value) { Some(value) => value, None => panic!("nonzero parameter id") }
}
#[allow(clippy::too_many_arguments)]
const fn parameter(
    id: u32, display_name: &'static str, display_unit: &'static str, unit: ParameterUnit,
    minimum: f32, maximum: f32, default_value: f32, mapping: ParameterMapping,
    automation_rate: AutomationRate, smoothing: SmoothingRule, smoothing_samples: u32,
) -> ParameterDescriptor { /* ... 20 identical field initialisers ... */ }

• Problem: measured with a script over the eight crates, the four helpers total
  55, 55, 55, 56, 55, 50, 53, 51 = 430 lines, differing only in the panic message strings and
  (for parametric-eq) in parameter taking (band, field) instead of a flat id. Every one
  builds ParameterDomain::Continuous, ParameterChannelPolicy::PerLane, readable: true,
  automatable: !matches!(automation_rate, AutomationRate::None), enum_choices: &[] and
  effect_contract::default_parameter_lattice(..) identically. A new effect copies it again.
• Proposed change: move all four into effect-contract as public const fns beside the
  types they build — effect_contract::{effect_id, port_id, parameter_id, continuous_parameter}
  — since that crate already owns EffectId::new, PortId::new, ParameterId::new and
  default_parameter_lattice. Each effect crate then keeps only its parameter table, which is
  the part that is genuinely per-effect. parametric-eq keeps its parameter(band, field)
  wrapper as a two-line call into the shared one.
• Expected effect: ~380 of 430 lines deleted across eight crates; one place to change when
  ParameterDescriptor gains a field, instead of eight; no render-path effect.
• Rulings / constraints checked: none applies. effect-contract's header says it "has no
  descriptor wire format, digest, package, CID, parser, or persistence envelope" — const
  constructors for its own descriptor types are none of those, and it already exports
  default_parameter_lattice, validate_descriptor and parameter_value_valid.
• Verification gate: cargo test -p effect-contract plus each effect crate's
  tests/contract.rs (they all assert the descriptor validates and that the table matches the
  runtime specs), then scripts/check-effect-descriptor-v1.sh and
  scripts/check-effect-contract.sh — the descriptor identity digests must not move.

---

DYN-13: three per-crate ParameterSpec translation tables exist only to route around a predicate that is now public

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/compressor/src/design.rs:81-118, crates/multiband-compressor/src/lib.rs:425-457, crates/gate-expander/src/lib.rs:326-343
• Current code:

/// The compressor keeps no domain predicate of its own: `params::parameter_value_valid` is the
/// workspace's one implementation, and this table is the descriptor rows expressed in the shape it
/// takes. `tests/contract.rs` asserts row by row that the two agree, so the table cannot drift
/// away from the descriptor it is derived from. (#95 makes the contract's own predicate public
/// and this table goes away with it.)
const fn spec(index: usize) -> ParameterSpec {
    let row = &COMPRESSOR_PARAMETERS[index];
    ParameterSpec {
        kind: ParameterKind::Continuous,
        minimum: match row.minimum { Some(value) => value, None => 0.0 },
        maximum: match row.maximum { Some(value) => value, None => 0.0 },
        mapping: match row.mapping {
            effect_contract::ParameterMapping::Logarithmic => ParameterMapping::Logarithmic,
            _ => ParameterMapping::Linear,
        },
        default: row.default_value,
    }
}
pub(crate) const PARAMETER_SPECS: [ParameterSpec; PARAMETER_COUNT] =
    [spec(0), spec(1), spec(2), spec(3), spec(4), spec(5), spec(6), spec(7)];

• Problem: the comment's precondition has been met — effect_contract::parameter_value_valid
  is public at crates/effect-contract/src/lib.rs:492. So the workspace now carries two
  domain predicates (effect_contract::parameter_value_valid(&ParameterDescriptor, f32) and
  effect_runtime::params::parameter_value_valid(&ParameterSpec, f32)) plus three hand-written
  translation tables between them, plus a descriptor_and_specs_agree test in each crate whose
  only job is to prove the translation did not drift. effect-runtime/src/params.rs:3-6 says
  the module exists because "the contract's own parameter_value_valid is private" — a
  statement that is no longer true.
• Proposed change: decide which predicate is canonical (the contract's, since the descriptor
  is the contract) and make effect_runtime::params::parameter_value_valid a thin forwarder or
  delete it; then delete compressor::design::{spec, PARAMETER_SPECS} (31 lines),
  multiband_compressor::{spec, SPECS} (~30 lines), gate_expander::GATE_SPECS (~14 lines) and
  the three descriptor_and_specs_agree tests they exist to justify. Keep
  ParameterSpec::{continuous, logarithmic, boolean} — they are a convenient literal form — but
  express them as descriptor rows.
• Expected effect: ~75 lines of table plus three tests deleted; one domain predicate in the
  workspace instead of two. Behaviour is already gated equal by the three tests, so this is a
  deletion, not a semantic change. No render-path effect.
• Rulings / constraints checked: none; this is issue 095 Audit: miso-engine-effect-contract and miso-engine-effect-compiler #95's stated follow-through, recorded
  in the source at the site.
• Verification gate: run each crate's tests/contract.rs before deleting the agreement
  tests to confirm they are green, then delete; cargo test -p effect-runtime --test params;
  scripts/check-effect-contract.sh, scripts/check-effect-runtime-policy.sh.

---

DYN-14: parametric-eq open-codes bank::finish_channel, which effect-runtime documents as the divergence it exists to stop

• Category: dry
• Class: A (bit-identical)
• Severity: low
• Location: crates/parametric-eq/src/lib.rs:1872-1885 and :1923-1932; the shared form is crates/effect-runtime/src/bank.rs:246-255
• Current code:

        for (index, (channel, block)) in
            [(&mut self.left, &mut *left), (&mut self.right, &mut *right)].into_iter().enumerate()
        {
            if check_block::<L>(block) { continue; }
            let mask = nonfinite_lane_mask::<L>(block);
            block.fill(0.0);
            channel.reset_states();
            for (lane, failed) in failures[index].iter_mut().enumerate().take(W) {
                *failed = mask & (1 << lane) != 0;
            }
        }

• Problem: crates/effect-runtime/src/bank.rs:241-245 names this verbatim: "Two shipped
  crates already open-code exactly this — parametric-eq and gate-expander both write
  if check_block(block) { … } followed by nonfinite_lane_mask(block) per channel — which is
  the divergence this module exists to stop. They are not rewritten here: each is another
  issue's file. compressor is the first caller." The EQ's version is finish_channel exactly
  (check, mask, zero, reset), so it is a straight substitution. The gate's is not — it recovers
  one lane of one channel and also checks the gain words (crates/gate-expander/src/kernel.rs
  state via crates/gate-expander/src/lib.rs:756-787), and issue 048 Launch gate reset, restore, and recovery proof #48 froze that; leave it, but
  say so.
• Proposed change: replace the EQ's two open-coded bodies with
  let mask = bank::finish_channel::<L>(block, || channel.reset_states()); plus the existing
  mask-to-[bool; MAX_LANES] expansion. Then lift that expansion — it appears in compressor
  (crates/compressor/src/lib.rs:596-599), parametric-eq (twice) and gate-expander — into
  bank as pub fn lane_flags<const N: usize>(mask: u32, width: usize) -> [bool; N].
• Expected effect: ~20 lines deleted; the §4.4 policy has one implementation for every effect
  that recovers per channel. No render-path change (identical operations).
• Rulings / constraints checked: none; the note in bank.rs is the standing record of the
  debt. Explicitly not proposed for gate-expander, whose recovery granularity is frozen.
• Verification gate: cargo test -p parametric-eq --test bank --test contract and the
  crate's non-finite cases; cargo test -p effect-runtime --test bank.

---

[tamashi095]

Audit report — Effects: parametric EQ, compressor, gate/expander, multiband (DYN-*), part 2/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

DYN-15: the compressor's Channel puts 1 152 bytes of control-plane arrays ahead of every word the render path reads

• Category: perf
• Class: A (bit-identical)
• Severity: low
• Location: crates/compressor/src/kernel.rs:83-104
• Current code:

pub(crate) struct Channel<L: Lane> {
    pub(crate) defaults: [[f32; PARAMETER_COUNT]; MAX_WIDTH],   // 256 B — control plane only
    pub(crate) words: CoefWords,                                // 256 B — read once per body
    pub(crate) ramps: [[LinearRamp; MAX_WIDTH]; RAMP_COUNT],    // 896 B — ramping body only
    pub(crate) lookahead_ms: [f32; MAX_WIDTH],                  //  32 B — control plane only
    pub(crate) delay: [u32; MAX_WIDTH],                         //  32 B — hot (the gather)
    pub(crate) gain_reduction_db: L,                            //  hot (the recurrence)
    pub(crate) cursor: u32,                                     //  hot
    pub(crate) ring_length: u32,                                //  hot
    pub(crate) main: Box<[f32]>,                                //  hot
    pub(crate) detector: Box<[f32]>,                            //  hot
}

• Problem: the idle body reads words once, then touches only delay, gain_reduction_db,
  cursor, ring_length and the two Box pointers — 80-odd bytes that today sit behind
  1 408 bytes of defaults + words + ramps + lookahead_ms, i.e. on different cache lines
  from each other and 22 lines into the struct. max_remaining() (called twice per block from
  process_block) walks ramps at stride 16 across 896 bytes, evicting nothing useful but
  touching 14 lines. Two Channels live in one Instance, so the pattern repeats.
• Proposed change: reorder the fields so the render-read set is contiguous and first —
  delay, gain_reduction_db, cursor, ring_length, main, detector, words — and the
  control-plane set (defaults, ramps, lookahead_ms) last. Pure field reordering; no
  #[repr] attribute, no API change. Channel::copy_state_from's explicit field list
  (:161-172) and state::snapshot_lane/commit_channel name fields, not offsets, so nothing
  else moves. Consider splitting ramps into [[f32; MAX_WIDTH]; RAMP_COUNT] lanes (DYN-10's
  LaneRampBank) at the same time, which makes max_remaining a contiguous 224-byte scan.
• Expected effect: the idle body's per-block working set for Channel state drops from ~22
  cache lines to 2. Not separately measured; the honest claim is a layout improvement whose size
  the console row would have to report.
• Rulings / constraints checked: none. Explicitly not a rename (AGENTS.md rule 5): field
  order only.
• Verification gate: cargo test -p compressor (tests/payload.rs pins the state layout,
  which is order-independent by construction since snapshot_lane names fields);
  scripts/check-abi-layout-v1.py if Channel is reachable from a pinned layout — it is
  pub(crate) and is not; paired scripts/run-console-benchmark.sh.

---

DYN-16: three incompatible ramp representations for one D11 law

• Category: dry
• Class: N/A (non-render restructuring)
• Severity: low
• Location: crates/effect-runtime/src/ramp.rs:31-41 (LinearRamp, scalar),
  crates/gate-expander/src/kernel.rs:66-89 + :319-333 (GateRamp<L> and its inline
  next_value transcription), crates/multiband-compressor/src/lib.rs:662-678 (Segment<L>)
• Current code:

// gate-expander/src/kernel.rs:319 — LinearRamp::next_value, retranscribed in the lane domain
        for ramp in &mut state.ramps {
            let moving = ramp.remaining.gt(zero);
            let final_sample = ramp.remaining.eq(one);
            let stepped = ramp.current.add(ramp.step);
            ramp.current = L::select(moving, L::select(final_sample, ramp.target, stepped), ramp.current);
            ramp.step = L::select(final_sample, zero, ramp.step);
            ramp.remaining = L::select(moving, ramp.remaining.sub(one), ramp.remaining);
        }

• Problem: LinearRamp (scalar, u32 counter) is the documented D11 law; GateRamp<L> is
  the same law with the counter held as an integer-valued float in a lane word and the snap
  re-derived by three lane selects per parameter per sample; Segment<L> is a third shape that
  carries current/step only and pushes the snap into plan_segment. Three shapes means the
  D11 rules — "remaining == 0 implies step == +0.0", "assign the target exactly on the final
  sample", the -0.0 and non-finite exclusions — are stated in three places and enforced by
  three different mechanisms. docs/rulings/multiband-ramping-split-boundary.md records that a
  deleted right-channel advance and a deleted D11 snap both passed every gate in the crate
  before that work added tests for them — a direct consequence of the law living in three places.
• Proposed change: LaneRampBank<N, W> from DYN-10, in crates/effect-runtime/src/ramp.rs,
  as the one lane-domain representation, with LinearRamp kept as the scalar per-lane form and
  a documented conversion between them. GateRamp<L> becomes a LaneRampBank<4, W> and its
  inline next_value becomes bank.advance::<L>(); Segment<L> becomes a borrow of one.
• Expected effect: ~60 lines deleted across the two crates; one enforcement site for the D11
  invariants instead of three. Render effect is DYN-10's, not this finding's.
• Rulings / constraints checked: docs/rulings/stationary-smoother-hoist-boundary.md lists
  every effect's existing ramping split and is the reason LinearRamp::stationary_at lives in
  effect-runtime; consolidating the representation does not touch the split decisions, which
  stay per crate.
• Verification gate: cargo test -p effect-runtime --test ramp --test contract_ramp_identity --test stationary_hoist, cargo test -p gate-expander --test contract (its ramp arrival
  pins), crates/multiband-compressor/src/split.rs.

---

DYN-17: the EQ's interleave pays a vector load and store per two sections; the takeable part is the per-pass coefficient and state gather, not the depth

• Category: perf
• Class: A (bit-identical) for the gather; the depth change would be class A but is ruled out
• Severity: low
• Location: crates/parametric-eq/src/lib.rs:1505-1540 (interleave), crates/lane/src/kernels.rs:187-224 (svf_cascade_interleaved)
• Current code:

    for pass in 0..length / DEPTH {
        let base = pass * DEPTH;
        let at: [usize; DEPTH] = core::array::from_fn(|k| list[base + k]);
        let coefficients: [[SvfCoef<L>; DEPTH]; 2] = [
            core::array::from_fn(|k| channels.0.sections[at[k]].coef),
            core::array::from_fn(|k| channels.1.sections[at[k]].coef),
        ];
        let mut state: [[SvfState<L>; DEPTH]; 2] = [
            core::array::from_fn(|k| channels.0.sections[at[k]].state),
            core::array::from_fn(|k| channels.1.sections[at[k]].state),
        ];
        svf_cascade_interleaved::<L, 2, DEPTH>([&mut *left, &mut *right], frames, &coefficients, &mut state);

• Problem: two things, and only one is takeable.
  1. The load/store per pass (svf_cascade_interleaved's L::load(slot) at line 206 and
     x.store(slot) at 220) is Boundary 3's named term. At EQ_SECTION_COUNT = 4 and
     SVF_CASCADE_DEPTH = 2 a stationary block does 2 passes, so 2 vector loads and 2 vector
     stores per channel-frame where a single 4-deep pass would do 1 and 1. That is exactly
     DEPTH = 4, and docs/rulings/cross-bank-interleave.md rules that
     SVF_CASCADE_DEPTH = 2 is at the sixteen-ymm register ceiling, reopening only on a
     machine with more vector registers. Recorded here so the next round does not
     re-derive it; not proposed.
  2. The per-pass gather is takeable. Each pass copies 2 streams * DEPTH * 6 lane words of
     coefficients and 2 * DEPTH * 2 of state in, and 2 * DEPTH * 2 out — 32 lane-word copies
     per pass, 64 per block at 2 passes, i.e. 64 vector loads and 32 vector stores per bank per
     block that exist only because Section is stored section-major while the kernel wants
     pass-major. Small against 128 frames (0.75 memory ops per frame) but pure bookkeeping.
• Proposed change: for (2), hold the sections' coefficient words in a pass-major mirror
  refreshed only where coefficients change (settle, start_ramp, snap, snap_section,
  restore_track — the same five sites that already maintain Channel::identity, see
  crates/parametric-eq/src/lib.rs:842-856), so interleave reads &mirror[pass] directly. The
  elision list makes the pass membership data-dependent, so keep the gather as the fallback for
  a shortened cascade and use the mirror only on the kept == EQ_SECTION_COUNT path.
  State still has to be gathered and scattered — it is written by the kernel.
• Expected effect: ~24 of the 64 lane-word copies per block removed on the un-elided path;
  honest assessment: small, and it is the residual after the two large EQ terms (DYN-8 and the
  ruled-out depth) are accounted for. Include it only if the mirror's five maintenance sites do
  not add more risk than the copies cost — identity_flags_agree already shows the pattern is
  workable and is asserted in debug builds on every stationary block.
• Rulings / constraints checked: docs/rulings/cross-bank-interleave.md (depth is fixed);
  docs/rulings/effect-floor-accounting.md Boundary 3 (this is 65 % of the EQ row's cost
  territory, and the interleave load/store is one of its four named terms).
• Verification gate: cargo test -p parametric-eq --test bank --test analytic --test time_domain --test determinism; the in-crate mod elision arms; then paired
  scripts/run-console-benchmark.sh on the EQ-only control row, which is the row that can see it.

---

Summary table

id	category	class	severity	location	one-line
DYN-1	simd	A	high	crates/compressor/src/kernel.rs:816-878	Per-lane detector gather is W scalar loads + W scalar stores per channel-frame in both fill_taps and gather_detector; a uniform-D arm makes it one vector load.
DYN-2	simd	A	high	crates/gate-expander/src/kernel.rs:259-293	Four tap gathers per frame: two duplicate each other when the channels' taps agree, and two are dead under DualMono.
DYN-3	simd	A	high	crates/multiband-compressor/src/lib.rs:865-880, :1000-1006	detector_tap runs four times per frame with two distinct index sets and no uniform-offset path.
DYN-4	simd	A	high	crates/multiband-compressor/src/lib.rs:902-932	band_amplitude rebuilds GainComputerCoef and re-splats seven constants four times per frame — 28 broadcasts.
DYN-5	simd	A	medium	crates/compressor/src/kernel.rs:906-967, :1066-1074	Link mode and bypass are prepared-time constants spent as per-lane-sample mask selects; const-generic them as the multiband already does.
DYN-6	simd	A	medium	crates/gate-expander/src/kernel.rs:316-357, :392-398	Seven constant splats and three block-invariant mask derivations per channel-sample; no Invariants equivalent.
DYN-7	dry	N/A	medium	compressor/src/kernel.rs:1028, gate-expander/src/kernel.rs:392, multiband-compressor/src/shim.rs:52,:70	Three branching one-poles and three detector links; one kernel each in effect-runtime::dynamics (the shim's own header says so).
DYN-8	perf	A	medium	crates/parametric-eq/src/lib.rs:822-830	Elision gate is a scalar five-int-op-per-word scan; two thirds of it is bank::check_block in the vector domain.
DYN-9	realtime-safety	A	medium	crates/parametric-eq/src/lib.rs:1858-1863, :1913-1917	512 bytes of stack scratch zeroed per bank per block for state only read on silent blocks.
DYN-10	perf	A	medium	crates/multiband-compressor/src/lib.rs:694, :1169-1281	Track-major ramp storage costs ~800 strided scalar accesses per block to transpose into and out of lanes.
DYN-11	realtime-safety	A	low	crates/compressor/src/kernel.rs:258-264	advance_cursor runs two integer % on the silent fast path, against the crate's own "no %" rule.
DYN-12	dry	N/A	medium	eight crates/*/src/lib.rs descriptor headers	~430 lines of byte-identical effect_id/port_id/parameter_id/parameter boilerplate.
DYN-13	dry	N/A	medium	compressor/src/design.rs:81-118, multiband-compressor/src/lib.rs:425-457, gate-expander/src/lib.rs:326-343	Three ParameterSpec translation tables routing around a predicate that is now public.
DYN-14	dry	A	low	crates/parametric-eq/src/lib.rs:1872-1885, :1923-1932	Open-codes bank::finish_channel, which bank.rs:241-245 names as the divergence it exists to stop.
DYN-15	perf	A	low	crates/compressor/src/kernel.rs:83-104	1 152 bytes of control-plane arrays sit ahead of every render-read word of Channel.
DYN-16	dry	N/A	low	effect-runtime/src/ramp.rs:31-41, gate-expander/src/kernel.rs:66-89, multiband-compressor/src/lib.rs:662-678	Three representations of one D11 ramp law, enforced three different ways.
DYN-17	perf	A	low	crates/parametric-eq/src/lib.rs:1505-1540	Interleave's load/store per pass is fixed by the register ceiling; only the per-pass coefficient gather is takeable.

---

Things I checked that are fine

• effect_runtime::dynamics::gain_delta_db / gain_computer_db (dynamics.rs:104-122) —
  one transcription of Giannoulis eq. 4, shared by the compressor and the multiband, branchless,
  with the W/2 comparison form correctly justified as the cheaper equivalent predicate. No
  duplicate exists. The knee's 1/(2W) division is at parameter-change time as required.
• effect_runtime::state_payload — genuinely one codec, used by every effect crate; the
  header records the seven copies it replaced. No divergence remains in the compressor's
  state.rs or the gate's write_lane.
• bank::check_block / nonfinite_lane_mask / block_is_positive_zero — correct shapes:
  one mask_any per block, no horizontal reduction in the loop; block_is_positive_zero is
  chunked and short-circuits because its common answer is "no", block_admits_elision is not
  because its common answer is "yes". Both choices are documented and right.
• compressor::design::rate_coefficient evaluating in f64 rather than using
  envelope::attack_release_coefficient — the divergence is deliberate and the cancellation
  argument at design.rs:17-29 is correct (at 5 000 ms / 96 kHz the f32 form keeps ~7 bits of
  c). Do not "unify" these two.
• Ring depths (Fs/50 + 1) in both the compressor and the multiband — set by the declared
  fixed latency and by the maximum_state word count, so shrinking them is a descriptor change,
  not an optimisation. The detector ring genuinely needs full depth at zero lookahead
  (D = N - L).
• Reusing the main ring as the detector ring in the compressor (it holds |main| under
  DualMono + Detector::Main) — unsound: link mode is per-block state while ring contents
  persist across blocks, so a linked block followed by a dual-mono one would read wrong values.
  The gate already applies the sound version of this (GateRing::detector is empty unless a
  sidechain is connected, audit finding F4).
• Lane-major / transposed rings — rejected with reasons in the preamble: the write side is
  one vector store per frame and would become a W-way scatter on every frame, including
  bypassed and silent ones.
• SVF_CASCADE_DEPTH = 2 and svf_step's frozen operation order — at the register ceiling
  per docs/rulings/cross-bank-interleave.md; lr4_step correctly reuses svf_step rather than
  transcribing a second recurrence, and the high = ap - low construction keeps the band sum
  exact by design.
• effect_contract::transpose_tile_4/8 living in the contract crate — looks like scope
  creep but is argued at crates/effect-contract/src/lib.rs:225-233: the tile is a fact about
  the AoSoA layout the contract defines, and scripts/check-rack-policy.sh depends on the
  vocabulary being the contract's. Accepted.
• Multiband plan_segment's snap-before-scan ordering and the FORCE_RAMPING A/B switch —
  correct and well gated; src/split.rs compares rendered samples and whole instances by bit
  pattern across widths, link modes and bypass.
• LinearRamp::stationary_at's three exclusions (-0.0, non-finite, subnormals not
  excluded) — the subnormal argument depends on issue Canonical FP environment at every render entry: clear FTZ/DAZ, render, restore (fixes the G6 divergence) #146's canonical FP environment and is
  correctly flagged as load-bearing rather than incidental.
• No render-path unwrap/expect/format!/Vec::push/Box::new/allocation in any of the
  four crates' process paths; the only % is DYN-11's. multiband-compressor/tests/no_alloc_render.rs
  already gates the allocation half.

[tamashi095]

Audit report — Effects: true-peak limiter, soft-clip, transient shaper, delay, references (FX-*), part 1/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

FX — effect crates audit (true-peak-limiter, soft-clip, transient-shaper, delay, dsp-reference, conformance)

Scope read: crates/true-peak-limiter/src/lib.rs (5555 L), crates/soft-clip/src/{lib.rs,kernel.rs},
crates/transient-shaper/src/lib.rs, crates/delay/src/lib.rs (2620 L),
crates/lane/src/kernels/halfband.rs, crates/lane/src/kernels.rs, crates/dsp-reference/,
crates/conformance/, crates/effect-runtime/src/, crates/effect-contract/src/lib.rs,
docs/rulings/effect-floor-accounting.md (220–260, 656–700),
docs/rulings/simd-wrapper-around-scalar-inner-loop.md,
docs/rulings/stationary-smoother-hoist-boundary.md,
.github/ISSUE_SPECS/020-transient-shaper.md,
.github/ISSUE_SPECS/332-make-transient-shaper-allocation-gate-render-thread-local.md.

---

FX-1: The limiter's stationary hoist is a branch inside the innermost frame loop, not outside it

• Category: perf
• Class: A (bit-identical)
• Severity: high
• Location: crates/true-peak-limiter/src/lib.rs:1890-1906 (uniform body), crates/true-peak-limiter/src/lib.rs:1701-1717 (per-lane body), crates/true-peak-limiter/src/lib.rs:3086-3096 and crates/true-peak-limiter/src/lib.rs:3197-3207 (the two mono twins); the boolean is computed at :1820-1824 and :1660-1664
• Current code:

                for (step, (((left_frame, right_frame), left_peak), right_peak)) in left_segment
                    .chunks_exact_mut(width) /* ... */ .enumerate()
                {
                    let (limit_left, release_left, limit_right, release_right) = if stationary {
                        (
                            hot_left.limit.resting_value(),
                            hot_left.release.resting_value(),
                            hot_right.limit.resting_value(),
                            hot_right.release.resting_value(),
                        )
                    } else {
                        (
                            hot_left.limit.advance(),
                            hot_left.release.advance(),
                            hot_right.limit.advance(),
                            hot_right.release.advance(),
                        )
                    };

• Problem: stationary is computed once per block (ramps_are_stationary over all four scalar ramp
  arrays, :1820-1824) and the doc comment claims the hoist is "taken once per block at whole-bank
  granularity". The decision is per block; the branch is written per frame, in the hottest loop of
  the kernel. LLVM's SimpleLoopUnswitch has a code-size budget and this loop body is two fully
  inlined channel_frame_uniform calls plus a sliding_minimum_uniform with an inner for _ in 0..window pass — well over the default unswitch threshold, so the compare and its four-way phi
  plausibly survive per frame. Even when it does unswitch, the source form blocks the second win:
  under stationary the four ramp values are loop-invariant and the four RampLanes structs
  (4 × L each = 16 vector words) never need to be live in the loop at all. The ruling's own
  limiter inventory prices the whole ramp stage at "0 on this fixture" — that zero is only real if
  the branch is gone.
  Compare crates/delay/src/lib.rs:1056-1061, where three chunk-invariant conditions
  (matrix_through, matrix_swap, damping_off) are read once and the loop body is hand
  unswitched with an explicit comment that this is loop unswitching rather than a per-sample branch.
  The limiter does the opposite for the same class of condition.
• Proposed change: make the two block bodies const-generic and dispatch once, in
  crates/true-peak-limiter/src/lib.rs:

fn limiter_block<L: Lane>(..) {
    let stationary = ramps_are_stationary(&left.limit) && /* .. */;
    match (lanes_uniform(left) && lanes_uniform(right), stationary) {
        (true,  true)  => limiter_block_uniform::<L, true>(..),
        (true,  false) => limiter_block_uniform::<L, false>(..),
        (false, true)  => limiter_block_per_lane::<L, true>(..),
        (false, false) => limiter_block_per_lane::<L, false>(..),
    }
}

fn limiter_block_uniform<L: Lane, const STATIONARY: bool>(..) {
    // hoisted above the segment walk when STATIONARY:
    let (limit_left, release_left, limit_right, release_right) = /* resting_value()s */;
    // frame loop body loses the branch entirely
}

Apply the same shape to limiter_block_per_lane, limiter_block_uniform_mono and
limiter_block_per_lane_mono. resting_value is already const fn returning self.current, so
the hoisted values are the same words the per-frame call returns — no arithmetic moves.

• Expected effect: removes one predictable compare + four-value phi per lane-frame from the
  138-op kernel, and lets the four RampLanes (16 vector words) stay out of the loop's live set on
  the standing fixture, which is at the 16-ymm ceiling per docs/rulings/cross-bank-interleave.md.
  Register pressure, not the compare, is the likely win. Code size: 4 monomorphisations of each body
  instead of 1 — measure .text growth.
• Rulings / constraints checked: stationary-smoother-hoist-boundary.md adopted the hoist for
  the limiter explicitly ("The limiter is the nearest such case: it had no ramping split at all, so
  its hoist is a pure removal with no settle to pay for"); this finding does not re-propose the
  hoist, it proposes moving the already-adopted branch out of the loop. No arithmetic, no operand
  order and no rounding changes, so class A. No runtime dispatch is introduced: the four arms are
  chosen by data the block already computed, exactly as process_bank_inner's existing
  const MONO: bool is (:2968).
• Verification gate: cargo test -p true-peak-limiter (the E12 corpus digests in
  tests/determinism.rs and a_uniform_cohort_renders_exactly_the_per_lane_path are bit gates), plus
  objdump -d of limiter_block_uniform in a release build showing no compare/cmov in the frame
  loop and four fewer live vector registers; then scripts/run-console-benchmark.sh on
  fixtures/session/v1/console-sixty-four-track.toml.

---

FX-2: The detector — 79 % of the limiter kernel — indexes with open-ended slices, defeating the R1(c) bounds-check elision the same crate documents

• Category: perf
• Class: A (bit-identical)
• Severity: medium
• Location: crates/true-peak-limiter/src/lib.rs:1603-1619
• Current code:

fn detector_chunk<L: Lane>(
    taps: &mut History<L>,
    io: &[f32],
    chunk: usize,
    span: usize,
    fir: &[[L; 4]; HISTORY_WORDS],
    peaks: &mut [f32; DETECTOR_CHUNK * MAXIMUM_WIDTH],
) {
    let width = L::WIDTH;
    let mut history = *taps;
    for frame in 0..span {
        let base = (chunk + frame) * width;
        let x = L::load(&io[base..]);
        detector_peak(&mut history, x, fir).store(&mut peaks[frame * width..]);
    }
    *taps = history;
}

• Problem: Lane::load is lanes.copy_from_slice(&src[..$width]) and Lane::store is
  dst[..$width].copy_from_slice(..) (crates/lane/src/wide_impl.rs:155-164), i.e. a panicking
  sub-slice. Handed &io[base..] and &mut peaks[frame * width..] — both open-ended slices whose
  length the compiler must recompute from a runtime base — each frame pays: the io[base..] range
  check, the < WIDTH check inside load, the peaks[frame*width..] range check, and the
  < WIDTH check inside store. Two channels ⇒ ~8 compares + branches per lane-frame on the stage
  the ruling prices at 109 of 138 lane-ops. This is precisely the pattern the crate's own ring_lane
  doc (:1024-1030) says it fixed elsewhere: "the sub-slice handed to Lane::load has a statically
  known length, so the width check inside load folds away and one of the two bounds checks per
  access disappears" — and limiter_block_uniform's frame loop already uses chunks_exact_mut
  (:1878-1884) for the same reason. detector_chunk was left on the old form when round 2 factored
  it out of the two block bodies.
• Proposed change: hand detector_chunk the chunk's sub-slices and walk them with
  chunks_exact, which yields exactly-width slices:

fn detector_chunk<L: Lane>(
    taps: &mut History<L>,
    io: &[f32],                 // exactly span * L::WIDTH
    fir: &[[L; 4]; HISTORY_WORDS],
    peaks: &mut [f32],          // exactly span * L::WIDTH
) {
    let mut history = *taps;
    for (frame, out) in io
        .chunks_exact(L::WIDTH)
        .zip(peaks.chunks_exact_mut(L::WIDTH))
    {
        detector_peak(&mut history, L::load(frame), fir).store(out);
    }
    *taps = history;
}

Callers pass &io[chunk * width..(chunk + span) * width] and &mut peaks[..span * width], so the
two range checks move out of the loop to one per chunk (one per 32 frames).

• Expected effect: ~8 compares/branches per lane-frame removed from the detector, replaced by 4
  per 32-frame chunk. No arithmetic changes; the same twelve add(mul(..)) steps in the same order.
• Rulings / constraints checked: effect-floor-accounting.md Boundary 4 counts the uniform path
  at 10 loads and 8 stores per lane-sample and calls the detector untouched by round 1 — this is
  bookkeeping around those loads, not new arithmetic. Not a rejected candidate: round 2's R1(c) note
  proposes exactly this transformation for the rings and it was adopted there.
• Verification gate: cargo test -p true-peak-limiter --test determinism (E12 digests at W1/W4/W8),
  plus objdump -d of the detector_chunk body showing no cmp/jae between the twelve
  vmulps/vaddps groups.

---

FX-3: The limiter divides by hot.window once per lane-sample where the divisor is block-constant (class B — flag only)

• Category: dsp-math
• Class: B (moves rendered bits — flag only, no change proposed)
• Severity: medium
• Location: crates/true-peak-limiter/src/lib.rs:1551 (channel_frame_uniform), crates/true-peak-limiter/src/lib.rs:1308 (channel_frame)
• Current code:

    hot.box_sum = hot.box_sum.add(quantised).sub(expired);
    store_ring_lane::<L>(uniform.box_ring, slots.ring_cursor, quantised);
    let smoothed = hot.box_sum.div(hot.window);

• Problem: hot.window is loaded once per block into HotChannel and is a per-lane preparation
  constant (LaneShape::window). This is a vdivps per lane-frame — one of the two divides the
  floor accounting notes "are counted as one op each, which flatters the floor: vdivps is neither
  single-cycle nor well pipelined". On Zen 4 / Golden Cove vdivps ymm is ~11 cycles latency, ~5
  reciprocal throughput, against a measured 13.918 cycles/lane-sample for the whole isolate.
• Proposed change: none. Recorded because the ruling asks the next round's exit report to say
  whether it was taken, and because the code is now precisely located. The class-B candidate is a
  splatted reciprocal computed at block entry (box_sum * (1/window)), which moves a rendered bit
  and is the owner's to rule on. The second divide, limit.div(peak) at :1529, is genuinely
  data-dependent and is not part of this note.
• Expected effect: unknown by design; not proposed.
• Rulings / constraints checked: effect-floor-accounting.md lines 250-255 names this exact
  divide and states "a splatted reciprocal would remove it — at the cost of moving a rendered bit,
  which makes it class B and not this document's to take". PREAMBLE constraint 1 forbids proposing it.
• Verification gate: n/a (flag only). If the owner ever rules on it, the gate is the crate's
  bs1770_annex2_conformance_is_unchanged and the E12 digests, both of which would go red by
  construction.

---

FX-4: Loop-invariant constants re-splatted inside three per-sample kernels, while each crate already owns a prepared coefficient struct to hold them

• Category: simd
• Class: A (bit-identical)
• Severity: medium
• Location:
  • crates/transient-shaper/src/lib.rs:317, :319, :321-322, :329-330, :331 (seven splats per channel-frame in frame), crates/transient-shaper/src/lib.rs:292 (half in link)
  • crates/soft-clip/src/kernel.rs:150-157 (five splats per cubic call, called twice per frame — ten per frame)
  • crates/true-peak-limiter/src/lib.rs:1528, :1543, :1545 and :1284, :1292, :1294
• Current code:

// crates/transient-shaper/src/lib.rs:314-336
fn frame<L: Lane>(x: L, u: L, c: &Coef<L>, e: &mut Env<L>, p: &Params<L>, bypass: L::Mask) -> L {
    e.fast = ar_one_pole_step(e.fast, u, &c.fast);
    e.slow = ar_one_pole_step(e.slow, u, &c.slow);
    let floor = L::splat(FLOOR);
    let ratio = e.fast.max(floor).div(e.slow.max(floor));
    let contrast = log2_lane(ratio).mul(L::splat(DB_PER_OCTAVE));
    let contrast = contrast
        .min(L::splat(CONTRAST_LIMIT_DB))
        .max(L::splat(-CONTRAST_LIMIT_DB));

• Problem: Coef<L> at crates/transient-shaper/src/lib.rs:228-232 is documented as "Per-bank
  follower coefficients, splatted once at prepare (master plan §4.2)" — and then seven more
  block-invariant constants are splatted inside the per-frame body, twice per frame (both channels).
  Same in cubic, which is called twice per soft-clip frame and re-splats -1.0, 1.0, 3.0,
  -2/3, 2/3 each time, while its caller soft_clip_block already hoists one, half and zero
  to block entry (kernel.rs:182-184) — an inconsistency inside one file. The limiter's
  LimiterCoef (:406-413) holds the splatted 48-entry FIR table but not 1.0, BOX_GRID or
  1/BOX_GRID.
  This is the ruling's named gap term (b), "vbroadcastss re-splatting loop-invariant constants".
  Honest caveat: these are compile-time constants, so LLVM materialises each as a 16/32-byte
  .rodata constant and LICM will normally hoist the load; the residual cost is real only where
  register pressure forces a reload per frame — which is exactly where these kernels sit
  (cross-bank-interleave.md: SVF_CASCADE_DEPTH=2 is at the 16-ymm ceiling). The finding is worth
  taking because it is free and because it makes the source say what the comments already claim.
• Proposed change: move every compile-time-constant splat into the existing prepared struct.
  • transient-shaper: extend Coef<L> with floor, db_per_octave, contrast_hi, contrast_lo, shape_hi, shape_lo, octaves_per_db, half, zero, one and take &Coef<L> in link too.
  • soft-clip: give cubic a &CubicConst<L> argument (or hoist the five into SoftClipCoef<L>
    at kernel.rs:66-77, which is already the per-block coefficient struct).
  • true-peak-limiter: add one, box_grid, box_grid_recip to LimiterCoef<L> (:406).
    None of this changes an operand, an order or a rounding.
• Expected effect: up to 14 (transient-shaper, two channels), 10 (soft-clip) and 3 (limiter)
  broadcast/.rodata loads per frame removed from the source; the real machine-level delta depends
  on whether LICM was already hoisting them, which the objdump gate answers.
• Rulings / constraints checked: effect-floor-accounting.md "class B candidates" table names
  re-splatting as gap term (b) and it is class A to fix. Not the rejected
  simd-wrapper-around-scalar-inner-loop.md candidate: no API shape changes and no scalar inner loop
  is involved.
• Verification gate: cargo test -p transient-shaper -p soft-clip -p true-peak-limiter (each
  crate's tests/determinism.rs pins are bit gates); objdump -d counting vbroadcastss /
  vmovaps-from-.rodata inside the frame loop of frame, soft_clip_block and
  channel_frame_uniform before and after.

---

FX-5: The limiter's mono-collapse path is a hand-copied 213-line duplicate of the dual block bodies

• Category: dry
• Class: A (no arithmetic change)
• Severity: medium
• Location: crates/true-peak-limiter/src/lib.rs:3030-3242 (limiter_block_mono, limiter_block_per_lane_mono, limiter_block_uniform_mono) against crates/true-peak-limiter/src/lib.rs:1575-1963 (limiter_block, limiter_block_per_lane, limiter_block_uniform)
• Current code:

// crates/true-peak-limiter/src/lib.rs:3008-3029, the module note above the copies
// Each is the dual body with the right channel's arguments deleted and every remaining line left
// where it was. Three things are restatements rather than deletions:
//
// * the peak **link** is computed on the one plane read twice, in the original operation order:
//   `peak_left.max(peak_left)`. ...
// * `stationary` is the four-ramp conjunction with the right channel's two conjuncts dropped. ...
// * `lanes_uniform` is the whole-bank branch, and it takes the same reading for the same reason ...

• Problem: three functions totalling 213 lines exist only to delete a channel from three other
  functions totalling ~390 lines. Every future change to the segment walk, the cursor advance, the
  chunk loop or the stationary hoist (FX-1) must be made twice, and the comment block above the
  copies is itself the evidence — it enumerates three places where the copies must be kept
  deliberately non-obvious so the two read the same. PreparedTruePeakLimiterBank::process_bank_inner
  (:2968) already demonstrates the crate's own answer to this problem, const MONO: bool.
• Proposed change: the frame bodies (channel_frame, channel_frame_uniform) are already shared;
  only the block scaffolding is duplicated. Extract the scaffolding, in
  crates/true-peak-limiter/src/lib.rs:

/// Walks the block in wrap-free segments, handing the callback both channels' slots.
#[inline(always)]
fn walk_segments<L: Lane>(
    shape: &Shape, frames: usize, cursors: &mut Cursors,
    left_offsets: WindowOffsets, right_offsets: WindowOffsets,
    mut body: impl FnMut(usize /*chunk*/, usize /*frame*/, usize /*run*/, Segment),
) { /* the loop currently written out at :1845-1940 and again at :3160-3235 */ }

Then limiter_block_uniform and limiter_block_uniform_mono become the two callbacks, and the
same for the per-lane pair. Alternatively make the bodies const MONO: bool and pass the right
channel as right_io: &mut [f32] of length 0 with every right-channel statement inside
if !MONO { .. } — but the segment-walk extraction is the smaller, safer change and does not need
a second ChannelState borrow.

• Expected effect: ~150 of the 213 duplicated lines deleted; one place to change the segment walk;
  FX-1 becomes a two-site edit instead of a four-site edit.
• Rulings / constraints checked: #[inline(always)] + a FnMut that captures the hot state is
  monomorphised and flattened, so no indirect call reaches the render path; this is the shape
  effect_runtime::bank::finish_block already uses (impl FnOnce() reset closure). No arithmetic
  and no operation order changes. Not the simd-wrapper-around-scalar-inner-loop.md candidate: the
  dominant kernel body stays lane-generic and in-line.
• Verification gate: cargo test -p true-peak-limiter — tests/mono_collapse.rs (314 lines) is
  the existing bit gate that the collapsed and dual bodies agree, plus tests/determinism.rs digests.

---

FX-6: Soft-clip has no stationary-ramp split at all — nine block-invariant operations per channel-frame

• Category: perf
• Class: A (bit-identical, if written as the one-shot form below)
• Severity: medium
• Location: crates/soft-clip/src/kernel.rs:188-215 (frame loop), crates/soft-clip/src/lib.rs:401-446 (Channel::process, the segment splitter)
• Current code:

    for frame in io.chunks_exact_mut(width) {
        drive = drive.add(c.drive_step);
        output = output.add(c.output_step);
        mix = mix.add(c.mix_step);
        // ...
        let dry = L::load(history_row::<L>(&h.dry, base - DRY_DELAY));
        let a = one.sub(mix);
        let b = a.mul(dry);
        let w = mix.mul(wet);
        let summed = b.add(w);
        let y = output.mul(summed);

        let identity = L::mask_or(c.bypass, L::mask_and(mix.eq(zero), output.eq(one)));
        L::select(identity, dry, y).store(frame);

• Problem: in steady state every lane's remaining is 0, so step_vector (lib.rs:452-460)
  yields exactly +0.0 for all three steps and drive, output, mix are block-constant. The
  kernel nonetheless spends, per channel-frame: three adds of +0.0; drive.add(drive) inside the
  X push (:195); one.sub(mix); and the four mask ops of identity (mix.eq, output.eq,
  mask_and, mask_or) — nine loop-invariant lane operations, all recomputed every sample. The
  stationary-smoother-hoist-boundary.md table of effects that already have a ramping split
  (parametric EQ, compressor, gate, matrix, fader) does not include soft-clip, and soft-clip has
  no coefficient design step at all (its "coefficients" are the raw ramp steps), so it is exactly
  the case that ruling names as reopen-worthy.
• Proposed change: add const STATIONARY: bool to soft_clip_block in
  crates/soft-clip/src/kernel.rs, dispatched from Channel::process on
  self.ramps.iter().flatten().all(|r| r.remaining == 0). Crucially, the stationary arm must apply
  each add once at block entry rather than skip it, which is bit-identical for every input including
  -0.0 and NaN ((x + 0.0) + 0.0 == x + 0.0 exactly):

    if STATIONARY {
        drive  = drive.add(c.drive_step);      // once
        output = output.add(c.output_step);
        mix    = mix.add(c.mix_step);
    }
    let twice_drive = if STATIONARY { drive.add(drive) } else { /* per frame */ };
    let a          = if STATIONARY { one.sub(mix)      } else { /* per frame */ };
    let identity   = if STATIONARY {
        L::mask_or(c.bypass, L::mask_and(mix.eq(zero), output.eq(one)))
    } else { /* per frame */ };

Skipping the add outright would not be bit-identical (-0.0 + 0.0 == +0.0), so the one-shot
form is load-bearing.

• Expected effect: 9 of roughly 145 lane-ops per channel-frame removed on the steady-state path
  (~6 %). No settle cost to pay: soft-clip's parameter events write a LinearRamp and nothing else,
  which is the precondition the ruling states for the hoist to be independently worthwhile.
• Rulings / constraints checked: stationary-smoother-hoist-boundary.md Boundary 2 rejects the
  ramp-arithmetic hoist as a standalone change only where a settle writes more lane words than
  start_ramp — "It would become independently worthwhile if ... an effect appeared whose ramp
  arithmetic were large relative to its coefficient preparation." Soft-clip has zero coefficient
  preparation. Boundary 1 (untouched tracks were already free) does not apply, because unlike every
  effect in that table soft-clip has no counter-based split to be already on.
• Verification gate: cargo test -p soft-clip — tests/ramp_law.rs, tests/partition_invariance.rs,
  tests/lane_identity.rs, tests/polyphase_identity.rs and tests/determinism.rs are all bit gates;
  then crates/soft-clip/tests/descriptive_bench.rs for the ns/lane-frame delta.

---

FX-7: Soft-clip's dry history is a 64-row double-written ring where 32 rows and one store would do

• Category: perf
• Class: A (bit-identical)
• Severity: medium
• Location: crates/soft-clip/src/kernel.rs:194 and :204, crates/lane/src/kernels/halfband.rs:126-133 (history_push), crates/soft-clip/src/kernel.rs:110-131 (SoftClipHistory)
• Current code:

// crates/lane/src/kernels/halfband.rs:126-133
pub fn history_push<L: Lane>(history: &mut [f32], pos: usize, value: L) {
    let width = L::WIDTH;
    value.store(&mut history[pos * width..]);
    value.store(&mut history[(pos + HALFBAND63_LIVE_ROWS) * width..]);
}
// crates/soft-clip/src/kernel.rs:194, 204
        history_push::<L>(&mut h.dry, pos, xin);
        let dry = L::load(history_row::<L>(&h.dry, base - DRY_DELAY));

• Problem: the double-write exists so that the 31-row window the tap loops read is contiguous
  — which h.x and h.e genuinely need (halfband2x_interp_even reads rows base-30 .. base-1).
  h.dry reads exactly one row, at the fixed age DRY_DELAY = 31, i.e. row
  base - 31 = pos + 1. It needs no contiguous window, so it pays a second vector store per frame
  (one of the six the kernel issues) and double the state for nothing. With HALFBAND63_LIVE_ROWS
  a power of two, the read index is one mask: (pos + 1) & HALFBAND63_POS_MASK.
  Footprint: h.dry is 64 * W * 4 bytes per channel — 2 048 B at W8, 4 096 B per stereo bank —
  half of it dead.
• Proposed change: add a single-write variant to crates/lane/src/kernels/halfband.rs and use it
  for the dry line only:

/// One-row push for a history whose reader takes a single fixed age (no contiguous window).
#[inline(always)]
pub fn history_push_single<L: Lane>(history: &mut [f32], pos: usize, value: L) {
    value.store(&mut history[pos * L::WIDTH..(pos + 1) * L::WIDTH]);
}

and in crates/soft-clip/src/kernel.rs allocate dry at HALFBAND63_LIVE_ROWS * width, push with
history_push_single, and read with history_row::<L>(&h.dry, (pos + 1) & HALFBAND63_POS_MASK).
The state payload is unaffected: write_lane_words already reads the dry line through
history_row_of_age (crates/soft-clip/src/lib.rs:583-597), which masks to live rows only, and
DRY_HISTORY_AGES = 31 needs ages 0..30, i.e. rows (pos + 31 - age) & 31 — all live.

• Expected effect: one of six vector stores per channel-frame removed (~17 % of the kernel's store
  traffic); 1 024 B per channel (2 048 B per stereo bank at W8) of state removed, which matters for
  the L1 residency of a 64-track console with soft clip in a rack. No arithmetic changes.
• Rulings / constraints checked: the halfband module doc justifies the double write by "the
  31-row window the taps read is always contiguous" — true for x and e, and the finding does not
  touch those. Not a class-B change: the value stored and the value loaded are the same word at the
  same age.
• Verification gate: cargo test -p soft-clip (tests/polyphase_identity.rs one-million-sample
  bit gate, tests/state_roundtrip.rs, tests/determinism.rs pins), plus
  cargo test -p soft-clip --test contract for the frozen LANE_STATE_WORDS/resource rows.

---

FX-8: halfband2x_decim_even tests a loop counter against a constant on every tap

• Category: perf
• Class: A (bit-identical)
• Severity: low
• Location: crates/lane/src/kernels/halfband.rs:182-197
• Current code:

pub fn halfband2x_decim_even<L: Lane>(history: &[f32], base: usize, odd: L) -> L {
    let width = L::WIDTH;
    let window = &history[(base - HALFBAND63_EVEN_TAPS) * width..base * width];
    let mut acc = L::zero();
    for (index, (row, tap)) in window.chunks_exact(width).rev().zip(HALFBAND63_EVEN).enumerate() {
        if index == HALFBAND63_CENTER_SPLIT {
            acc = acc.add(L::splat(HALFBAND63_CENTER).mul(odd));
        }
        acc = acc.add(L::splat(tap).mul(L::load(row)));
    }
    acc
}

• Problem: 30 integer compares per call, one per tap, to place a single constant contribution at a
  known position. The trip count is the constant 30, so LLVM will normally unroll and fold the
  compares away — but the function is called once per soft-clip frame per channel and the source form
  makes the structure (k = 1..=15, centre, k = 16..=30) invisible, which is also what the doc
  comment has to spell out in prose.
• Proposed change: split the loop at the known boundary, in
  crates/lane/src/kernels/halfband.rs:

    let mut acc = L::zero();
    let mut rows = window.chunks_exact(width).rev();
    for tap in HALFBAND63_EVEN[..HALFBAND63_CENTER_SPLIT].iter().copied() {
        acc = acc.add(L::splat(tap).mul(L::load(rows.next().expect("row"))));
    }
    acc = acc.add(L::splat(HALFBAND63_CENTER).mul(odd));
    for tap in HALFBAND63_EVEN[HALFBAND63_CENTER_SPLIT..].iter().copied() {
        acc = acc.add(L::splat(tap).mul(L::load(rows.next().expect("row"))));
    }

(or index the window directly to avoid the iterator expect, which must not be on a data-dependent
path — the counts are compile-time constants, so an indexed form is preferable for the realtime
policy check.)

• Expected effect: 30 compares per call removed from the source; likely zero at machine level if
  the loop was already unrolled, but the accumulation order is made structurally obvious rather than
  asserted in prose. Take it as a readability + guarantee change, not a measured win.
• Rulings / constraints checked: the centre tap must stay between k = 15 and k = 16 — the split
  preserves it exactly, which is the doc's own stated condition ("moving it changes the bits").
• Verification gate: cargo test -p soft-clip --test polyphase_identity (one million samples,
  zero mismatches) and cargo test -p soft-clip --test determinism.

---

FX-9: Transient-shaper recomputes a block-invariant identity mask per channel-frame on its dominant (steady-state) path

• Category: perf
• Class: A (bit-identical)
• Severity: medium
• Location: crates/transient-shaper/src/lib.rs:333-335, reached from the tail loop at crates/transient-shaper/src/lib.rs:513-528
• Current code:

    let gain = exp2_lane(shape.mul(L::splat(OCTAVES_PER_DB)));
    let wet = gain_mix_step(x, gain, p.mix);
    let identity = L::mask_or(bypass, L::mask_or(p.mix.eq(zero), shape.eq(zero)));
    L::select(identity, x, wet)

• Problem: Shaper::run splits the block into a ramping prefix and a resting tail
  (:490-528), and Ramps::prefix() is documented as "zero in steady state (finding F6)" — so the
  tail loop is the dominant path, exactly as the 020 Launch dual-envelope transient shaper #20 record's 4.96 ns W8 measurement claims. In that
  loop p.mix and bypass are both block-constant, so L::mask_or(bypass, p.mix.eq(zero)) is
  block-constant: one eq and one mask_or per channel-frame that could be computed once per block.
  Two channels ⇒ 4 lane-ops per frame. On the bitselect-lowering targets the ruling names as gap
  term (a), a mask op is three bitwise instructions, not one.
• Proposed change: make frame take the partially-folded mask instead of bypass, and fold it
  once per loop in crates/transient-shaper/src/lib.rs:

fn frame<L: Lane>(x: L, u: L, c: &Coef<L>, e: &mut Env<L>, p: &Params<L>, quiet: L::Mask) -> L {
    // ...
    let identity = L::mask_or(quiet, shape.eq(L::zero()));
    L::select(identity, x, wet)
}
// in run(), for the tail loop only:
let quiet_left  = L::mask_or(bypass, pl.mix.eq(L::zero()));
let quiet_right = L::mask_or(bypass, pr.mix.eq(L::zero()));

The prefix loop keeps computing it per frame (its mix moves), so step takes the two masks
rather than one bypass. mask_or is associative over bit patterns and both operands are
all-ones/all-zeros lane masks, so or(bypass, or(mix_eq, shape_eq)) == or(or(bypass, mix_eq), shape_eq) bit for bit.

• Expected effect: 2 lane-ops per channel-frame, 4 per frame, removed from the dominant loop —
  against a kernel whose per-frame op count is dominated by log2_lane/exp2_lane, so a low single-digit
  percentage. Combined with FX-4's seven splats it is ~18 source-level ops per frame.
• Rulings / constraints checked: simd-wrapper-around-scalar-inner-loop.md requires that any
  transient-shaper change keep the dominant kernel in the lane-generic body — this change stays inside
  it and adds no scalar work. Verified against the ruling's amendment: the reworked W8 block kernel
  (4.96 ns) is the current shape, and the tail loop of run is it.
• Verification gate: cargo test -p transient-shaper (tests/bank.rs, tests/cross_target.rs,
  tests/oracle.rs, tests/partition.rs are bit gates), then the 020 Launch dual-envelope transient shaper #20 descriptive protocol:
  release, 48 kHz, 128-frame blocks, 20 000 blocks, W1 and W8 ns/lane-frame through the public factory.

---

FX-10: The delay zero-initialises 2 KB of stack tap windows on every process call

• Category: realtime-safety
• Class: A (bit-identical)
• Severity: high
• Location: crates/delay/src/lib.rs:1266, crates/delay/src/lib.rs:729-746
• Current code:

// crates/delay/src/lib.rs:729-746
struct TapWindows {
    left_old: [f32; CHUNK_FRAMES],
    left_new: [f32; CHUNK_FRAMES],
    right_old: [f32; CHUNK_FRAMES],
    right_new: [f32; CHUNK_FRAMES],
}
impl TapWindows {
    const fn new() -> Self {
        Self { left_old: [0.0; CHUNK_FRAMES], /* ... */ }
    }
}
// crates/delay/src/lib.rs:1266, inside PreparedNativeEffect::process
        let mut windows = TapWindows::new();

• Problem: 4 * 128 * 4 = 2 048 bytes of stack are materialised and zero-filled at the top of
  every render block, on the render thread. The zeroing is dead work: fill_windows overwrites
  *_old for the chunk, and *_new is written only while a crossfade is running — the kernel never
  reads it otherwise (tap_sample returns old when !lane.fading). The compiler cannot elide the
  initialiser because the subsequent writes cover only [..frames] and only conditionally, so a
  memset/.rodata memcpy of 2 KB stands per block per delay instance. With one delay per track on a
  64-track session that is 128 KB of pure memset per 128-frame block, plus 2 KB of render-thread stack
  depth. The crate preallocates its two 384 KB rings at prepare (:450) and this is the one buffer it
  did not.
• Proposed change: make it a preallocated field, in crates/delay/src/lib.rs:

pub struct PreparedDelay {
    // ...
    windows: TapWindows,   // constructed once in prepare_delay()
}
// process():
        let windows = &mut self.windows;   // no initialisation on the render path

PreparedDelay is already boxed by bind/prepare and lives for the plan's lifetime, so this
moves 2 KB from the render stack into the prepared allocation — which is where every other buffer
in the crate already is. Note the borrow split: process_chunk takes &mut self and
&mut TapWindows, so the field must be temporarily moved out (core::mem::take-free: pass
&mut self.windows alongside a &mut split of the two lanes, or restructure process_chunk to
take &mut DelayLane, &mut DelayLane, &mut TapWindows explicitly rather than &mut self).

• Expected effect: 2 048 bytes of memset per block per instance removed, and the same amount of
  render-thread stack. On the 64-track console fixture that is 128 KB/block of store traffic that
  never reaches the kernel.
• Rulings / constraints checked: AGENTS.md "Approved audio architecture" — render performs no
  allocation and preallocation belongs to the prepared plan; this is a stack-zeroing cost, not a heap
  allocation, so it does not currently trip scripts/check-realtime-policy.sh, which is why it
  survived. No arithmetic touched.
• Verification gate: cargo test -p delay (tests/determinism.rs digests,
  partition_invariance_over_1_7_64_128_512, dry_identities_warm_histories_with_canonical_zero_state),
  plus a perf stat/objdump check that no memset/rep stos remains at the head of
  PreparedDelay::process.

---

FX-11: The delay leaves two chunk-invariant conditions as per-sample branches in tap_sample, twenty lines after hand-unswitching three others

• Category: perf
• Class: A (bit-identical)
• Severity: medium
• Location: crates/delay/src/lib.rs:1139-1152 (tap_sample), called at crates/delay/src/lib.rs:1072-1073; contrast with crates/delay/src/lib.rs:1050-1062
• Current code:

fn tap_sample(lane: &LaneChunk<'_>, frame: usize, last: usize, alpha: &mut f32, step: f32) -> f32 {
    let old = lane.old[frame];
    if !lane.fading {
        return old;
    }
    let new = lane.new[frame];
    *alpha += step;
    if lane.fade_last && frame == last {
        return new;
    }
    alpha.fma(new - old, old)
}

• Problem: lane.fading and lane.fade_last are both fields of LaneChunk, which the crate's own
  doc calls "Everything one lane contributes to one chunk, all of it constant across the chunk"
  (:748). Twenty lines above, delay_chunk explicitly hand-unswitches three equally chunk-invariant
  conditions with the comment "They are read once, so the loop is unswitched rather than branched per
  sample" (:1050-1053). fading and fade_last were not given the same treatment, so the common
  case (no crossfade running — the overwhelming majority of blocks) still executes a load-and-branch
  per sample per channel, and the branch sits directly on the tap read that everything downstream
  depends on.
• Proposed change: make tap_sample const-generic and unswitch at the same place the other three
  are, in crates/delay/src/lib.rs:

#[inline(always)]
fn tap_sample<const FADING: bool>(
    lane: &LaneChunk<'_>, frame: usize, last: usize, alpha: &mut f32, step: f32,
) -> f32 {
    let old = lane.old[frame];
    if !FADING { return old; }
    // ... unchanged
}
// in delay_chunk, alongside matrix_through / damping_off:
match (left.fading, right.fading) {
    (false, false) => run_frames::<false, false>(..),
    // ...
}

or, cheaper to write, hoist a single let fading = left.fading || right.fading; and split the frame
loop into a non-fading body (which drops alpha, new, and both branches for both channels) and
the existing general body. fade_last && frame == last is only reachable inside the fading arm.

• Expected effect: on the dominant no-crossfade path: two loads + two predictable branches per
  frame per channel removed, plus the alpha accumulator and the new window load. The new window
  is also never filled in that case (fill_windows at :534-539 already skips it), so the
  non-fading body needs no new slice at all.
• Rulings / constraints checked: the frozen operation order in the delay_chunk doc
  (:1000-1021) lists the tap as "fma blend while crossfading" — the non-fading arm is defined as
  returning old, so the specialisation is the arm the select always chooses, the exact argument the
  crate already makes for matrix_through / damping_off. Class A.
• Verification gate: cargo test -p delay — crossfade_updates_are_exact_and_queued_retarget_completes,
  ramp_updates_retarget_and_partition_are_exact, tap_timing_is_sample_exact,
  partition_invariance_over_1_7_64_128_512, and tests/determinism.rs G5 digests.

---

FX-12: Every effect crate re-declares the same three const panic-wrappers around effect-contract's id constructors

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/true-peak-limiter/src/lib.rs:106-126, crates/soft-clip/src/lib.rs:102-121, crates/transient-shaper/src/lib.rs:65-84, crates/delay/src/lib.rs:99-119, crates/compressor/src/lib.rs:68-…, crates/gate-expander/src/lib.rs:63-…, crates/parametric-eq/src/lib.rs:158-…, crates/multiband-compressor/src/lib.rs:110-…, plus crates/effect-package/src/wire.rs:1929
• Current code:

const fn effect_id(value: &'static str) -> effect_contract::EffectId {
    match effect_contract::EffectId::new(value) {
        Ok(value) => value,
        Err(_) => panic!("valid static effect identifier"),
    }
}
const fn port_id(value: &'static str) -> PortId {
    match PortId::new(value) {
        Ok(value) => value,
        Err(_) => panic!("valid static port identifier"),
    }
}
const fn parameter_id(value: u32) -> ParameterId {
    match ParameterId::new(value) {
        Some(value) => value,
        None => panic!("nonzero parameter identifier"),
    }
}

• Problem: nine copies, byte-identical except for one word of panic text ("nonzero parameter identifier" vs "nonzero static parameter identifier"). ~20 lines × 9 ≈ 180 lines that exist only
  because effect-contract exposes the fallible constructor and not the infallible one every caller
  actually wants. The pattern is the same one tools/bench-support was created to end
  (104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104 F4: "the second copy is the defect"), applied to crates/ instead of tools/.
• Proposed change: add the three const constructors to crates/effect-contract/src/lib.rs, next
  to EffectId::new (:63), PortId::new (:101) and ParameterId::new (:120):

impl EffectId {
    /// The identifier of a literal that is part of this build's frozen descriptor.
    ///
    /// # Panics
    /// At compile time, if `value` is not a valid effect identifier.
    #[must_use]
    pub const fn from_static(value: &'static str) -> Self {
        match Self::new(value) { Ok(id) => id, Err(_) => panic!("valid static effect identifier") }
    }
}
// PortId::from_static, ParameterId::from_raw likewise

then delete the nine local copies and call the shared ones from the descriptor tables.

• Expected effect: ~180 lines deleted; one panic message per id kind instead of two variants; new
  effect crates stop copying the block.
• Rulings / constraints checked: control plane only, evaluated in const context at compile time;
  no render path and no rendered bit. Does not rename anything (PREAMBLE constraint 5).
• Verification gate: cargo test --workspace plus scripts/check-workspace-policy.sh; the
  frozen-descriptor tests in each crate (descriptor_metadata_and_exact_resource_rows_are_frozen,
  descriptor_exact_resources_caps_and_integer_mapping_are_frozen) prove the ids did not move.

---

FX-13: Six of eight bind_homogeneous_bank implementations hand-roll the shape check that PrepareEffectBankRequest::validate_shape documents as universal

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/soft-clip/src/lib.rs:883-890, crates/transient-shaper/src/lib.rs:816-823, crates/delay/src/lib.rs:597-604, crates/compressor/src/lib.rs:815-822, crates/gate-expander/src/lib.rs:1189-1196, crates/multiband-compressor/src/lib.rs:1779-1786 — against crates/effect-contract/src/lib.rs:900-908 and its two existing callers crates/parametric-eq/src/lib.rs:2100 and crates/true-peak-limiter/src/lib.rs:2717
• Current code:

// crates/effect-contract/src/lib.rs:894-908
    /// Every `bind_homogeneous_bank` implementation calls this **before** it inspects a member,
    /// so that a malformed request can never be hidden behind an absent capability.
    pub const fn validate_shape(self) -> Result<(), EffectPrepareError> {
        if !self.has_matching_backend_width() || self.requests.len() != self.width.lanes() as usize
        { return Err(EffectPrepareError { code: "effect.bank.requests" }); }
        Ok(())
    }
// crates/soft-clip/src/lib.rs:883-890 — one of six copies
        if !request.has_matching_backend_width()
            || request.requests.len() != request.width.lanes() as usize
        {
            return Err(EffectPrepareError {
                code: "effect.bank.requests",
            });
        }

• Problem: the shared method's own doc asserts "Every bind_homogeneous_bank implementation
  calls this" and six of eight do not — they inline the identical predicate and the identical error
  code. That is a documentation/code divergence in a contract crate, and it means the semantic the
  effect-contract MUTATIONS record pins for parametric-eq (crates/effect-contract/tests/MUTATIONS.md:23)
  is only actually enforced at two of eight sites. Any future refinement of the shape rule silently
  applies to two effects.
• Proposed change: replace the six inlined blocks with request.validate_shape()?; and delete the
  now-unused local imports. ~42 lines removed, one predicate.
• Expected effect: ~42 lines deleted; the contract crate's stated invariant becomes true; a single
  place to change bank-shape validation.
• Rulings / constraints checked: preparation path only, no render code. The error code and the
  predicate are byte-identical, so no observable behaviour moves.
• Verification gate: cargo test --workspace; each crate's bank test
  (bank_binding_validates_before_fallback_and_retains_exact_width_bytes in true-peak-limiter,
  bank_fallback_validates_every_member in delay, bank_binding_rejects_malformed_shapes_and_declines_a_foreign_width
  in parametric-eq) plus the effect-contract MUTATIONS row 3.

---

FX-14: soft-clip::width_is_native re-derives the backend→width law with raw cfg!, and diverges from it under miso_wasm_simd8

• Category: crate-boundary
• Class: N/A (non-render; but it silently changes which path renders)
• Severity: medium
• Location: crates/soft-clip/src/lib.rs:903-913, used at crates/soft-clip/src/lib.rs:938
• Current code:

const fn width_is_native(width: BankWidth) -> bool {
    match width {
        BankWidth::Four => cfg!(any(
            target_arch = "aarch64",
            all(target_arch = "wasm32", target_feature = "simd128")
        )),
        BankWidth::Eight => cfg!(any(target_arch = "x86", target_arch = "x86_64")),
    }
}

• Problem: crates/effect-contract/src/lib.rs:198-209 states that BankWidth::for_backend "is the
  workspace's single backend-to-width law (084 Audit: miso-engine-core (SIMD kernels, SPSC, plan lifetime) #84 phase A): every crate that needs the width of a
  Backend calls this rather than re-deriving a table of its own". This is a re-derived table, and it
  is already out of date: lane::Backend::current() (crates/lane/src/backend.rs:30-68) selects
  Simd8 on wasm32 + simd128 + cfg(miso_wasm_simd8) — the issue Wasm 8-lane banks (D4 revision): survey + paired W4/W8 measurement, then the backend switch #183 step-2 measurement build —
  where width_is_native(BankWidth::Eight) returns false. In that build the planner asks for an
  eight-lane bank, soft-clip answers Ok(None), and the whole effect silently falls back to eight
  scalar instances. The paired W4/W8 wasmtime record that miso_wasm_simd8 exists to produce would
  therefore compare a W4 bank against a W8 scalar fallback for this effect. soft-clip is the only
  crate under crates/*/src/lib.rs that names target_arch = "aarch64"; every sibling uses
  Backend::current() (e.g. crates/compressor/src/lib.rs:855, :863).
• Proposed change: delete width_is_native and use the one law, in crates/soft-clip/src/lib.rs:

    if !same_program || !request.width.matches_backend(lane::Backend::current()) {
        return Ok(None);
    }

(BankWidth::matches_backend is crates/effect-contract/src/lib.rs:213-220.) Also add a test that
pins the two agree, so a third copy cannot reappear.

• Expected effect: 11 lines deleted; the miso_wasm_simd8 measurement build actually banks the
  soft clipper; one backend→width table in the workspace instead of two. No rendered bit moves on any
  shipping configuration (x86-64, aarch64 and default wasm all agree today).
• Rulings / constraints checked: AGENTS.md — "Native x86 is x86-64-v3 ... never dispatched at
  runtime"; this is a compile-time constant either way, so no runtime dispatch is introduced. 084 Audit: miso-engine-core (SIMD kernels, SPSC, plan lifetime) #84
  phase A named for_backend the single law and this is the outstanding violation of it.
• Verification gate: cargo test -p soft-clip --test contract and --test lane_identity; then
  build the wasm guest with RUSTFLAGS="--cfg miso_wasm_simd8" and confirm
  tools/wasm-gate-corpus reports a bound W8 bank rather than a scalar fallback for soft-clip.

---

FX-15: Eight copies of the same xorshift64* generator, one per corpus module — including one in effect-runtime, which every effect crate already depends on

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/effect-runtime/src/corpus.rs:57-73, crates/true-peak-limiter/src/corpus.rs:108-123, crates/soft-clip/src/corpus.rs:49-63, crates/transient-shaper/src/corpus.rs:106-120, crates/delay/src/corpus.rs:58-72, crates/compressor/src/corpus.rs:103-121, crates/parametric-eq/src/corpus.rs:89-104, crates/multiband-compressor/src/corpus.rs:55-70
• Current code:

struct Rng(u64);
impl Rng {
    fn next(&mut self) -> u64 {
        let mut x = self.0;
        x ^= x >> 12;
        x ^= x << 25;
        x ^= x >> 27;
        self.0 = x;
        x.wrapping_mul(0x2545_f491_4f6c_dd1d)
    }
}

• Problem: the eight copies differ only in the seed derivation and in whether next returns the
  full u64, the top 32 bits, or a narrowed f32 sample. The state-transition body — the three
  shift/xor steps and the multiplier — is byte-identical in all eight. These are the generators that
  produce every cross-target determinism corpus, so eight independent copies of the same frozen
  sequence law is exactly the class of duplication that lets one copy drift and a digest mismatch look
  like a numerics difference. effect-runtime already has one of the copies and is already a
  non-dev dependency of all eight crates.
• Proposed change: promote the generator in crates/effect-runtime/src/corpus.rs to a public type
  and have every corpus module derive its own seed and narrowing from it:

/// `xorshift64*`. Integer-only, so every target builds the same sequence.
#[derive(Clone, Copy, Debug)]
pub struct Xorshift64Star(u64);

impl Xorshift64Star {
    #[must_use] pub const fn new(seed: u64) -> Self { Self(seed | 1) }
    pub fn next_u64(&mut self) -> u64 { /* the frozen body above */ }
    #[must_use] pub fn next_u32(&mut self) -> u32 { (self.next_u64() >> 32) as u32 }
}

Seeds stay where they are (they differ per crate deliberately), and every existing pinned digest
must be unchanged — which is the gate.

• Expected effect: ~110 lines deleted across eight crates; one frozen sequence law.
• Rulings / constraints checked: corpus modules are pub mod corpus in src/ and are replayed by
  tools/wasm-gate-corpus, so the shared type must live in a non-dev dependency — effect-runtime
  already is one for all eight crates, so no new edge is added to the dependency graph.
• Verification gate: every crate's tests/determinism.rs must produce the identical pinned
  digests (D90_DIGESTS, D1_DIGESTS, G5_DIGESTS, …) with no repin: cargo test --workspace --test determinism,
  then tools/wasm-gates for the wasm leg.

---

FX-16: Seven near-identical tests/determinism.rs files (681 lines) doing digest-vs-pins at three widths

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/true-peak-limiter/tests/determinism.rs (78), crates/soft-clip/tests/determinism.rs (81), crates/delay/tests/determinism.rs (92), crates/gate-expander/tests/determinism.rs (85), crates/builtins/tests/determinism.rs (82), crates/parametric-eq/tests/determinism.rs (127), crates/effect-runtime/tests/determinism.rs (136)
• Current code:

// crates/soft-clip/tests/determinism.rs (structure common to all seven)
fn digest<L: Lane>(case: usize) -> ([u8; 32], Vec<u32>) {
    let mut words = vec![0_u32; POINTS];
    run_case::<L>(case, &mut words);
    let mut hasher = /* sha256 */;
    for word in &words { hasher.update(word.to_le_bytes()); }
    (hasher.finalize().into(), words)
}
fn render(digest: [u8; 32]) -> String { /* repin printer */ }

• Problem: each file re-implements: the SHA-256 fold over the corpus words, the W1/W4/W8 comparison
  against the crate's pins, the "same words at every width" assertion, and a MISO_ENGINE_REPIN_*
  environment-variable printer with its own hand-rolled hex formatting. 681 lines for one pattern.
  The workspace already has the answer next door: conformance::effect_conformance_test! is a macro
  each crate invokes in a nine-line tests/conformance.rs
  (crates/soft-clip/tests/conformance.rs:9).
• Proposed change: add a sibling macro in crates/conformance/src/, e.g.

// crates/conformance/src/corpus_gate.rs
#[macro_export]
macro_rules! corpus_determinism_test {
    ($corpus:path, $pins:path, $repin_env:literal) => { /* digest, three widths, repin printer */ };
}

and reduce each tests/determinism.rs to a doc comment plus one invocation, exactly as
tests/conformance.rs already is. Crates whose corpus has extra structure (parametric-eq and
effect-runtime are the two longest) can keep the extra assertions alongside the macro invocation.

• Expected effect: roughly 450 of 681 lines deleted; one repin printer and one digest fold instead
  of seven; a new effect crate's determinism gate becomes a one-liner.
• Rulings / constraints checked: test-only; the pins themselves are untouched, which is the whole
  gate. conformance is already a dev-dependency of these crates for effect_conformance_test!.
• Verification gate: cargo test --workspace --test determinism must produce byte-identical
  results with no pin edits; tools/wasm-gates unaffected (it replays corpus::run_case, not these
  files).

---

FX-17: Four hand-rolled counting GlobalAlloc harnesses under crates/, each with its own #![allow(unsafe_code)], while the workspace has one audited allocator

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/transient-shaper/tests/allocation.rs:1-105 (262 L total), crates/true-peak-limiter/tests/allocation.rs (255 L), crates/soft-clip/tests/allocation.rs (209 L), crates/multiband-compressor/tests/no_alloc_render.rs; against tools/bench-support/src/alloc.rs (194 L) and its policy note in tools/bench-support/src/lib.rs:1-12
• Current code:

// crates/transient-shaper/tests/allocation.rs:19-45 — and three more variants of the same thing
thread_local! {
    static ARMED: Cell<bool> = const { Cell::new(false) };
    static ALLOCATIONS: Cell<u64> = const { Cell::new(0) };
    static DEALLOCATIONS: Cell<u64> = const { Cell::new(0) };
}
struct CountingAllocator;
#[global_allocator]
static GLOBAL_ALLOCATOR: CountingAllocator = CountingAllocator;
unsafe impl GlobalAlloc for CountingAllocator { /* alloc, alloc_zeroed, dealloc, realloc */ }

The three effect-crate copies do not even agree on their state names — ARMED (transient-shaper),
ACTIVE (true-peak-limiter, multiband-compressor), ARMED + a single COUNT (soft-clip).

• Problem: ~950 lines of duplicated unsafe test scaffolding in four crates, four independent
  #![allow(unsafe_code)] under crates/ in a workspace where unsafe_code = "deny" and exactly one
  production exception is allowlisted. tools/bench-support/src/lib.rs:1-8 records the exact
  precedent — issue 104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104 found fourteen copies of an audited GlobalAlloc under tools/, collapsed
  them into one, and had scripts/check-bench-policy.sh enforce that "the second copy is the defect".
  The same audit never reached crates/*/tests/. Note that crates/conformance/Cargo.toml already
  takes bench-support as a dev-dependency, so the "no package under crates/ may depend on it"
  rule in that module's doc is about [dependencies], not [dev-dependencies] — the path is open.
  Issue Make the transient-shaper allocation gate render-thread-local #332 deliberately deferred this (Non-goals: "refactoring other allocation harnesses or
  adopting a shared harness in this slice"), so it is unfinished work, not a rejected candidate.
• Proposed change: add the Make the transient-shaper allocation gate render-thread-local #332 measurement mode to the shared allocator rather than adopting its
  current process-global counters, which are exactly what Make the transient-shaper allocation gate render-thread-local #332 diagnosed as racy under parallel
  libtest:

// tools/bench-support/src/alloc.rs — new, alongside Mode/counters
/// Thread-local armed measurement. Only the calling thread's allocations are counted;
/// every hook uses `try_with` so a teardown allocation never panics.
pub fn measure(body: impl FnOnce()) -> (u64, u64);

Then each of the four test files becomes #[global_allocator] static A: bench_support::alloc::AuditedAllocator = ..;
plus its own workload, and every #![allow(unsafe_code)] under crates/ disappears. Extend
scripts/check-realtime-policy.sh (or check-bench-policy.sh) to forbid a new GlobalAlloc impl
under crates/.

• Expected effect: ~700–800 lines deleted; four #![allow(unsafe_code)] removed from crates/;
  the thread-local fix Make the transient-shaper allocation gate render-thread-local #332 paid for applies to all four gates instead of one. The Make the transient-shaper allocation gate render-thread-local #332 discriminating
  controls (same-thread positive control, prestarted foreign thread) move into the shared crate once.
• Rulings / constraints checked: Make the transient-shaper allocation gate render-thread-local #332 gates 1–5 must be preserved verbatim for transient-shaper
  (const-initialised thread-local Cells, teardown-safe hooks, the exact 1 000 × 128 scalar-plus-bank
  workload, independent zero-allocation/zero-free assertions, and the
  std::hint::black_box(Vec::<u8>::with_capacity(1)); red mutation). This finding proposes moving the
  harness, never weakening it. Test-only; no render path.
• Verification gate: each crate's allocation binary run under explicit concurrency
  (cargo test -p transient-shaper --release --test allocation -- --test-threads 8, repeated), plus
  the recorded red mutation re-run in an isolated copy per Make the transient-shaper allocation gate render-thread-local #332 gate 6, plus
  scripts/check-realtime-policy.sh and scripts/check-workspace-policy.sh.

---

[tamashi095]

Audit report — Effects: true-peak limiter, soft-clip, transient shaper, delay, references (FX-*), part 2/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

FX-18: Ring-wrap arithmetic is written out three times across the delay, the limiter and the PDC kernel

• Category: dry
• Class: A (bit-identical where render-path)
• Severity: low
• Location: crates/delay/src/lib.rs:505-522 (DelayLane::copy_window), crates/lane/src/kernels.rs:527-544 (pdc_delay_block), crates/graph/src/runtime.rs:118-175 + :241-262 (CompensationDelay, TrackDelayLine), crates/true-peak-limiter/src/lib.rs:1042-1045 (wrapped) and crates/true-peak-limiter/src/lib.rs:1462-1516 (segment)
• Current code:

// crates/delay/src/lib.rs:505-522
    fn copy_window(&self, cursor: usize, d: usize, destination: &mut [f32]) {
        let r = self.ring.len();
        let mut start = cursor + r - d;
        if start >= r { start -= r; }
        let n = destination.len();
        let first = n.min(r - start);
        destination[..first].copy_from_slice(&self.ring[start..start + first]);
        destination[first..].copy_from_slice(&self.ring[..n - first]);
    }
// crates/lane/src/kernels.rs:527-544
pub fn pdc_delay_block(ring: &mut [f32], cursor: &mut usize, io: &mut [f32]) {
    let length = ring.len();
    let count = io.len();
    let first = core::cmp::min(count, length - *cursor);
    ring[*cursor..*cursor + first].swap_with_slice(&mut io[..first]);
    let rest = count - first;
    if rest > 0 { ring[..rest].swap_with_slice(&mut io[first..count]); }
    let advanced = *cursor + count;
    *cursor = if advanced >= length { advanced - length } else { advanced };
}

• Problem: three independent implementations of "split a run of n slots starting at cursor
  into at most two contiguous segments, then advance the cursor with one conditional subtract". The
  answer to the brief's cross-reference question is that the delay ring and the PDC delay lines are
  not the same data structure and should not share a kernel — PDC is a pure shift where the delay
  equals the ring length and the exchange is a swap_with_slice with no floating-point operation at
  all, whereas the delay crate must read at an arbitrary D < R while writing at cursor and feeds a
  feedback path. What is duplicated is only the segment/wrap arithmetic underneath, three times,
  each with its own correctness argument in prose.
• Proposed change: extract the arithmetic (not the data movement) into
  crates/lane/src/kernels.rs, next to pdc_delay_block:

/// The two contiguous runs a length-`n` window starting at `cursor` occupies in a `len`-slot ring.
/// `n <= len` and `cursor < len`; the second run is empty when the window does not wrap.
#[inline(always)]
pub const fn ring_runs(len: usize, cursor: usize, n: usize) -> (usize, usize) {
    let first = if n < len - cursor { n } else { len - cursor };
    (first, n - first)
}
/// `value - len` once `value` has passed the end; every caller holds `value < 2 * len`.
#[inline(always)]
pub const fn ring_wrap(value: usize, len: usize) -> usize {
    if value >= len { value - len } else { value }
}

pdc_delay_block, DelayLane::copy_window and the limiter's wrapped (:1042) then call the two
helpers. The limiter's segment (:1462) keeps its own seven-way min, which is genuinely
specific to it.

• Expected effect: three correctness arguments become one with one test; ~15 lines net. No
  rendered bit moves — the arithmetic is index arithmetic and the identity is already asserted by
  the_segment_walk_visits_the_slots_a_frame_at_a_time_walk_visits (crates/true-peak-limiter/src/lib.rs:4137)
  and a_delay_line_is_a_pure_shift_at_every_partitioning (crates/graph/src/runtime.rs:2871).
• Rulings / constraints checked: crates/lane is the correct home — it already owns
  pdc_delay_block and the halfband history helpers, and both new functions are const fn index
  arithmetic with no wide or intrinsic use. #90 F6 (no % on a render cursor) is preserved: both
  helpers are the conditional-subtract form, never a modulo.
• Verification gate: cargo test -p lane -p delay -p true-peak-limiter -p graph; specifically
  partition_invariance_over_1_7_64_128_512 (delay), the_segment_walk_visits_the_slots_a_frame_at_a_time_walk_visits
  (limiter, which checks against a % oracle) and a_delay_line_is_a_pure_shift_at_every_partitioning (graph).

---

FX-19: crates/conformance/src/effect.rs is 1 562 lines holding two unrelated things — a mock effect and the conformance harness

• Category: crate-boundary
• Class: N/A (non-render)
• Severity: low
• Location: crates/conformance/src/effect.rs:28-660 (the DualAccumulatorDelay mock effect: descriptor, ports, qualities, factory, bank, prepared instance, lane encode/decode) versus crates/conformance/src/effect.rs:661-1562 (ConformanceConfig, the probes, run_effect_conformance)
• Current code:

// crates/conformance/src/effect.rs:28-46 — a complete second effect implementation, in the harness file
const MOCK_ID: EffectId = match EffectId::new("conformance.delay") { /* .. */ };
const MAIN_IN: PortId = match PortId::new("main-in") { /* .. */ };
const PARAMETERS: [ParameterDescriptor; 1] = [ParameterDescriptor { /* .. */ }];
// ...
pub static DUAL_ACCUMULATOR_DELAY_DESCRIPTOR: EffectDescriptor = EffectDescriptor { /* .. */ };
pub struct DualAccumulatorDelayFactory { /* .. */ }

• Problem: the file's name says "effect", and it contains both the subject (a synthetic effect
  used as a fault-injection target) and the instrument (the harness that runs any
  NativeEffectFactory through the 011 conformance tiers). They share no code. The mock also carries
  the fourth copy of the EffectId::new-with-match pattern of FX-12 (:28-43) and its own
  has_matching_backend_width check (:217) that FX-13 covers. This is the giant-single-file /
  real-seam problem from the brief, at 1 562 lines.
  On the rest of the scope: crates/dsp-reference is clean — no dependencies at all, no fixture
  I/O, no JSON, no CLI, and its duplicated tables (REFERENCE_ANNEX2_FIR,
  reference_halfband_63) are deliberately independent oracles, which the effect crates' own tests
  assert bit-for-bit against.
• Proposed change: split along the seam, in crates/conformance/src/:
  • mock.rs — everything at :28-660, re-exported unchanged from lib.rs so
    tests/effect_contract.rs and tests/fixtures.rs do not move;
  • effect.rs — the harness only (:661-1562), which then reads as one thing.
    Apply FX-12 and FX-13 to the mock while it moves.
• Expected effect: two files of ~630 and ~900 lines instead of one of 1 562; no behaviour change,
  no public path change if lib.rs re-exports.
• Rulings / constraints checked: the crate's stated purpose is "Deterministic fixture, numerical
  comparison, and repeatability harnesses" (crates/conformance/src/lib.rs:1), which covers both
  halves — this is a file-seam finding, not a crate-scope one. crc32c and PcmFixture are not
  duplicated anywhere in the workspace and belong here.
• Verification gate: cargo test -p conformance and cargo test --workspace (every effect
  crate's tests/conformance.rs invokes conformance::effect_conformance_test!), plus
  scripts/check-conformance-boundaries.sh.

---

Summary table

id	category	class	severity	location	one-line
FX-1	perf	A	high	crates/true-peak-limiter/src/lib.rs:1890-1906, :1701-1717, :3086, :3197	The block-invariant stationary hoist is branched per frame inside the innermost loop; make it const STATIONARY: bool
FX-2	perf	A	medium	crates/true-peak-limiter/src/lib.rs:1603-1619	The 79 %-of-kernel detector loads/stores through open-ended slices, keeping ~8 bounds compares per lane-frame
FX-3	dsp-math	B (flag)	medium	crates/true-peak-limiter/src/lib.rs:1551, :1308	box_sum.div(hot.window) is a vdivps per lane-frame by a block-constant — the ruling's named class-B residual
FX-4	simd	A	medium	crates/transient-shaper/src/lib.rs:292,317-331; crates/soft-clip/src/kernel.rs:150-157; crates/true-peak-limiter/src/lib.rs:1528,1543,1545	Loop-invariant constants re-splatted per sample while each crate already has a prepared coefficient struct
FX-5	dry	A	medium	crates/true-peak-limiter/src/lib.rs:3030-3242 vs :1575-1963	The mono-collapse path is a hand-copied 213-line duplicate of the dual block bodies
FX-6	perf	A	medium	crates/soft-clip/src/kernel.rs:188-215	Soft-clip has no stationary split: 9 block-invariant lane-ops per channel-frame, and no settle to pay for the hoist
FX-7	perf	A	medium	crates/soft-clip/src/kernel.rs:194,204; crates/lane/src/kernels/halfband.rs:126-133	The dry history is a 64-row double-written ring where 32 rows and one store suffice
FX-8	perf	A	low	crates/lane/src/kernels/halfband.rs:182-197	halfband2x_decim_even compares a counter against a constant on every one of 30 taps
FX-9	perf	A	medium	crates/transient-shaper/src/lib.rs:333-335, :513-528	The identity mask's bypass/mix == 0 terms are block-invariant on the dominant tail loop
FX-10	realtime-safety	A	high	crates/delay/src/lib.rs:1266, :729-746	2 KB of stack tap windows zero-filled on the render thread every block; move into PreparedDelay
FX-11	perf	A	medium	crates/delay/src/lib.rs:1139-1152	tap_sample branches per sample on two chunk-invariant flags, twenty lines after three siblings were hand-unswitched
FX-12	dry	N/A	medium	8 effect crates + crates/effect-package/src/wire.rs:1929	Nine byte-identical effect_id/port_id/parameter_id const panic-wrappers; add them to effect-contract
FX-13	dry	N/A	medium	crates/soft-clip/src/lib.rs:883-890 + 5 more	Six bind_homogeneous_banks hand-roll the check PrepareEffectBankRequest::validate_shape documents as universal
FX-14	crate-boundary	N/A	medium	crates/soft-clip/src/lib.rs:903-913	width_is_native re-derives the backend→width law and disagrees with Backend::current() under miso_wasm_simd8
FX-15	dry	N/A	medium	8 corpus.rs modules incl. crates/effect-runtime/src/corpus.rs:57-73	Eight copies of the same frozen xorshift64* that drives every determinism corpus
FX-16	dry	N/A	medium	7 × crates/*/tests/determinism.rs (681 L)	One digest-vs-pins pattern written seven times; make it a macro next to effect_conformance_test!
FX-17	dry	N/A	medium	4 × crates/*/tests/allocation.rs (~950 L) vs tools/bench-support/src/alloc.rs	Four hand-rolled counting GlobalAllocs and four #![allow(unsafe_code)] under crates/; #332 deferred this
FX-18	dry	A	low	crates/delay/src/lib.rs:505-522; crates/lane/src/kernels.rs:527-544; crates/true-peak-limiter/src/lib.rs:1042	Ring segment/wrap arithmetic written three times; the delay ring and the PDC line are correctly not one kernel
FX-19	crate-boundary	N/A	low	crates/conformance/src/effect.rs:28-660 vs :661-1562	A mock effect and the conformance harness share one 1 562-line file

---

Things I checked that are fine

• The limiter's Annex-2 detector arithmetic is irreducible in class A. ANNEX2_FIR
  (crates/true-peak-limiter/src/lib.rs:316-341) is palindromic (c[t][p] == c[11-t][3-p]), so each
  of the 24 magnitudes appears twice — but the two occurrences multiply different history taps, and
  across successive samples a given coefficient meets a different sample every time. There is no
  shared partial product for the four phases to reuse, so 48 mul + 48 add per lane-sample is the
  floor of the frozen op order. Nothing to propose.
• The FIR coefficients are splatted once at preparation, into LimiterCoef::fir
  (crates/true-peak-limiter/src/lib.rs:416-429), and passed by reference to annex2_phases — not
  re-splatted per sample.
• The detector history is register-resident, not a shifted array. History<L>
  (:819-834) is twelve named L fields with a written-out twelve-assignment shift
  (:908-921), specifically to stop LLVM idiom-recognising a memory.copy on wasm; it is loaded once
  per block via History::load and stored once via History::store. Per-lane AoS does not occur:
  every ring is slot * width + lane, so a frame is one contiguous vector.
• Both residuals effect-floor-accounting.md Boundary 4 named have been taken. The van Herk
  result is now returned as an L (sliding_minimum_uniform at :1090-1129) rather than
  round-tripped through a [f32; MAXIMUM_WIDTH] scratch, and state.phase.fill(..) now runs once per
  block at :1957-1960, not once per sample. The next exit report can say both were taken.
• The limiter's silence fixed point is not a per-block full-state scan. is_at_silent_rest
  (:640-651) reads ~93 KB per stereo bank, but it runs only after a rendered block and only when
  quiet already holds; once silent_fixed_point is true the block is skipped without it, and
  quiet short-circuits on block_is_positive_zero(&left_io[..words]) for any block carrying signal.
  The scan is therefore bounded to the ~4 blocks of ring drain at each silence onset.
• The uniform-cohort admission mechanism is lanes_uniform (:1010-1013) — a whole-bank
  LaneShape bit-compare plus a van Herk phase bit-compare, taken once per block per channel at
  :1589, never per lane. It is reusable by the compressor only if the compressor's per-lane
  divergence is likewise a preparation parameter; the limiter's is (lookahead_ms → LaneShape),
  and the ruling's gap term (c) describes the compressor's problem as a per-lane detector gather,
  which is a data-layout problem rather than a shape-uniformity one. Cross-referenced to DYN as a
  candidate, not asserted as a fit.
• Cursors::advance uses % (:451-454) but only on the skipped-block path that renders
  nothing, with an in-place comment explaining why it is not the % 090 Audit: miso-engine-true-peak-limiter #90 F6 removed. Same for
  advance_rest_phase (:659-664). Both correct.
• No ADAA anywhere in the codebase. docs/research/f64-introduction.md:21 states it explicitly:
  "the current soft clipper is fixed 2x oversampling, not ADAA". There is no x == x1 divided-difference
  fallback to write as a select, and the research doc already rules that a future ADAA needs f64.
• There is exactly one halfband oversampler — crates/lane/src/kernels/halfband.rs, used only by
  soft-clip. The limiter's oversampling is the BS.1770 Annex-2 polyphase estimator (no
  reconstruction), and the multiband crossover is LR4, so there is no duplicated FIR to collapse.
• L::splat(tap) inside the halfband tap loops is correct as written. Each iteration splats a
  different constant, so it is a broadcast-from-.rodata of 120 bytes rather than a pre-splatted
  960-byte table; hoisting it into a [L; 30] would make the L1 footprint eight times larger for no
  instruction saving. Not FX-4.
• The envelope followers are already shared. ar_one_pole_step, peak_follow, rms_follow,
  hysteresis_step and attack_release_coefficient all live in crates/effect-runtime/src/envelope.rs;
  the transient shaper consumes ArCoef/ar_one_pole_step from there rather than carrying a copy.
  Same for gain_mix_step, flush, check_block and finish_block.
• The transient shaper's lane-generic block kernel is genuinely the dominant path.
  Shaper::run (crates/transient-shaper/src/lib.rs:488-530) splits the block on
  Ramps::prefix(), which is zero in steady state, and the tail loop is
  chunks_exact_mut(L::WIDTH) calling a fully #[inline(always)] lane-generic step/frame.
  There is no residual per-track scalar loop in the render path; Ramps::advance's per-lane packing
  runs only in the ramping prefix. The simd-wrapper-around-scalar-inner-loop.md failure shape is
  gone.
• The delay's fractional-delay question has a clean answer: there is none. delay_samples
  (crates/delay/src/lib.rs:713) rounds to an integer u32, and a retarget is a 128-update linear
  crossfade between two integer taps (tap_sample, :1139), not an interpolated read. There is no
  Lagrange/allpass/linear fractional read to audit, and no redundant interpolation ops.
• Nothing in the four render paths allocates. Every vec!/Box::new/collect in
  true-peak-limiter, soft-clip, transient-shaper and delay is in prepare/new/reset_to/
  #[cfg(test)]. No unwrap/expect on a data-dependent path, no format!, no % on a per-sample
  line.
• crates/dsp-reference has no scope creep. Zero dependencies (crates/dsp-reference/Cargo.toml),
  no fixture I/O, no JSON, no CLI, no manifest handling. Its f64 references share no code with the
  f32 kernels by design, and the duplicated coefficient tables are the independent oracles the
  effect crates assert against (descriptor_resources_and_independent_fir_design_are_frozen,
  bs1770_annex2_conformance_is_unchanged). Correct as it stands.
• crc32c and PcmFixture are not duplicated anywhere in the workspace; the only definition is
  crates/conformance/src/fixture.rs:185.

[tamashi095]

Audit report — SIMD foundation and math: lane / math (LANE-*), part 1/1

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

LANE — crates/lane and crates/math audit

Scope: crates/lane/{lib,kernels,kernels/builtins,kernels/halfband,wide_impl,scalar,bits,fpenv,softfma,backend}.rs
and crates/math/{lib,lane_math,fast_db,corpus}.rs.

All disassembly evidence below was produced on this host (aarch64-apple-darwin, rustc 1.97.1,
lto = "fat", codegen-units = 1, the workspace release profile) by building the unmodified
crates/lane / crates/math sources into a scratch cdylib with #[no_mangle] wrappers around the
production generic kernels at L = Simd4, and disassembling with objdump -d. Where a fix is claimed,
it was applied to a scratch copy of the crate and re-measured; both instruction counts are quoted.
The x86-64 (AVX2) leg was not re-measured here — that host is not available — so every x86 number
is a prediction and the verification gates say so.

---

LANE-1: Lane::splat of a compile-time constant emits a memset_pattern16 libc call per use on Apple targets

• Category: simd
• Class: A (bit-identical — a splat of a constant is the same constant either way)
• Severity: high
• Location: crates/lane/src/wide_impl.rs:144-148; consequences at crates/lane/src/lib.rs:120-123
  (flush), crates/lane/src/kernels.rs:274-283 (svf_step), crates/math/src/lane_math.rs:96-116,
  crates/math/src/fast_db.rs:163-205
• Current code:

// crates/lane/src/wide_impl.rs:144
#[inline(always)]
fn splat(x: f32) -> Self {
    <$simd>::splat(x)
}

wide 1.6.1 implements that as wide-1.6.1/src/simd.rs:326:
pub const fn splat(elem: $T) -> Self { unsafe { transmute::<[$T; $N], $Simd>([elem; $N]) } }

• Problem: the [elem; N] repeat expression with a constant elem is lowered by LLVM into a
  pattern-fill of a stack alloca, which on Darwin becomes a call to the libc symbol
  _memset_pattern16. The call is opaque, so SROA cannot promote the alloca and LICM cannot hoist the
  constant out of the enclosing frame loop. Measured, unmodified sources, L = Simd4:

  probe	instructions	bl _memset_pattern16
  lane::flush::<Simd4>	21 (incl. a stack frame)	1
  kernels::svf_block::<Simd4> frame loop	47 per frame	2 per frame
  kernels::one_pole_block::<Simd4> frame loop	18 per frame	1 per frame
  kernels::svf_block_ramped::<Simd4> frame loop	—	2 per frame
  math::exp2_lane::<Simd4>	141	10
  math::fast_db::fast_gain_from_db::<Simd4>	115	8

  A splat of a runtime f32 is fine (dup.4s, one instruction) — only the constant case is
  pathological, which is why every L::splat(CONST) in the workspace is affected and nothing else is.
  Beyond the instruction count this is a realtime-rule violation: an out-of-line, PLT/stub-dispatched
  libc call executes twice per frame per SVF section on the render thread, and the master plan's render
  contract forbids per-sample indirect calls. wasm32 is unaffected (verified: the same flush lowers to
  v128.const); Linux/x86 is unverified but memset_pattern16 is a Darwin-only symbol, so the blast
  radius is aarch64-apple-darwin (host-native on macOS) and aarch64-apple-ios (hosts/host-mobile,
  a shipping target).

• Proposed change: build the vector without a repeat expression. Pass a per-width token list into
  the macro so the array is written as an explicit aggregate:

// crates/lane/src/wide_impl.rs
macro_rules! impl_lane_for_wide {
    ($simd:ty, $uint:ty, $width:literal, $cascade_depth:literal, [$($slot:tt),+]) => {
        // ...
        #[inline(always)]
        fn splat(x: f32) -> Self {
            // NOT `[x; $width]`: a repeat expression of a constant becomes a `memset_pattern16`
            // call on Darwin, which blocks SROA and LICM. An explicit aggregate does not.
            <$simd>::new([$( { let _ = $slot; x } ),+])
        }

with impl_lane_for_wide!(f32x4, u32x4, 4, 2, [0, 1, 2, 3]); in simd4.rs:11 and the eight-slot form
in simd8.rs:12. The same treatment is needed for the five direct <$simd>::splat(..) /
<$uint>::splat(..) calls inside exp2_int (wide_impl.rs:333-340) and frexp
(wide_impl.rs:343-354), which bypass Lane::splat.

• Expected effect: measured with exactly this patch, same host, same profile: svf_block frame loop
  47 → 28 instructions and 0 calls (the FLUSH_EPS constant is then hoisted out of the loop by LICM);
  one_pole_block 18 → 12; exp2_lane 141 → 93; fast_gain_from_db 115 → 83. The whole
  svf_block::<Simd4> body drops from 75 to 43 instructions and from a 224-byte stack frame to none.
• Rulings / constraints checked: not a rejected candidate — no ruling touches splat. Bit identity
  is trivial (same array of the same value). It is not a fast-math, fusion, or reassociation change, and
  it changes no operation order. cross-bank-interleave.md's register-pressure argument is helped, not
  contradicted: the eliminated stack traffic is exactly the spill pressure that ruling measures against.
• Verification gate: cargo test -p lane --release and cargo test -p math --features lane --release
  (bit-identity gates G1/G2/M1/M2/M3/F1 must stay green — the change must move no fixture bit); then
  bash scripts/run-native-vectorization-report.sh plus an objdump of
  svf_block::<Simd8> on x86-64 and of svf_block::<Simd4> on an Apple aarch64 host, asserting zero
  bl/call instructions inside the kernel bodies. Add that "no call in a kernel body" assertion to
  tools/audit/vectorization-allowlist.tsv so it cannot regress (see LANE-9).

---

LANE-2: the mix kernels re-check three slice bounds per frame because only debug_assert relates their lengths

• Category: perf
• Class: A
• Severity: high
• Location: crates/lane/src/kernels.rs:472-491 (sum2_block), crates/lane/src/kernels.rs:497-513
  (sum_into_block), crates/lane/src/kernels.rs:563-590 (mix2x2_block)
• Current code:

pub fn sum2_block<L: Lane>(out: &mut [f32], a: &[f32], b: &[f32]) {
    debug_assert_eq!(out.len(), a.len());
    debug_assert_eq!(out.len(), b.len());
    let count = out.len();
    let vectored = count - count % L::WIDTH;
    let mut index = 0;
    while index < vectored {
        let left = L::load(&a[index..]);
        let right = L::load(&b[index..]);
        left.add(right).store(&mut out[index..]);
        index += L::WIDTH;
    }
    // ... scalar tail, same shape
}

• Problem: the loop bound comes from out.len(), but the loop indexes a and b, whose lengths are
  related to it only by debug_assert — a no-op in release. So the compiler must emit, per frame,
  a bounds check for &a[index..], one for the src[..WIDTH] inside Lane::load, and the same pair for
  b and for out. Measured on sum2_block::<Simd4>: the vector loop body is 16 instructions, of
  which 6 are compare/branch bounds checks, with four panic landing pads; the useful work is 4
  (ldr, ldr, fadd, str). The checks also block unrolling — the scalar tail of the same function
  is unrolled 4x by LLVM because its bounds are resolved, while the vector loop is not unrolled at all.
  mix2x2_block has the same defect (4 in-loop bounds branches). svf_cascade_interleaved
  (kernels.rs:196-198) already documents and applies the fix — "Truncating once, outside the loop, is
  what lets the frame indexing below carry no per-frame bounds branch" — it was simply never applied here.
• Proposed change: drive all three streams from chunks_exact/chunks_exact_mut iterators, which
  carry their length as a fact:

let count = out.len();
let vectored = count - count % L::WIDTH;
let (a, b, out) = (&a[..count], &b[..count], &mut out[..count]);
for ((out_frame, a_frame), b_frame) in out[..vectored]
    .chunks_exact_mut(L::WIDTH)
    .zip(a[..vectored].chunks_exact(L::WIDTH))
    .zip(b[..vectored].chunks_exact(L::WIDTH))
{
    L::load(a_frame).add(L::load(b_frame)).store(out_frame);
}
for ((o, x), y) in out[vectored..].iter_mut().zip(&a[vectored..]).zip(&b[vectored..]) {
    *o = *x + *y;
}

• Expected effect: measured with exactly this patch: the vector loop body goes 16 → 6 instructions
  (ldr, ldr, fadd, str, subs, b.ne), zero bounds branches, and the whole function shrinks from
  145 to 55 instructions. sum_into_block is the graph's per-edge mix reduction and mix2x2_block is on
  every routed track, so this is per-sample on nearly every plan edge.
• Rulings / constraints checked: no ruling covers it. Same adds in the same order, so class A; the
  scalar tail *x + *y is exactly <f32 as Lane>::add. Keeps the debug_asserts (master plan §4.3:
  validate once at prepare, debug_assert only on the render path).
• Verification gate: cargo test -p lane --release (G2 kernel identity, P1 partition invariance);
  cargo test -p graph --release; objdump sum2_block::<Simd8> in the release audit binary and assert
  no ja/jb bounds branch and no panic landing pad inside the loop.

---

LANE-3: on AArch64 the D8 max/min fold into fmaxnm/fminnm in release builds — gate G1 is red today and CI cannot see it

• Category: dsp-math / realtime-safety
• Class: A to fix (the current behaviour is the bug: it moves bits away from the pinned oracle)
• Severity: high
• Location: crates/lane/src/wide_impl.rs:278-330 (the #[cfg(not(x86|wasm-simd128))] arms),
  crates/lane/src/lib.rs:292-302 (the trait default), crates/lane/src/wide_impl.rs:83-88 (the claim
  under test), .github/workflows/ci.yml:157 (the only place -p lane is tested)
• Current code:

// crates/lane/src/wide_impl.rs:298 — the AArch64 arm of `max`
// NEON has no instruction with this rule, and `wide`'s scalar-array fallback
// answers `a` on a tie where D8 answers `b`. Both keep the portable form.
#[cfg(not(any(
    target_arch = "x86",
    target_arch = "x86_64",
    all(target_arch = "wasm32", target_feature = "simd128")
)))]
{
    $crate::Lane::select($crate::Lane::gt(self, b), self, b)
}

• Problem: LLVM's AArch64 backend folds select(fcmp ogt a, b, a, b) — including through
  vbslq_f32 and through wide::bitselect's explicit bit blend — into fmaxnm/fminnm, which is
  precisely the vmaxnmq_f32 lowering the module documentation rejects at wide_impl.rs:83-88 and marks
  ✗ in its own truth table at wide_impl.rs:93-103. Measured on unmodified sources, release, aarch64:

  a	b	scalar oracle max	Simd4/Simd8 max
  +0.0	-0.0	0x80000000	0x00000000 ✗
  1.0	0xffc00001	0xffc00001	0x3f800000 ✗
  0x7fc00000	0xffc00001	0xffc00001	0x7fc00000 ✗

  and the mirror rows for min. The engine's own gate catches it through exp2_int, whose clamp is a
  max then a min: cargo test -p lane --release --test g1_op_identity FAILS on this host today
  (g1_random_vectors_are_lane_identical: "exp2_int differs from the scalar oracle at Simd4 in 7659 of
  8000000 lanes", e.g. a=0xff90882d oracle=0x7f000000 actual=0x00800000). For a signalling NaN the
  scalar side folds too (fmaxnm(sNaN, -126) raises invalid and returns a quiet NaN, then
  fminnm(NaN, 127) returns 127, so exp2_int(sNaN) is 2^127 instead of the documented 2^-126).
  The same test passes in a debug build and CI runs cargo test --release -p lane on
  ubuntu-24.04 only — no workflow ever executes anything on aarch64 (ci.yml:200 only
  rustup target adds aarch64-apple-ios/aarch64-linux-android for cross-builds). So the D5
  cross-target bit-identity claim is currently false on the two ARM shipping targets and nothing reports it.

• Proposed change: two parts, both in crates/lane.

  1. Make the AArch64 lowering unfoldable. Replacing Lane::select with wide::f32x4::bitselect was
     tried here and did not work (measured — still folds). The remaining class-A options, in order of
     preference: (a) do the blend in the integer domain — f32x4::from_bits((a.to_bits() & m.to_bits()) | (b.to_bits() & !m.to_bits())) using u32x4 ops, so no FP select survives for the backend to
     match; (b) if (a) still folds, an asm!("", options(nostack, preserves_flags)) scheduling barrier
     between the compare and the blend, using the same mechanism and the same allowlist slot as
     fpenv::scheduling_barrier (crates/lane/src/fpenv.rs:314-322) — this costs no instructions;
     (c) accept fmaxnm as the AArch64 lowering and re-ratify D8 for NaN/signed-zero, which is a
     class B owner ruling, not an optimisation.
  2. Add an aarch64 execution leg to CI (macos-14 runner, or a qemu-aarch64 step) running at minimum
     cargo test --release -p lane -p math --features lane. Without it, any fix is unenforced.

• Expected effect: restores the pinned cross-target contract on aarch64. Instruction count is
  unchanged or +0 (option b) / +1 per max (option a, if the integer blend does not fold back).

• Rulings / constraints checked: wide_impl.rs:66-117 is the standing analysis and it already
  states the correct rule; this finding is that the code does not achieve it. unfused-multiply-add-audit.md
  is untouched. Not a rejected candidate: no ruling has looked at aarch64 codegen.

• Verification gate: cargo test -p lane --release --test g1_op_identity on an aarch64 host must go
  from FAIL to PASS; llvm-objdump of <f32x4 as Lane>::max must contain no fmaxnm/fminnm;
  cargo test --release -p lane must stay green on x86-64 (the fast_max arms must not change).

---

LANE-4: exp2_int re-clamps an argument both of its callers have already clamped

• Category: dsp-math
• Class: A
• Severity: medium
• Location: crates/lane/src/wide_impl.rs:332-340, crates/lane/src/scalar.rs:169-174,
  callers crates/math/src/fast_db.rs:164-181 and crates/math/src/lane_math.rs:96-116
• Current code:

// crates/lane/src/wide_impl.rs:333
fn exp2_int(n: Self) -> Self {
    let n = $crate::Lane::min(
        $crate::Lane::max(n, <$simd>::splat($crate::bits::EXP2_INT_MIN)),
        <$simd>::splat($crate::bits::EXP2_INT_MAX),
    );
    let biased = n + <$simd>::splat($crate::bits::EXP2_INT_MAGIC);
    <$simd>::from_bits(biased.to_bits() << $crate::bits::MANTISSA_BITS)
}
// crates/math/src/fast_db.rs:165 — the caller, immediately before
let x = x.max(L::splat(-126.0)).min(L::splat(127.0));
let xi = x.floor();
// ... p.mul(L::exp2_int(xi))

• Problem: both production callers clamp to exactly [-126, 127] with the same two constants before
  taking floor, so xi is provably in range (NaN included — the outer max already swallows it to
  -126) and exp2_int's own clamp can never fire. effect-floor-accounting.md:157 prices exp2_int
  at 6 lane-ops of the compressor's 94-op floor, 4 of which are this dead clamp — 4.3 % of the whole
  compressor floor, paid twice per channel-frame. exp2_int has exactly three call sites in the
  workspace (grep exp2_int): these two and tests/g1_op_identity.rs.
• Proposed change: add one Lane method next to exp2_int, in crates/lane/src/lib.rs:

/// `2^n` for an integer-valued `n` **already** in `[-126, 127]`.
/// The caller owns the clamp; `debug_assert` only, no render-path branch.
fn exp2_int_in_range(n: Self) -> Self;   // the body of `exp2_int` minus its two clamp lines

implement it in scalar.rs and in the wide_impl macro (exp2_int then becomes
exp2_int_in_range(min(max(n, MIN), MAX)), one body, no duplication), and call it from
fast_db::fast_exp2 and lane_math::exp2_lane. Keep exp2_int's clamp for the G1 gate and any future
unclamped caller.

• Expected effect: measured (applied on top of LANE-1's fix, aarch64/Simd4):
  fast_gain_from_db::<Simd4> 83 → 62 instructions, exp2_lane::<Simd4> 93 → 72. On x86-64 the
  saving is smaller — max/min are single vmaxps/vminps there — predicted ~4 instructions per
  conversion, i.e. ~8 per compressor channel-frame. It also lowers the documented floor from 94 to 90
  lane-ops, which is an owner-visible re-count (effect-floor-accounting.md:108-117 already records that
  one such recount is owed).
• Rulings / constraints checked: fast-db-tier-boundaries.md freezes the polynomial and the
  operation order of the conversions; this removes neither — it deletes a clamp whose output is provably
  its input. Not the rejected "reciprocal instead of divide" or any reassociation. f1_fast_db_bounds.rs
  sweeps the whole domain exhaustively and must stay bit-identical, which is the proof.
• Verification gate: cargo test -p math --features lane --release — in particular
  --test f1_fast_db_bounds and --test m1_exhaustive (exhaustive over all 2^32 f32), plus
  --test m2_lane_identity and --test m3_determinism; every digest must be unchanged.

---

LANE-5: ramp_block evaluates a per-frame select of a loop-invariant predicate

• Category: perf
• Class: A
• Severity: medium
• Location: crates/lane/src/kernels.rs:450-465
• Current code:

pub fn ramp_block<L: Lane>(io: &mut [f32], frames: usize, seg: &RampSegment<L>) -> L {
    debug_assert_eq!(io.len(), frames * L::WIDTH);
    let mut g = seg.start;
    for (index, frame) in io.chunks_exact_mut(L::WIDTH).enumerate() {
        let gain = if index < seg.ramp_frames { g } else { seg.target };
        let x = L::load(frame);
        x.mul(gain).store(frame);
        g = g.add(seg.step);
    }
    g
}

• Problem: index < seg.ramp_frames is monotone in index, so the loop is two straight-line runs;
  the compiler instead materialises the scalar index into a vector every frame. Measured
  (ramp_block::<Simd4>, unmodified): the loop body is 13 instructions, of which fmov d4, x10,
  cmhi.2d, dup.2d, bsl.16b plus the index bookkeeping are 7 — the useful work is
  ldr/fmul/str/fadd = 4.
• Proposed change: split the loop once, outside it, in the same kernel:

let ramping = seg.ramp_frames.min(frames);
let (head, tail) = io.split_at_mut(ramping * L::WIDTH);
for frame in head.chunks_exact_mut(L::WIDTH) {
    L::load(frame).mul(g).store(frame);
    g = g.add(seg.step);
}
for frame in tail.chunks_exact_mut(L::WIDTH) {
    L::load(frame).mul(seg.target).store(frame);
    g = g.add(seg.step);   // kept: the returned `g` is what makes the kernel partition-invariant (P1)
}

• Expected effect: ~13 → ~6-7 instructions per frame on the settled tail, which is the common case
  (a ramp is at most 64 frames of a 128-frame quantum, and most blocks are entirely settled). No change
  to the returned g, which gate P1 pins.
• Rulings / constraints checked: stationary-smoother-hoist-boundary.md rejects the stationary
  hoist — detecting a no-op smoother and skipping ramp arithmetic plus re-preparing — and its
  Boundary 2 shows the arithmetic-skip half alone regressed because settle wrote more lane words than
  start_ramp. This finding writes no words and detects nothing: it is a loop split on a predicate that
  is already a parameter, and g still advances every frame, so none of that ruling's costs apply.
• Verification gate: cargo test -p lane --release --test p1_partition --test g2_kernel_identity;
  cargo test -p builtins --release; the ramp fixtures in crates/builtins/tests/.

---

LANE-6: svf_block_ramped recomputes -c1 and re-tests the ramp predicate on every frame, including all-settled blocks

• Category: perf
• Class: A
• Severity: medium
• Location: crates/lane/src/kernels.rs:295-322
• Current code:

for (index, frame) in io.chunks_exact_mut(L::WIDTH).enumerate() {
    let nc1 = c.c1.neg();
    let v0 = L::load(frame);
    let (v1, v2) = svf_step(v0, nc1, c.a2, c.a3, &mut state);
    let y = c.m2.fma(v2, c.m1.fma(v1, c.m0.mul(v0)));
    y.store(frame);
    if index < ramp_frames {
        c.c1 = c.c1.add(step.c1);
        // ... five more
    }
}

• Problem: after frame ramp_frames the coefficients are frozen, yet nc1 = c.c1.neg() is recomputed
  per frame (a sign-bit XOR plus a reload of c.c1 through the &mut reference, which cannot be hoisted
  because the same reference is written in the loop) and the index < ramp_frames compare is executed per
  frame. svf_block (kernels.rs:132-143) hoists exactly this neg and documents why
  (kernels.rs:237-239). The frame body also carries the LANE-1 pathology (2 memset_pattern16 calls per
  frame, measured).
• Proposed change: split at ramping = ramp_frames.min(frames): run the existing ramped body over the
  first ramping frames, then run svf_block's exact body (with nc1 hoisted once) over the rest, from
  the same state. Bit-identical by construction — the second loop is literally svf_block on the tail,
  and svf_block_ramped with ramp_frames = 0 is already gated as bit-identical to svf_block (G2).
• Expected effect: removes 1 neg + 1 compare + the coefficient reload per settled frame; for a
  64-frame ramp inside a 128-frame quantum that is half the block. Combined with LANE-1 the settled tail
  becomes exactly svf_block's 28-instruction loop.
• Rulings / constraints checked: as LANE-5 — this is not the rejected stationary hoist; no detection,
  no re-preparation, no extra lane words written. d7-check-block-fusion.md warns against threading new
  state through svf_block/svf_block_ramped; this threads nothing and adds no accumulator.
• Verification gate: cargo test -p lane --release --test g2_kernel_identity (which pins
  svf_block_ramped(ramp_frames = 0) == svf_block), cargo test -p parametric-eq --release (its digests
  are the ramped kernel's pinned bits).

---

LANE-7: the builtin input chain exists as six near-identical copies of one frame body

• Category: dry
• Class: A
• Severity: medium
• Location: crates/lane/src/kernels/builtins.rs:408-472 (input_chain_block), :810-848
  (identity_chain_block), :850-922 (mixed_chain_block), :947-996 (input_chain_block_mono),
  :998-1026 (identity_chain_block_mono), :1027-1096 (mixed_chain_block_mono)
• Current code:

// the prologue is character-for-character identical in all six:
let limit = L::splat(NONFINITE_LIMIT);
let one = L::splat(1.0);
let zero = L::zero();
let mut count = [zero; 2];
let mut nonfinite = [no_lanes::<L>(); 2];
// ... and the frame body:
let x = L::load(frame);
let bad = L::mask_not(x.abs().lt(limit));
count[channel] = count[channel].add(one.andnot(L::mask_not(bad)));
let mut v = x.andnot(bad).mul(c.trim[channel]);

• Problem: ~330 lines are six spellings of one loop that differ only in (i) how many planes are walked
  (1 or 2) and (ii) which of the four sections are elided. The file's own comment at
  builtins.rs:936-945 concedes this ("each is the dual body's channel-0 arm, character for
  character"). Every future change to the frozen order — a new sanitise form, a new boundary scan — has to
  be made six times identically, and the crate's stated purpose (wide_impl.rs:1-5) is that "a second
  copy of an operation body is exactly the defect this crate exists to remove".
• Proposed change: one #[inline(always)] body in crates/lane/src/kernels/builtins.rs, const-generic
  over the plane count and over the elision mask, dispatched once per block by the existing three-way
  match at builtins.rs:804-808:

#[inline(always)]
fn chain_frames<L: Lane, const PLANES: usize, const ELIDED: u8>(
    planes: [&mut [f32]; PLANES],
    frames: usize,
    c: &InputChainCoef<L>,
    s: &mut InputChainState<L>,
) -> InputChainReport<L>
// ELIDED bit (channel * 2 + section); every `if` on it is const-folded per instantiation,
// so each of the three shipped shapes compiles to exactly the hand-written copy it replaces.

input_chain_block becomes chain_frames::<L, 2, 0b0000>, identity_chain_block
chain_frames::<L, 2, 0b1111>, the mono forms the PLANES = 1 instantiations, and mixed_chain_block
keeps its runtime plan arm.

• Expected effect: ~330 lines → ~90; three shipped instantiations emit the same instructions they do
  today (const-folded branches), so no bit moves and no code-size regression.
• Rulings / constraints checked: none applies. The class-A argument at builtins.rs:776-793 (identity
  runs collapse to one add(+0.0) at the run's position) is preserved verbatim by keeping the same
  per-instantiation constants.
• Verification gate: cargo test -p lane --release --test input_chain_elision --test sanitise_counter;
  cargo test -p builtins --release (its pinned digests are the proof no bit moved).

---

LANE-8: 20*log10(2) and its inverse are declared four times each, in three different spellings

• Category: dry / crate-boundary
• Class: N/A (compile-time constants; all four spellings currently agree)
• Severity: medium
• Location: crates/math/src/fast_db.rs:123 and :128; crates/effect-runtime/src/dynamics.rs:35
  and :38; crates/gate-expander/src/kernel.rs:45 and :50;
  crates/transient-shaper/src/lib.rs:207 and :210
• Current code:

// crates/math/src/fast_db.rs:123
const DB_PER_LOG2: f32 = (20.0_f64 * core::f64::consts::LOG10_2) as f32;
// crates/effect-runtime/src/dynamics.rs:35   — identical text, second declaration
const DB_PER_LOG2: f32 = (20.0_f64 * core::f64::consts::LOG10_2) as f32;
// crates/gate-expander/src/kernel.rs:45      — a decimal literal
pub const DB_PER_OCTAVE: f32 = 6.020_6;
// crates/transient-shaper/src/lib.rs:207     — a bit literal
const DB_PER_OCTAVE: f32 = f32::from_bits(0x40c0_a8c1);

• Problem: four declarations of one pinned coefficient in three unrelated encodings, with nothing
  mechanical keeping them equal — only a doc comment (fast_db.rs:121-122: "Bit-identical to
  effect_runtime::dynamics::DB_PER_LOG2 and to the gate and transient-shaper spellings of the same
  number"). A future edit to any one of them silently splits the dB law across effects, and the failure
  would surface as a fixture digest change in an unrelated crate. crates/math is the workspace's stated
  single home for this arithmetic (math/src/lib.rs:226-251 already exports db_to_gain/gain_to_db).
• Proposed change: export from crates/math/src/lib.rs (unconditional, no lane feature — they are
  plain f32 constants):

/// `20 * log10(2)`, rounded once from `f64`: `0x40c0_a8c1`.
pub const DB_PER_LOG2_F32: f32 = (20.0_f64 * core::f64::consts::LOG10_2) as f32;
/// `log2(10) / 20`, rounded once from `f64`: `0x3e2a_152d`.
pub const LOG2_PER_DB_F32: f32 = (core::f64::consts::LOG2_10 / 20.0) as f32;

and have fast_db, effect_runtime::dynamics, gate_expander::kernel and transient_shaper name
those. Keep the independent restatement in crates/math/tests/f1_fast_db_bounds.rs:67-68 — that one is
a deliberate oracle, not a duplicate.

• Expected effect: 8 declarations → 2; the bit-identity claim becomes a compiler fact instead of a
  comment. No rendered bit moves (verified by the digests below).
• Rulings / constraints checked: fast-db-tier-boundaries.md Boundary 3 forbids pointing
  effect_runtime::dynamics at the fast tier; sharing a constant is not that — the two tiers keep
  their own polynomials and their own seal.
• Verification gate: cargo test --release -p math --features lane -p effect-runtime -p gate-expander -p transient-shaper; all D1/corpus digests must be byte-identical.

---

LANE-9: the native vectorization allowlist still requires fused multiply-add, which issue #163 phase 2 deleted

• Category: dead-code
• Class: N/A (non-render)
• Severity: medium
• Location: tools/audit/vectorization-allowlist.tsv:4 and :7;
  scripts/run-native-vectorization-report.sh; .github/workflows/nightly.yml:55-78
• Current code:

x86_64-avx2	recursive-svf	probe_svf_simd8	vfmadd|vfnmadd,%ymm	mulss,addss,subss,divss
aarch64-neon	recursive-svf	probe_svf_simd4	fmla|fmls,.4s	fmul s,fadd s,fsub s,fdiv s,fmla s

• Problem: the recursive-svf rows demand that svf_block's disassembly contain a fused
  multiply-add. Lane::fma has been unfused (a*b)+c on every backend since Floor pass: resource usage to the theoretical floor (plan, phases 0-5) #163 phase 2
  (lib.rs:215-236), and scripts/check-unfused-seal.sh fails the build if a fused intrinsic appears in
  source — so the required group can never match. Confirmed directly: the disassembly of
  svf_block::<Simd4> measured for this audit contains only fmul/fadd/fsub and zero fmla.
  The job runs with continue-on-error: true, so it has been reporting red into an artifact nobody reads.
  The same report is also blind to LANE-1: a bl _memset_pattern16 in the middle of a kernel is neither a
  required group nor a forbidden scalar family.
• Proposed change: update both recursive-svf rows to the post-Floor pass: resource usage to the theoretical floor (plan, phases 0-5) #163 truth — required groups
  vmulps,%ymm + vaddps,%ymm (x86) and fmul,.4s + fadd,.4s (aarch64) — and add vfmadd|vfnmadd
  / fmla|fmls to forbidden_scalar_families for those rows, which turns the report into a second
  mechanical guard on the unfused seal. Add a forbidden_calls column asserting no bl/call inside a
  kernel body, which is what would have caught LANE-1.
• Expected effect: a nightly report that means something; two stale claims removed; the unfused
  contract gains a codegen-level check it does not have today (check-unfused-seal.sh only scans source).
• Rulings / constraints checked: none; this is evidence machinery, not a render path.
• Verification gate: bash scripts/run-native-vectorization-report.sh must exit 0 and report
  "status":"pass", and bash scripts/test-native-vectorization-report.sh (its red-mutation suite) must
  still fail every mutation.

---

LANE-10: math::corpus — 476 lines and 1 KB of digests of test-only data — is compiled into every production consumer

• Category: crate-boundary / dead-code
• Class: N/A (non-render)
• Severity: low
• Location: crates/math/src/lib.rs:38 (pub mod corpus;), crates/math/src/corpus.rs:1-476,
  crates/math/Cargo.toml:12-16
• Current code:

// crates/math/src/lib.rs:36
pub mod corpus;

#[cfg(feature = "lane")]
mod lane_math;

• Problem: corpus is a gate-M3 fixture generator — a 1,000,000-point runner, 32 case names and 32
  pinned SHA-256 digests — with exactly two consumers, both tests: crates/math/tests/m3_determinism.rs
  and tools/wasm-gates/tests/g5_native_corpus.rs. It is nevertheless unconditional, while the two
  genuinely optional modules next to it (lane_math, fast_db) are correctly behind the lane feature.
  Every effect crate that depends on math therefore compiles it, and it is the only place in math
  carrying hard assert! (corpus.rs:230-231).
• Proposed change: add a default-off corpus feature in crates/math/Cargo.toml, gate the module
  with #[cfg(feature = "corpus")], add required-features = ["corpus"] to the m3_determinism test
  and math = { workspace = true, features = ["corpus"] } to tools/wasm-gates's dev-dependencies.
• Expected effect: ~476 lines and 32 × 32 bytes of digests out of every production build of math;
  the crate's public surface stops advertising a fixture generator.
• Rulings / constraints checked: none. The M3 gate and the wasm G5 replay keep working unchanged.
• Verification gate: cargo test -p math --features lane,corpus --release; cargo test -p wasm-gates;
  cargo build -p compressor --release must no longer compile math::corpus (check with
  cargo build -p compressor --release --timings or cargo tree -e features).

---

LANE-11: the same xorshift64* generator is copy-pasted into twenty test/corpus modules

• Category: dry
• Class: N/A (non-render)
• Severity: low
• Location: crates/math/src/corpus.rs:70-90, crates/lane/tests/support/mod.rs:33-86,
  crates/lane/tests/halfband.rs, crates/compressor/src/corpus.rs,
  crates/parametric-eq/src/corpus.rs, crates/multiband-compressor/src/corpus.rs,
  crates/true-peak-limiter/src/corpus.rs, crates/transient-shaper/src/corpus.rs,
  crates/builtins/src/corpus.rs, crates/graph/src/program.rs, crates/soft-clip/tests/polyphase_identity.rs,
  and nine more (grep -rl 0x9e37_79b9_7f4a_7c15 crates returns 20 files)
• Current code:

// crates/math/src/corpus.rs:73
struct Rng(u64);
impl Rng {
    fn new(case: usize) -> Self {
        Self(0x9e37_79b9_7f4a_7c15 ^ ((case as u64).wrapping_mul(0x0002_5a2f_1c3d_0b41) | 1))
    }

• Problem: twenty independent copies of one integer-only deterministic generator, each with its own
  seeding convention. The property every corpus depends on — that the sequence is identical on every
  target — is asserted twenty times and implemented twenty times.
• Proposed change: one pub struct DeterministicRng in crates/math (it is already the crate that
  owns "integer arithmetic and exact conversions only, so every target builds an identical input
  sequence", corpus.rs:3-6), behind the same corpus feature as LANE-10, and have the corpus modules
  and test-support modules use it. Where a crate's digests are pinned to its current seeding, keep that
  crate's seeding expression and only share the step function, so no digest moves.
• Expected effect: ~400 duplicated lines deleted; one place to prove target-independence.
• Rulings / constraints checked: none. Any change that moved a corpus sequence would move pinned
  digests, so the migration must be digest-neutral crate by crate.
• Verification gate: cargo test --release --workspace — every corpus digest test must be unchanged.

---

LANE-12: the soft clipper applies the D7 flush to two feed-forward FIR history words, which the law does not cover

• Category: dsp-math
• Class: B — flag only (removing a flush changes rendered bits whenever it fires)
• Severity: low
• Location: crates/lane/src/lib.rs:114-123 (the law), crates/soft-clip/src/kernel.rs:195 and :199
• Current code:

// crates/soft-clip/src/kernel.rs:195
history_push::<L>(&mut h.x, pos, flush(drive.add(drive).mul(xin)));
let base = pos + HALFBAND63_BASE;
let u = halfband2x_interp_even::<L>(&h.x, base);
history_push::<L>(&mut h.e, pos, flush(cubic(u)));

• Problem: D7 as stated in lane/src/lib.rs:98-123 is a law about recursive state words
  ("applied to each recursive state word once per sample"). h.x and h.e are FIR history rows: nothing
  in the soft clipper feeds them back, so a denormal there decays out of the 63-tap window and cannot
  grow. This is the only place in the workspace where flush is applied to a non-recursive value
  (audited: svf_step ×2, one_pole_block ×1, envelope.rs:158, compressor/kernel.rs:1031,
  gate-expander/kernel.rs:393, multiband-compressor/lib.rs:923,
  true-peak-limiter/lib.rs:1312,1555, delay/lib.rs:1078-1079,1116-1117,1164 are all recursive). Cost is
  2 × 3 = 6 lane-ops per lane-sample in an oversampled effect.
• Proposed change: none recommended. This is class B: the crate documents the choice at
  soft-clip/src/kernel.rs:36-44 and the rationale is sound — CanonicalFpEnv pins FTZ/DAZ clear
  (wide_impl.rs:119-131), so a denormal entering a 63-tap convolution is a real microcode stall, not a
  theoretical one. Recorded here only so that the D7 law's wording in lane/src/lib.rs:114-119 can be
  amended to say "recursive state words, and by explicit ruling the soft clipper's two oversampling
  histories", instead of leaving the one exception undocumented at the law's own site.
• Expected effect: documentation only unless an owner rules otherwise; the removal would be
  6 lane-ops per lane-sample and would move soft-clip's pinned digests.
• Rulings / constraints checked: d7-check-block-fusion.md rules on the boundary scan, not on the
  flush law, and explicitly says "removing or weakening the D7 check itself... is not on the table".
• Verification gate: none required for the documentation change; any behavioural change would need
  cargo test -p soft-clip --release re-pinned under the master plan §8 fixture procedure.

---

LANE-13: floor-accounting gap term (a) is already closed in code but the ruling's tables still price it as open

• Category: architecture
• Class: N/A (accounting)
• Severity: low
• Location: crates/lane/src/wide_impl.rs:39-64 and :263-271;
  docs/rulings/effect-floor-accounting.md:128-129,134-136,183-186; tools/bench/src/floor.rs;
  scripts/console-benchmark-record-lib.jq
• Current code:

// crates/lane/src/wide_impl.rs:264
fn select(m: Self::Mask, a: Self, b: Self) -> Self {
    m.select(a, b)   // wide 1.6.1 -> blend_varying_m256 == vblendvps on avx
}

• Problem: the brief's gap term (a) — "bitselect lowering to 3 bitwise ops instead of vblendvps" —
  no longer exists. Verified in wide-1.6.1/src/f32x8_.rs:148-158: select is
  blend_varying_m256(if_false, if_true, mask) under avx, i.e. one vblendvps, and
  f32x4_.rs:236-248 is blend_varying_m128 / v128_bitselect / vbslq_f32. The semantics argument is
  sound (blendv reads only the sign bit; every mask the trait can build is all-ones or all-zeros, and
  the four mask constructors in kernels::builtins are themselves ordered compares). But
  effect-floor-accounting.md:134-136 still says "On the emitted code it is three — LLVM builds
  (a & m) | (b & andnot m)" and the compressor gap table at :183-186 still attributes +24
  instructions per channel-frame to it. An implementer reading the ruling will re-do work that is done.
  Separately, wide_impl.rs:108-117 records that max/min are now one instruction on x86 and wasm
  while the floors still price them at two — an owed recount that has not happened.
• Proposed change: re-derive the compressor/EQ/limiter/builtins inventories in
  effect-floor-accounting.md against the current lowerings (select = 1 emitted, max/min = 1 on
  x86/wasm and 2 on NEON, exp2_int = 2 after LANE-4), and re-issue the floor constants in
  tools/bench/src/floor.rs and scripts/console-benchmark-record-lib.jq in the same change, as that
  ruling requires. Do it after LANE-4, so one recount covers both.
• Expected effect: the standing authority every sealed console record is read against stops being
  conservative by an unquantified margin; gap term (a) is struck from the open list.
• Rulings / constraints checked: effect-floor-accounting.md:108-117 explicitly says this recount is
  owed and must be an owner-visible change; this finding is the trigger, not an unauthorised re-pricing.
• Verification gate: bash scripts/run-console-benchmark.sh against the re-issued floors; the
  record validator (scripts/console-benchmark-record-lib.jq) must accept the sealed records unchanged
  apart from the re-priced floor fields.

---

Summary table

id	category	class	severity	location	one-line
LANE-1	simd	A	high	crates/lane/src/wide_impl.rs:144-148	splat(CONST) emits a memset_pattern16 libc call per use on Apple targets; 2 per frame inside svf_step
LANE-2	perf	A	high	crates/lane/src/kernels.rs:472-491,497-513,563-590	mix kernels carry 4-6 bounds branches per frame because only debug_assert relates the slice lengths
LANE-3	dsp-math	A	high	crates/lane/src/wide_impl.rs:278-330	AArch64 release folds D8 max/min into fmaxnm/fminnm; G1 is red today and no CI job runs on aarch64
LANE-4	dsp-math	A	medium	crates/lane/src/wide_impl.rs:332-340	exp2_int re-clamps an argument both callers already clamped — 4 of the compressor's 94 floor ops
LANE-5	perf	A	medium	crates/lane/src/kernels.rs:450-465	ramp_block evaluates a per-frame vector select of a monotone predicate; split the loop
LANE-6	perf	A	medium	crates/lane/src/kernels.rs:295-322	svf_block_ramped recomputes -c1 and the ramp test on every frame including settled ones
LANE-7	dry	A	medium	crates/lane/src/kernels/builtins.rs:408-1096	six near-identical copies of the input-chain frame body (~330 lines)
LANE-8	dry	N/A	medium	crates/math/src/fast_db.rs:123,128 + 3 crates	20*log10(2) and its inverse declared 4x each in 3 spellings; belongs in math
LANE-9	dead-code	N/A	medium	tools/audit/vectorization-allowlist.tsv:4,7	the vectorization gate requires fused multiply-add that #163 phase 2 removed; masked by continue-on-error
LANE-10	crate-boundary	N/A	low	crates/math/src/lib.rs:38	test-only corpus module compiled into every production consumer of math
LANE-11	dry	N/A	low	crates/math/src/corpus.rs:70-90 + 19 files	one xorshift64* generator copy-pasted twenty times
LANE-12	dsp-math	B (flag)	low	crates/soft-clip/src/kernel.rs:195,199	flush applied to two feed-forward FIR history words; documented but outside the D7 law's wording
LANE-13	architecture	N/A	low	docs/rulings/effect-floor-accounting.md:134-136,183-186	gap term (a) is closed in code; the floor tables and bench constants still price it as open

---

Things I checked that are fine

• Lane::select → vblendvps. Already done (wide_impl.rs:263-271); wide 1.6.1's select is
  blend_varying_m256/blend_varying_m128/v128_bitselect/vbslq_f32. Gap term (a) is closed —
  see LANE-13. Do not re-propose it.
• Lane::andnot (self & !m). The floor prices it at 1 (vandnps); LLVM forms the single
  instruction (verified on aarch64: bic.16b, one instruction, in flush). No change needed.
• Lane::fma, max/min on x86 and wasm. fma is the required unfused (a*b)+c; the fast_max/
  fast_min lowerings are argued instruction by instruction at wide_impl.rs:66-117 and are correct.
• Coefficient hoisting in the block kernels (gap term b). svf_block, svf_cascade_interleaved,
  input_chain_block and mixed_chain_block all hoist nc1 and take coefficients by & outside the
  frame loop, and the measured disassembly confirms the coefficient loads are hoisted (ldp q2, q3, [x3]
  before the loop). The residual vbroadcastss traffic the ruling counts is register pressure from the
  number of live constants (fast-db-tier-boundaries.md: "its fifteen live constants have to be
  rematerialised or spilled"), and AVX2 has no embedded-broadcast operand form, so there is no source-level
  lever except reducing the constant count — which is what LANE-4 does.
• flush() frequency. Exactly one flush per recursive state word per sample everywhere except the
  soft clipper (LANE-12): svf_step flushes ic1 and ic2 and nothing else; one_pole_block,
  effect_runtime::envelope, compressor, gate/expander, multiband, limiter and delay each flush their own
  single recurrence. No double-flush found.
• Horner vs Estrin in lane_math/fast_db. Both are strict Horner with explicit mul/add.
  Estrin would change the rounding sequence and is class B; the crates document why the mul/add
  spelling is kept (lane_math.rs:10-21). Not proposed.
• Range reductions. exp2_lane's Cephes fold and fast_exp2's unfolded reduction are both exact
  (x - floor(x) for |x| < 2^23, Sterbenz on f - 1), and fast_db's no-fold choice is a measured
  accuracy decision, not a corner cut. The only redundant reduction is LANE-4's.
• Exponent extraction. exp2_int/frexp use add + to_bits + shift + from_bits, deliberately not
  float↔int conversion, and bits.rs:1-8 explains that three targets saturate differently. Correct.
• #[inline] attributes. Every Lane op, every kernel and both math lane-tier functions are
  #[inline(always)]; math's scalar layer is #[inline] and is control-plane only. The release profile
  is lto = "fat", codegen-units = 1 (Cargo.toml:135-139), so cross-crate monomorphisation is not at
  risk.
• debug_assert discipline. No hard assert! on any render path in lane or math (the only two
  are in math::corpus, which is test machinery — LANE-10).
• div on render paths in lane/math. None: no kernel and neither lane_math nor fast_db divides.
  The two vdivps the limiter pays are that crate's, and effect-floor-accounting.md (limiter inventory, the two div note) already
  rules the reciprocal substitution class B.
• svf_cascade_interleaved depth. SVF_CASCADE_DEPTH = 2 at both vector widths is the measured
  register ceiling (cross-bank-interleave.md); nothing here argues against it.
• pdc_delay_block. Two swap_with_slice calls and one branchless-enough cursor wrap; no %, no
  per-sample work, no float operation. Fine.
• fpenv. Guard is once per render entry; the asm!("") barrier emits no instructions; the unsafe
  is confined to the two allowlisted files.

[tamashi095]

Audit report — Control plane: session, compilers, graph (control half), host-core, effect-package (CP-*), part 1/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

Control plane / compilers audit (CP-*)

Scope: crates/session, crates/effect-compiler, crates/builtins-compiler, crates/rack-compiler,
crates/graph-compiler, control-plane parts of crates/graph, crates/host-core, crates/effect-package.

Dependency graph (cargo metadata --format-version 1 --no-deps, normal deps only)

engine:              (none)
lane:                wide
math:                lane
effect-contract:     engine, lane, math
effect-runtime:      lane, math
rack:                effect-contract, engine
session:             engine, jstrict
effect-package:      effect-contract, engine, sha2
rack-compiler:       effect-contract, engine, rack
graph:               effect-contract, engine, lane, rack
builtins:            effect-contract, engine, lane, math
protocol:            engine, session
source:              engine, graph, session
effect-compiler:     compressor, delay, effect-contract, effect-package, engine, gate-expander,
                     lane, multiband-compressor, parametric-eq, session, soft-clip,
                     transient-shaper, true-peak-limiter
builtins-compiler:   builtins, effect-contract, engine, graph, lane, rack, rack-compiler,
                     session, sha2
graph-compiler:      builtins, builtins-compiler, effect-compiler, effect-contract, engine,
                     graph, lane, math, rack, rack-compiler, session, sha2
host-core:           builtins, builtins-compiler, effect-compiler, effect-contract, engine,
                     graph, graph-compiler, lane, session, source
capi:                effect-contract, engine, host-core, lane, protocol, session, source
host-web:            builtins, builtins-compiler, effect-contract, engine, host-core, math, session

Three structural facts fall straight out of this graph and drive several findings below:

1. graph does not depend on session. That is why StableGraphId is a byte-for-byte copy of
   session::StableId and why graph-compiler::ids::gid exists to re-parse and re-allocate every
   id on the way across (CP-5).
2. effect-compiler does not depend on rack or graph. That is why EffectRack is a third
   copy of a three-variant rack enum (CP-5).
3. effect-package depends on effect-contract, so nothing forces the descriptor-rule
   duplication in CP-8 — the shared home already exists and validate_parameter_lattice_parts
   already proves the pattern.

Corrected file inventory (the task brief's byte sizes were attributed to the wrong crates)

graph-compiler/src/lib.rs is 438.8 K / 10 166 lines, of which 9 902 lines (97 %) are one
inline #[cfg(test)] mod tests. The genuinely large production files in scope are:

file	total lines	production lines	inline test lines
graph-compiler/src/lib.rs	10 166	264	9 902
builtins-compiler/src/lib.rs	5 411	3 310	2 101
graph/src/lib.rs	4 660	1 586	3 074
graph/src/runtime.rs	3 463	2 839	624
effect-package/src/wire.rs	3 258	1 922	1 336
graph/src/program.rs	2 503	853	1 650
effect-package/src/state.rs	1 564	1 564	0
effect-compiler/src/prepare.rs	1 440	1 440	0
session/src/parse.rs	1 392	1 392	0
rack-compiler/src/lib.rs	1 193	447	746
host-core/src/lib.rs	143	143	0

host-core/src/lib.rs is 9.4 K, not 156 K; runtime.rs/program.rs live in graph, not
graph-compiler. Module-split proposals are in CP-11 and are written against these real numbers.

Distinct representations along session -> plan (item 2 count)

Effect: 8 representations. session::Effect+EffectParam -> effect_compiler::EffectPreparedEntry
(+EffectBankPreparation) -> rack::RackProgram<K> slot key -> rack_compiler::CohortCandidate ->
rack_compiler::BankGroup/BankPlan -> graph::EffectNodeId/GraphNodeId::Effect ->
graph::GraphPreparedEffect/GraphPreparedEffectBank -> graph::program::Op ->
graph::runtime::RuntimeOp/ConsoleEffect.

Track: 6 representations. session::Track -> builtins_compiler::StripPreparation
(+TrackControlRecord/TrackFaderRecord/TrackInputRecord) -> 7 GraphNodeId::TrackStage nodes ->
program::NodeIndex (u32) -> runtime::RuntimeOp/TrackDelayLine -> host_core::HostSessionShape
/console_tracks: Vec<Box<str>>.

Rack: 4 enum spellings (CP-5). Diagnostic: 5 near-identical shapes (CP-6, CP-9).

---

CP-1: the whole compile front-half is keyed by a heap-String enum that lower immediately interns to u32

• Category: architecture
• Class: N/A (non-render)
• Severity: high
• Location: crates/graph-compiler/src/schedule.rs:9-65, crates/graph-compiler/src/schedule.rs:74-152,
  crates/graph-compiler/src/schedule.rs:195-278, crates/graph-compiler/src/ids.rs:50-61,
  crates/graph-compiler/src/ids.rs:108-110, crates/graph/src/program.rs:170-180
• Current code:

// crates/graph-compiler/src/schedule.rs:9
pub(crate) fn topo(nodes: &[GraphNode], edges: &[GraphEdge]) -> Option<Vec<DependencyLevel>> {
    let mut degree: BTreeMap<_, u64> = nodes.iter().map(|node| (node.id.clone(), 0)).collect();
    let mut successors: BTreeMap<_, Vec<_>> = nodes
        .iter().map(|node| (node.id.clone(), Vec::new())).collect();
    let mut predecessors: BTreeMap<_, Vec<_>> = nodes
        .iter().map(|node| (node.id.clone(), Vec::new())).collect();
    for edge in edges {
        *degree.get_mut(&edge.destination.node)? += 1;
        successors.get_mut(&edge.source.node)?.push(edge.destination.node.clone());
        predecessors.get_mut(&edge.destination.node)?.push(edge.source.node.clone());
    }

// crates/graph/src/program.rs:173 -- the interning that already exists, run only at the very end
pub fn node_index(spec: &GraphSpec, id: &GraphNodeId) -> Option<NodeIndex> {
    spec.nodes.binary_search_by(|node| node.id.cmp(id)).ok().map(|i| i as NodeIndex)
}

• Problem: GraphNodeId is an enum whose every variant carries one or two StableGraphId(String),
  i.e. a heap allocation. Every stage of compilation before program::lower uses it as a BTreeMap
  /BTreeSet key. On fixtures/session/v1/console-sixty-four-track.json (64 tracks, 128 effects,
  64 routes, 1 output) the graph is 641 nodes and ~640 edges. Counting only the map/set
  construction: topo clones 3N for its three maps + 2E for the edge pushes + N for ready + N for
  node_levels + N for levels ≈ 5 800 String allocations; cycle_witnesses
  (schedule.rs:74) clones 2N for adjacency/reverse plus one per DFS/SCC visit ≈ 3 000;
  buffer_assignments (schedule.rs:195) clones N into positions and then does 2E BTreeMap
  lookups, each an O(log 641) walk of ~10 string comparisons; ids::add_node clones each id
  twice (schedule.rs latency/tail maps) and ids::ports_for clones it twice more; compile.rs
  builds the (String, RackId, String) key four separate times per effect
  (compile.rs:174-178, :198-202, :236-240, :290-294, :401-405) = ~10 String allocations
  per effect. Total across one structural compile: roughly 15 000-20 000 short-String
  heap allocations plus tens of thousands of string comparisons, all to produce identity that
  program::lower then discards by interning to NodeIndex = u32 via binary search.
  The crate doc on graph/src/lib.rs:1 already states the intent ("nothing on the render path
  compares strings") — the point is that nothing on the compile path needs to either.
• Proposed change: intern once, immediately after nodes.sort_by(|a,b| a.id.cmp(&b.id)) in
  graph-compiler/src/compile.rs:395. Add to graph-compiler a new mod intern:

// crates/graph-compiler/src/intern.rs
pub(crate) struct Interned<'a> {
    nodes: &'a [GraphNode],                 // sorted by id; index == NodeIndex
    edges: Box<[(u32 /*src*/, u32 /*dst*/, GraphPortKind)]>,
}
impl<'a> Interned<'a> {
    pub(crate) fn new(nodes: &'a [GraphNode], edges: &[GraphEdge]) -> Option<Self>; // one binary
                                                                                   // search per endpoint
    pub(crate) fn id(&self, index: u32) -> &GraphNodeId;  // only for diagnostics and plan rows
}

Rewrite topo, cycle_witnesses, cycle_witness_in_component and buffer_assignments to take
&Interned and use flat Vec<u32>/Vec<Vec<u32>> indexed by NodeIndex instead of
BTreeMap<GraphNodeId, _>; pdc::timings (crates/graph-compiler/src/pdc.rs, 5 BTreeMaps)
likewise. Materialise GraphNodeId again only where a value actually leaves the compiler:
DependencyLevel::nodes, sequential_schedule, BufferAssignment::port, GraphDiagnostic::cycle.

• Expected effect: ~15 000 fewer heap allocations and all string comparisons removed from one
  64-track structural compile; the maps become O(1) array indexing instead of O(log N) string-keyed
  B-tree walks. No rendered bit moves — the outputs are the same sorted sequences. The same code
  gets shorter: schedule.rs currently carries 31 .clone() and 9 BTreeMap in 278 lines.
• Rulings / constraints checked: control plane only; no ruling covers compile-time identity.
  graph/src/program.rs:1-32 explicitly frames interning as the right shape ("node ids are interned
  to NodeIndex, so nothing on the render path compares strings") — this extends the same decision
  one stage earlier. Node/level/edge ordering is unchanged because spec.nodes is already sorted by
  id, so NodeIndex order is id order.
• Verification gate: cargo test -p graph-compiler (the 60 inline tests pin canonical SHA-256s,
  level contents and cycle witnesses verbatim); cargo test -p graph for the lowering property
  tests; cargo test -p host-core. Determinism gate: GraphCompiler::sha256 must be unchanged for
  every fixture in fixtures/session/v1/.

---

CP-2: program::lower runs three times per prepared plan; the cached result is thrown away at bind

• Category: perf
• Class: N/A (non-render, but on every structural plan swap)
• Severity: high
• Location: crates/graph/src/lib.rs:840-849, crates/graph/src/lib.rs:857-868,
  crates/graph/src/lib.rs:906, crates/graph/src/lib.rs:824, crates/graph/src/lib.rs:1017-1021,
  crates/graph/src/lib.rs:349-357
• Current code:

// crates/graph/src/lib.rs:840
fn lower_from_current_fields(&self) -> Option<program::ExecutionProgram> {
    program::lower(&self.spec, &self.sequential_schedule, &self.dependency_levels,
                   &self.inserted_delays, &bank_member_nodes(&self.banks, &self.builtin_banks)).ok()
}
// :857 -- bind path re-derives instead of reading `self.program`
fn lowered(&self) -> Option<program::ExecutionProgram> {
    let program = self.lower_from_current_fields()?;
    ...
}
// :349 -- and this is the stated reason it must:
    pub spec: GraphSpec,
    pub sequential_schedule: Vec<GraphNodeId>,
    pub dependency_levels: Vec<DependencyLevel>,
    pub inserted_delays: Vec<InsertedDelay>,

• Problem: on the production host path (host-core::prepare_host_runtime_with_console)
  lower_from_current_fields runs at PreparedGraphPlan::new (lib.rs:906), again inside
  attach_builtin_banks (lib.rs:824), and a third time inside bind_optional_source_set via
  lowered() (lib.rs:1017). The doc at lib.rs:342-347 names the reason: "the schedule, levels
  and inserted delays are public and the transactional bind contract hands a rejected plan back to
  be repaired and re-bound". lower is not cheap: it builds level_of, position, order, a
  BTreeMap<&GraphEdgeId, u64> of delays, per-node main_in: Vec<Vec<usize>> (program.rs:566),
  a liveness-colouring pass with expire: Vec<Vec<u32>> (program.rs:740), and a node_index
  binary search per schedule entry and per edge endpoint. Each call also rebuilds
  bank_member_nodes (lib.rs:463-491), which clones every bank member's EffectNodeId
  (two Strings each) into a fresh Vec<Vec<GraphNodeId>>. Two of the three lowerings are
  discarded outright. The only reason the third is needed is that nine fields are pub so tests
  can mutate them.
• Proposed change: make spec, sequential_schedule, dependency_levels, route_timings,
  inserted_delays, buffer_assignments, estimate, required_bindings private with &
  accessors (they are already read-only for every production consumer — graph-compiler builds the
  plan through PreparedGraphPlanParts, host-core only reads). Add
  #[cfg(feature = "test-support")] pub fn parts_mut(&mut self) -> … (or a
  #[cfg(feature = "test-support")] pub fn relower(&mut self)) for the hand-built test plans. Then
  lowered() becomes self.program.as_ref() and attach_builtin_banks stays the one re-derivation
  point. graph already has a test-support feature (crates/graph/Cargo.toml:13), so no new
  machinery is needed. Also cache bank_member_nodes alongside program so the second derivation
  does not re-clone every member id.
• Expected effect: 2 of 3 lowerings of a 641-node/640-edge program removed per structural plan
  swap, plus 2 of 3 bank_member_nodes clone passes. Plan-swap latency drops by roughly two thirds
  of the lowering cost. No rendered bit moves: the program the executor gets is the one already
  validated at construction, and graph_plans_always_lower_to_an_executable_program already asserts
  they agree.
• Rulings / constraints checked: no ruling. The doc comment at lib.rs:336-347 is the only
  justification and it is entirely about the pub fields, which this finding removes.
• Verification gate: cargo test -p graph, cargo test -p graph-compiler,
  cargo test -p host-core; the plan's program() accessor and every bind-time
  graph.scheduler.layout rejection test must behave identically. Add a counter or a
  #[cfg(debug_assertions)] assert that lower is entered at most twice per plan.

---

CP-3: has_valid_structural_layout re-runs at bind the topological and permutation checks the compiler just proved

• Category: architecture (redundant validation layer)
• Class: N/A
• Severity: medium
• Location: crates/graph/src/lib.rs:630-716, crates/graph/src/lib.rs:1017-1019,
  crates/graph-compiler/src/schedule.rs:9-65, crates/graph-compiler/src/schedule.rs:74-152
• Current code:

// crates/graph/src/lib.rs:630
fn has_valid_structural_layout(&self) -> bool {
    let graph_nodes: BTreeSet<_> = self.spec.nodes.iter().map(|node| node.id.clone()).collect();
    if graph_nodes.len() != self.spec.nodes.len() { return false; }
    let mut level_by_node = BTreeMap::new();
    let mut flattened = Vec::with_capacity(graph_nodes.len());
    ...
        || level.nodes.iter().any(|node| level_by_node.insert(node.clone(), level.level).is_some())
    ...
    let positions: BTreeMap<_, _> = self.sequential_schedule.iter().cloned().enumerate()
        .map(|(position, node)| (node, position)).collect();
    if self.spec.edges.iter().any(|edge| {
        match (level_by_node.get(&edge.source.node), level_by_node.get(&edge.destination.node)) {
            (Some(source), Some(destination)) => source >= destination,
            _ => true,
        }
    }) { return false; }

• Problem: 87 lines that re-derive, from scratch, facts graph-compiler established minutes
  earlier: node-id uniqueness (compile.rs:396 sorts and the ids came from a validated session),
  that the schedule is the concatenation of the levels (compile.rs:428-431 builds it that way),
  and — the expensive one — that every edge runs forward, which is precisely what
  cycle_witnesses + topo (schedule.rs:9-152) already proved. It costs three more full passes
  of GraphNodeId cloning (graph_nodes, level_by_node, flattened, positions, plus
  bank_members) ≈ 3 200 String allocations on the 64-track fixture, on top of CP-1's
  ~15 000. And program::lower itself already returns ProgramError::NotTopological,
  SpecUnsorted and ScheduleMismatch (program.rs:155-168) for exactly these conditions, so the
  next line (lowered()) would reject the same plans anyway.
• Proposed change: delete the edge-direction, level-flattening and permutation clauses and keep
  only the bank clauses (lines 677-713), which lower does not check. Rely on
  lowered()'s ProgramError for the rest — map SpecUnsorted/ScheduleMismatch/NotTopological
  to the same "graph.scheduler.layout" code that has_valid_structural_layout returns today, so
  the observable rejection is byte-identical. If a hand-built test plan must still be rejected
  before lowering, gate the residual check behind #[cfg(feature = "test-support")].
• Expected effect: ~60 lines deleted, ~3 200 fewer allocations per plan bind, one topological
  check per plan instead of three (cycle_witnesses, topo, has_valid_structural_layout, and
  lower's own).
• Rulings / constraints checked: none applies. Note the interaction with CP-2: with the plan's
  fields private, the "caller repaired a rejected plan" scenario disappears entirely and this
  function loses its last justification.
• Verification gate: cargo test -p graph (graph.scheduler.layout rejection tests),
  cargo test -p graph-compiler, cargo test -p rack-compiler (its doc comments at
  rack-compiler/src/lib.rs:205,401,790 name this function as the contract they satisfy — those
  clauses must survive).

---

CP-4: bind_optional_source_set builds six string-keyed BTreeSets and then clones one of them

• Category: perf
• Class: N/A
• Severity: medium
• Location: crates/graph/src/lib.rs:958-996
• Current code:

let supplied: BTreeSet<_> = bindings.nodes.iter().map(|binding| binding.node.clone()).collect();
let builtin_bank_members: BTreeSet<_> = self.builtin_bank_members().cloned().collect();
let required: BTreeSet<_> = self.required_bindings.iter()
    .filter(|node| !builtin_bank_members.contains(*node)).cloned().collect();
let duplicate_binding = supplied.len() != bindings.nodes.len();
let source_claims = source_set.as_ref().map(GraphPreparedSourceSet::claimed_nodes).unwrap_or_default();
let source_claim_set: BTreeSet<_> = source_claims.iter().cloned().collect();
...
let mut all_supplied = supplied.clone();
all_supplied.extend(source_claim_set.iter().cloned());
let source_overlap = supplied.iter().any(|node| source_claim_set.contains(node));

• Problem: six BTreeSet<GraphNodeId> built by deep-cloning String-carrying ids, plus
  supplied.clone() — a full second copy of an already-built set, every node of it re-allocated
  — used only to compute all_supplied != required. On the 64-track fixture required_bindings
  holds 4 stages × 64 tracks + 1 output = 257 entries and bindings.nodes a comparable number, so
  this is ~1 500 String allocations for a set-equality test. Every containment test is an O(log N)
  walk of string comparisons.
• Proposed change: with CP-1's interning in place, required_bindings and
  GraphNodeBinding::node become NodeIndex, and all six sets become sorted Vec<u32> or a
  bitset over spec.nodes.len(). Without CP-1, the minimal fix is to drop supplied.clone():
  build all_supplied by chaining the two iterators once, and compute source_overlap as
  all_supplied.len() != supplied.len() + source_claim_set.len() — one set instead of two.
• Expected effect: minimal fix removes ~700 allocations per bind and one whole set; with CP-1,
  all ~1 500 and every string comparison.
• Rulings / constraints checked: none. Bind is control plane.
• Verification gate: cargo test -p graph (graph.plan.binding, source.graph.binding_mismatch,
  graph.plan.observer and graph.plan.envelope_mismatch rejection tests must fire on exactly the
  same inputs), cargo test -p host-core.

---

CP-5: four spellings of the same three-variant rack enum, two ID newtypes with identical grammars, two conversion functions and two token tables

• Category: dry
• Class: N/A
• Severity: medium
• Location:
  crates/session/src/model.rs:536-563 (RackName, 4 variants),
  crates/effect-compiler/src/prepare.rs:844-849 (EffectRack),
  crates/graph/src/lib.rs:49-55 (RackId),
  crates/rack/src/lib.rs:41-47 (RackLocation),
  crates/graph-compiler/src/ids.rs:160-166 (rack_id), crates/graph-compiler/src/banks.rs:19-26
  (rack_location), crates/graph-compiler/src/canonical.rs:20-26 (rack_token),
  crates/graph-compiler/src/ids.rs:167-176 (a second inline copy of rack_token);
  crates/session/src/id.rs:7-30 vs crates/graph/src/lib.rs:28-46 (StableId vs StableGraphId)
• Current code:

// crates/graph/src/lib.rs:50            // crates/rack/src/lib.rs:42
pub enum RackId {                        pub enum RackLocation {
    Simd1 = 1,                               Simd1 = 1,
    Dynamic = 2,                             Simd2 = 2,      // <-- different discriminants
    Simd2 = 3,                               Dynamic = 3,    //     and both derive Ord
}                                        }
// crates/graph-compiler/src/ids.rs:167 -- second copy of canonical.rs:20's table
        match rack { RackId::Simd1 => "simd1", RackId::Dynamic => "dynamic", RackId::Simd2 => "simd2" }

// crates/graph/src/lib.rs:28 -- byte-for-byte identical to crates/session/src/id.rs:12
pub struct StableGraphId(String);
impl StableGraphId {
    pub fn parse(value: &str) -> Option<Self> {
        let bytes = value.as_bytes();
        if !(1..=127).contains(&bytes.len()) || !bytes[0].is_ascii_lowercase() { return None; }
        if bytes[1..].iter().all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit()
            || matches!(byte, b'.' | b'_' | b'-')) { Some(Self(value.to_owned())) } else { None }

• Problem: four enums, ~30 lines of duplicated declaration plus 26 lines of conversion/token
  functions, and a latent hazard: RackId orders Simd1 < Dynamic < Simd2 (signal-flow order, and
  it is the sort key for GraphNodeId::Effect), while RackLocation orders
  Simd1 < Simd2 < Dynamic; both derive Ord and rack_location maps freely between them, so any
  future code that sorts by one and expects the other's order is silently wrong. The StableId
  duplication is worse than 20 lines: it forces graph-compiler::ids::gid (ids.rs:108-110), which
  re-validates the grammar and re-allocates the String for every one of the ~641 node ids
  built per compile — a validated session::StableId is thrown away and rebuilt as an unvalidated-
  looking StableGraphId with an .expect().
• Proposed change: move both types down to effect-contract (the deepest crate all four
  consumers already depend on — see the dependency graph):

// crates/effect-contract/src/lib.rs
#[repr(u8)] #[derive(Clone,Copy,Debug,Eq,Hash,Ord,PartialEq,PartialOrd)]
pub enum Rack { Simd1 = 1, Dynamic = 2, Simd2 = 3 }   // one order, signal-flow
impl Rack { pub const ALL: [Self; 3]; pub const fn token(self) -> &'static str; }

#[derive(Clone,Debug,Eq,Hash,Ord,PartialEq,PartialOrd)]
pub struct StableId(Box<str>);                         // one grammar, one parse

session::RackName keeps its extra Builtins variant as a wrapper
(enum RackName { Rack(Rack), Builtins }) since it is a wire token. Delete EffectRack,
RackId, RackLocation, StableGraphId, rack_id, rack_location, both rack_token copies
and gid. graph gains no new dependency (it already depends on effect-contract).

• Expected effect: ~100 lines deleted; ~641 String re-allocations and re-validations per
  compile removed with gid; the two-Ord hazard eliminated by construction.
• Rulings / constraints checked: docs/rulings/prefix-strip-inventory.md and
  de-versioning-inventory.md govern naming, not type identity; this is not a rename-for-its-own-
  sake — it deletes three types. AGENTS.md's rack vocabulary (simd1/dynamic/simd2) is
  preserved exactly, including the canonical tokens.
• Verification gate: cargo test --workspace; the canonical-graph SHA-256 fixtures in
  crates/graph-compiler/src/lib.rs's test module and fixtures/ must be unchanged (the tokens are
  wire-visible in write_canonical); scripts/check-workspace-policy.sh.

---

CP-6: three structurally identical {code, path} diagnostic types with three copies of sorted()

• Category: dry
• Class: N/A
• Severity: medium
• Location: crates/effect-compiler/src/diagnostic.rs:1-20,
  crates/builtins-compiler/src/lib.rs:233-250, crates/graph/src/lib.rs:284-303,
  crates/rack-compiler/src/lib.rs:175-177
• Current code:

// effect-compiler/src/diagnostic.rs:3        // builtins-compiler/src/lib.rs:234
pub struct EffectDiagnostic {                  pub struct BuiltinDiagnostic {
    pub code: &'static str,                        pub code: &'static str,
    pub path: String,                              pub path: String,
}                                              }
pub struct EffectDiagnosticSet(pub Vec<..>);   pub struct BuiltinDiagnosticSet(pub Vec<..>);
impl EffectDiagnosticSet {                     impl BuiltinDiagnosticSet {
    pub fn sorted(mut d: Vec<..>) -> Self {        pub fn sorted(mut v: Vec<..>) -> Self {
        d.sort(); Self(d)                              v.sort(); v.dedup(); Self(v)
    }                                              }
}                                              }

• Problem: three declarations of the same struct and three copies of sorted, which already
  disagree: EffectDiagnosticSet::sorted does not dedup() while BuiltinDiagnosticSet::sorted
  and GraphDiagnosticSet::sorted do. That is a live behavioural inconsistency hiding in a
  copy-paste. GraphDiagnostic adds cycle: Vec<GraphNodeId> and cycle_edge_paths: Vec<String>,
  which every non-cycle diagnostic carries as two empty Vecs (48 bytes of nothing per diagnostic).
  ~60 lines total.
• Proposed change: one generic in effect-contract (again the common ancestor):

// crates/effect-contract/src/diagnostic.rs
#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
pub struct Diagnostic<X = ()> { pub code: &'static str, pub path: String, pub extra: X }
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct DiagnosticSet<X>(Vec<Diagnostic<X>>);
impl<X: Ord> DiagnosticSet<X> {
    pub fn sorted(mut v: Vec<Diagnostic<X>>) -> Self { v.sort(); v.dedup(); Self(v) }
    pub fn diagnostics(&self) -> &[Diagnostic<X>] { &self.0 }
}

effect-compiler and builtins-compiler alias Diagnostic<()>; graph aliases
Diagnostic<CycleWitness> where CycleWitness is the two cycle fields, boxed so the common case
is one pointer. Decide the dedup question once and pin it with a test.

• Expected effect: ~45 lines deleted; the dedup inconsistency resolved deliberately rather
  than by accident; every non-cycle GraphDiagnostic shrinks by 48 bytes.
• Rulings / constraints checked: none. Diagnostic codes are wire-visible strings and none of
  them change.
• Verification gate: cargo test -p session -p effect-compiler -p builtins-compiler -p graph -p graph-compiler -p host-core; crates/session/tests/diagnostic_parity.rs and
  crates/host-core/tests/source_diagnostics.rs pin the emitted code/path pairs.

---

CP-7: host-core::prepare carries seven copies of the same nine-line diagnostic-mapping closure

• Category: dry
• Class: N/A
• Severity: low
• Location: crates/host-core/src/prepare.rs:382-391, :419-428, :568-577, :613-622,
  :641-650, :716-725, :747-756
• Current code:

    .map_err(|diagnostics| {
        PrepareDiagnostics::new(
            PrepareRejection::Effect,
            diagnostic_lines(diagnostics.0.iter().map(|d| (d.code, &d.path))),
        )
    })?;

• Problem: seven verbatim repetitions differing only in the PrepareRejection variant and in
  whether the set is reached as .0.iter(), .diagnostics().iter() or
  .diagnostics().iter() with d.code.as_str(). ~63 lines that should be ~10. The three different
  accessor spellings are exactly the CP-6 inconsistency showing through.
• Proposed change: once CP-6 lands, one function:

// crates/host-core/src/diagnostics.rs
impl PrepareDiagnostics {
    pub fn from_set<X>(kind: PrepareRejection, set: &DiagnosticSet<X>) -> Self {
        Self::new(kind, diagnostic_lines(set.diagnostics().iter().map(|d| (d.code, &d.path))))
    }
}

Call sites become .map_err(|d| PrepareDiagnostics::from_set(PrepareRejection::Effect, &d))?.
session::DiagnosticSet needs a small adapter because its code is an enum with .as_str().

• Expected effect: ~50 lines deleted from the single most safety-relevant function in the crate
  (prepare_host_runtime_with_console carries #[allow(clippy::too_many_lines)]).
• Rulings / constraints checked: none.
• Verification gate: cargo test -p host-core — tests/prepare.rs and
  tests/source_diagnostics.rs pin the emitted rejection kind and line bytes.

---

CP-8: effect-package re-implements effect-contract's descriptor validation rules over the wire view

• Category: crate-boundary
• Class: N/A
• Severity: high
• Location: crates/effect-package/src/wire.rs:1399-1633 (borrowed_semantic_errors, 235 lines),
  crates/effect-package/src/wire.rs:1303-1372 (parameter_semantics_valid),
  crates/effect-package/src/wire.rs:1373-1398 (parameter_lattice_valid),
  crates/effect-package/src/wire.rs:725-733 (valid_text, valid_id)
  vs crates/effect-contract/src/lib.rs:609-773 (validate_descriptor, 165 lines),
  crates/effect-contract/src/lib.rs:510-... (parameter_valid),
  crates/effect-contract/src/lib.rs:596-608 (observation_valid),
  crates/effect-contract/src/lib.rs:460 (valid_text), :37 (valid_static_id)
• Current code:

// crates/effect-contract/src/lib.rs:611     // crates/effect-package/src/wire.rs:1417
if d.contract_major != 1 {                    if view.contract_major != 1 {
    e.push(DescriptorError { path:                push("descriptor.contract_major",
        "descriptor.contract_major",                   DescriptorDiagnosticCode::ContractMajor,
        code: DescriptorDiagnosticCode::ContractMajor })   20, None);
}                                             }
if d.state_layout_version == 0 { ... }        if view.state_layout_version == 0 { ... }
if !d.supported_link_modes.contains(          if !view.link_modes.contains(
        LinkMode::DualMono) { ... }                   LinkMode::DualMono) { ... }
let (mut prior, mut ids) = (0, BTreeSet::new()); let mut prior_parameter = 0;
for p in d.parameters {                          let mut parameter_ids = BTreeSet::new();
    if p.id.0 == 0 || !ids.insert(p.id.0) { ... } for index in 0..view.layout.parameters as usize {
    if p.id.0 <= prior { ... }                        if parameter.id == 0 || !parameter_ids

• Problem: the descriptor semantic law is stated twice — once over &'static EffectDescriptor
  in the crate that owns the contract, once over BorrowedEffectDescriptorView<'_> in the crate
  whose job is bytes and CIDs. ~400 lines of rules duplicated clause for clause, including the
  diagnostic path strings and the DescriptorDiagnosticCode variants (which
  effect-package imports from effect-contract, so it already knows where the owner is). A rule
  added to one and not the other means the encoder accepts a descriptor the verifier rejects, or
  vice versa, with the mismatch appearing only as a Code::Semantic on someone else's machine.
  wire.rs:302 even calls validate_descriptor(descriptor) on the encode path — so the same
  descriptor is checked by both implementations, in the same function, on the way out.
• Proposed change: the repo already established the fix and applied it to exactly one rule.
  effect_contract::step::validate_parameter_lattice_parts (crates/effect-contract/src/step.rs:440)
  is documented as "canonical descriptor-wire verification uses this entry point so the wire and
  static-contract paths execute one implementation of the declaration law", and
  effect-package/src/wire.rs:1386 already calls it. Extend that pattern to every remaining
  rule. Add to effect-contract:

// crates/effect-contract/src/descriptor_law.rs
pub fn descriptor_header_errors(contract_major: u16, state_layout_version: u32,
    effect_id: &str, display_name: &str, link_modes: LinkMode) -> impl Iterator<Item = DescriptorError>;
pub fn parameter_errors_parts(id: u32, unit: ParameterUnit, domain: ParameterDomain,
    mapping: ParameterMapping, minimum: Option<f32>, maximum: Option<f32>, default_value: f32,
    enum_choice_values: &[f32], lattice: ParameterLattice, flags: ParameterFlags)
    -> impl Iterator<Item = DescriptorError>;
pub fn port_errors_parts(..) -> ..;  pub fn quality_errors_parts(..) -> ..;
pub fn observation_errors_parts(..) -> ..;

validate_descriptor becomes a thin adapter from &'static EffectDescriptor;
borrowed_semantic_errors becomes a thin adapter from BorrowedEffectDescriptorView that adds
only the byte offset and record index it alone knows.

• Expected effect: ~300 of ~400 duplicated rule lines deleted; the encode-path double check at
  wire.rs:302 becomes redundant and can go too. The "wire accepts what the contract rejects" class
  of bug becomes unrepresentable.
• Rulings / constraints checked: none applies; this is control plane and off render entirely.
  The wire format does not change, so no CID moves.
• Verification gate: cargo test -p effect-contract -p effect-package, in particular
  crates/effect-package/tests/descriptor_v1_qualification.rs (936 lines of frozen accept/reject
  vectors) and crates/effect-contract/tests/lattice.rs; the frozen
  effect.descriptor.wire.* diagnostic codes and byte offsets in
  crates/effect-package/src/diagnostic.rs:145-165 must be unchanged.

---

CP-9: three near-identical #[repr(C)] wire-diagnostic structs and code enums in effect-package

• Category: dry
• Class: N/A
• Severity: medium
• Location: crates/effect-package/src/diagnostic.rs:1-63, :66-126, :129-197
• Current code:

#[repr(C)] pub struct EffectPackageDiagnostic {   #[repr(C)] pub struct EffectStateDiagnostic {
    pub code: EffectPackageDiagnosticCode,            pub code: EffectStateDiagnosticCode,
    pub detail: u32,                                  pub detail: u32,
    pub artifact_index: u32,                          pub item_index: u32,
    pub reserved: u32,                                pub reserved: u32,
    pub byte_offset: u64,                             pub byte_offset: u64,
    pub required_bytes: u64,                          pub required_bytes: u64,
}                                                  }
// and identical `const fn new(..)` and `const fn buffer_too_small(..)` on each

• Problem: EffectPackageDiagnostic and EffectStateDiagnostic are field-for-field identical
  (only the code enum type and the middle field's name differ) with identical constructors;
  EffectDescriptorWireDiagnostic is the same shape at u32 widths. Their three code enums share
  10 variants each with the same names and, for the first two, the same numeric values
  (Ok=0, Limit=1, BufferTooSmall=2, Header=3, Length=4, Reserved=5, Enum=6, …, Overflow=16).
  ~130 lines. The asymmetry is the tell: only EffectDescriptorWireDiagnosticCode has an
  as_str() (diagnostic.rs:147-166) and only it has a frozen-numbering test
  (diagnostic.rs:200-283) — the other two enums are equally wire-visible and have neither.
• Proposed change:

// crates/effect-package/src/diagnostic.rs
#[repr(C)] #[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct WireDiagnostic<C: Copy> {
    pub code: C, pub detail: u32, pub index: u32, pub reserved: u32,
    pub byte_offset: u64, pub required_bytes: u64,
}
impl<C: Copy + WireDiagnosticCode> WireDiagnostic<C> {
    pub const fn new(code: C, detail: u32, index: u32, byte_offset: u64) -> Self { .. }
    pub const fn buffer_too_small(detail: u32, required_bytes: u64) -> Self { .. }
}
pub trait WireDiagnosticCode: Copy { const BUFFER_TOO_SMALL: Self; fn as_str(self) -> &'static str; }

Keep pub type EffectPackageDiagnostic = WireDiagnostic<EffectPackageDiagnosticCode>; etc. so the
C-ABI-facing names and layouts are unchanged. Add as_str to all three enums via the trait, and
extend the frozen-numbering test to all three with a table-driven macro.

• Expected effect: ~80 lines deleted; two enums gain the as_str and frozen-numbering coverage
  the third already has; #[repr(C)] layout is provably identical because the field list is.
• Rulings / constraints checked: the structs cross the C ABI (crates/effect-package/src/ffi.rs),
  so layout is contract — a generic #[repr(C)] struct with one monomorphisation per code type has
  the identical layout, and a static_assertions-style const size/offset test should pin it.
• Verification gate: cargo test -p effect-package; add
  assert_eq!(size_of::<EffectPackageDiagnostic>(), 32) etc. plus offset_of! asserts for every
  field; crates/effect-package/tests/effect_interchange_abi.rs.

---

CP-10: the descriptor wire layout is a table of naked integer literals repeated in three places

• Category: dry
• Class: N/A
• Severity: medium
• Location: crates/effect-package/src/wire.rs:403-470 (encoder), :786-810 and :851-1030
  (verifier), plus the borrowed-view accessors in the same file
• Current code:

// encoder, wire.rs:415-462                    // verifier, wire.rs:788-804
write_u16(output, 8, VERSION);                  if read_u16(bytes, 8) != VERSION { .. }
write_u16(output, 10, HEADER_BYTES as u16);     if read_u16(bytes, 10) != HEADER_BYTES as u16 { .. }
write_u32(output, 16, layout.total);            let total = read_u32(bytes, 16);
write_u32(output, 48, layout.parameters);       let parameters = read_u32(bytes, 48);
write_u32(output, 56, layout.ports);            let ports = read_u32(bytes, 56);
write_u32(output, 64, layout.qualities);        let qualities = read_u32(bytes, 64);
write_u32(output, 72, layout.choices);          let choices = read_u32(bytes, 72);
write_u32(output, 80, layout.string_bytes);     let string_bytes = read_u32(bytes, 80);
write_u32(output, 88, layout.observations);     let observations = read_u32(bytes, 88);

• Problem: roughly 200 naked offset literals across the encoder, the verifier and the borrowed
  view, hand-kept in three parallel tables. Header fields (8/10/12/16/20/22/24/28/32/36/40/44/48…92),
  parameter record fields (record+4 … record+76), port, quality, choice and observation records
  all appear at least twice, and the parameter-record offsets appear in four places (encode, verify,
  BorrowedParameter, and borrowed_semantic_errors's record + 4/record + 32 diagnostics).
  Adding one descriptor field means editing four literal tables and every subsequent offset in each.
• Proposed change: one module of named const usize offsets plus a #[repr(C)]-free
  field-accessor pair per record type:

// crates/effect-package/src/wire/layout.rs
pub(crate) mod header { pub const VERSION: usize = 8; pub const HEADER_BYTES: usize = 10;
    pub const TOTAL: usize = 16; pub const CONTRACT_MAJOR: usize = 20; /* … */ }
pub(crate) mod parameter { pub const ID: usize = 0; pub const UNIT: usize = 4; /* … */
    pub const BYTES: usize = 80; }

Every write_u32(output, 48, ..) becomes write_u32(output, header::PARAMETERS, ..) and every
read_u32(bytes, 48) the same. Add one test that asserts the offsets are dense, non-overlapping
and sum to HEADER_BYTES / PARAMETER_BYTES, which is a stronger gate than the current
"the two tables happen to agree".

• Expected effect: no line-count change, but the layout becomes stateable once and testable
  mechanically; the class of bug where encoder and verifier disagree about one offset becomes a
  compile error rather than a fixture failure.
• Rulings / constraints checked: wire format is frozen and unchanged — this is a renaming of
  literals to constants with identical values.
• Verification gate: cargo test -p effect-package; the byte vectors in
  crates/effect-package/tests/package_vectors.rs and
  crates/effect-package/tests/state_vectors.rs must be unchanged byte for byte.

---

CP-11: four giant files, three of which are 60-97 % inline test module; concrete splits

• Category: crate-boundary
• Class: N/A
• Severity: medium
• Location: crates/graph-compiler/src/lib.rs:264-10166, crates/graph/src/lib.rs:1586-4660,
  crates/graph/src/runtime.rs:1-2839, crates/builtins-compiler/src/lib.rs:1-5411,
  crates/effect-package/src/wire.rs:1922-3258, crates/graph/src/program.rs:853-2503
• Current code:

// crates/graph-compiler/src/lib.rs:255-264 -- the entire production body ends here
mod banks;  mod canonical;  mod compile;  mod estimate;  mod ids;  mod pdc;  mod schedule;

#[cfg(test)]
mod tests {                       // lines 264..10166 == 9 902 lines, 60 #[test] fns

• Problem: graph-compiler/src/lib.rs is 438 K because 97 % of it is one test module —
  60 tests averaging 165 lines each, importing seven private modules' internals. rustfmt,
  rust-analyzer and every editor pay for that on every keystroke, and the file is unnavigable.
  The other three are genuinely large production files with no internal module structure.

• Proposed change — concrete assignments:

  graph-compiler/src/lib.rs (264 prod / 9 902 test). Move mod tests to
  crates/graph-compiler/tests/ as integration tests, one file per subject, using only the public
  API where possible and #[cfg(test)] pub(crate) re-exports where not:
  tests/canonical.rs (canonical text + SHA-256 + dot), tests/schedule.rs (topo, levels, cycle
  witnesses), tests/buffers.rs (colouring, arena counts), tests/pdc.rs, tests/banks.rs
  (cohorts, chain merges, lane sets), tests/console.rs (the compile_console_model* harnesses),
  tests/estimate.rs, tests/scale.rs. lib.rs keeps the 264 production lines.

  graph/src/lib.rs (1 586 prod / 3 074 test). Split production into:
  ids.rs (StableGraphId, RackId, TrackStage, EffectNodeId, GraphNodeId, GraphPortKind,
  GraphPortId, GraphEdgeId — lines 26-112, and see CP-5); spec.rs (GraphNode, GraphEdge,
  GraphSpec, DependencyLevel, RouteTiming, InsertedDelay, ReductionRecord,
  BufferAssignment — 113-159); compile_contract.rs (GraphResourceEstimate,
  GraphBuiltinBankResourceEstimate, GraphBuiltinBankAttachError, GraphCompileCaps,
  GraphDiagnostic, GraphDiagnosticSet — 160-303; and see CP-12: these are compiler-facing, not
  render-reachable); plan.rs (PreparedGraphPlan and its 426-line impl, PreparedGraphPlanParts,
  PreparedRoute, PreparedTrackDelay, RouteTransform, reduce_left_to_right — 304-1045,
  1300-1330); bind.rs (GraphRuntimeBindings, GraphNodeBinding, GraphBindingBlock,
  GraphRuntimeProcessor, GraphObservationBlock, GraphRuntimeObserver,
  GraphNodeObserverBinding, GraphBindFailure, GraphSourceBindFailure, the bind* methods —
  1068-1298); source_set.rs (GraphSourceInputClaim, GraphSourceSetResourceReport,
  GraphPreparedSourceSetDriver, GraphPreparedSourceSet — 1078-1206);
  executor.rs (GraphExecutor + impl PreparedPlanExecutor — 1331-1527).

  graph/src/runtime.rs (2 839 prod). Split into runtime/delay.rs (CompensationDelay,
  TrackDelayLine — 118-264), runtime/op.rs (StagedInput, RuntimeOp, RuntimeUnit,
  NodeKind, ConsoleEffect, execute_op, observe, bank_gather_source — 266-530, 963-1205),
  runtime/build.rs (the bind-time construction: build_op, finish_unit, units_of,
  cohort_runs, op_dataflow, chains_into, route_fold — ~1200-2830), runtime/mod.rs
  (Runtime, ArenaLease, execute, observe_unit — 700-960). The build half is the majority and
  is not render code at all.

  builtins-compiler/src/lib.rs (3 310 prod). See CP-12 for the render-code split; also lift
  crates/builtins-compiler/src/lib.rs:925-1078 (155 lines of #[cfg(feature = "test-support")]
  allocation tracker) to src/test_support.rs, and lib.rs:1080-1352 (PreparedBuiltinsGraphArtifact
  and friends, BuiltinResourceEstimate, ResourceAccumulator) to src/artifact.rs/src/resource.rs.

• Expected effect: no behaviour change; graph-compiler/src/lib.rs drops from 10 166 to 264
  lines, graph/src/lib.rs from 4 660 to ~200 (module declarations plus re-exports),
  graph/src/runtime.rs from 3 463 to ~400.

• Rulings / constraints checked: crates/graph/src/lib.rs:1-4 already declares the intended
  seam ("Parsing, hashing, validation, and lowering live in graph-compiler; this crate only
  retains the already-validated immutable result and its preallocated render state") — the split
  above makes the file layout match the declared seam. Moving mod tests out of graph-compiler's
  lib.rs loses access to seven private modules; where a test genuinely needs one, prefer
  #[cfg(feature = "test-support")] pub over widening the production API.

• Verification gate: cargo test --workspace with no test deleted or renamed; git diff --stat
  should show pure moves. scripts/check-realtime-policy.sh must still find every
  REALTIME_POLICY_BEGIN/END block after the runtime.rs split.

---

CP-12: builtins-compiler contains ten render-path process/observe implementations; graph contains the compiler's caps and diagnostics

• Category: crate-boundary
• Class: N/A
• Severity: medium
• Location: crates/builtins-compiler/src/lib.rs:364-666 (three
  GraphPreparedBuiltinBankProcessor impls), crates/builtins-compiler/src/lib.rs:2963-3131
  (six GraphRuntimeProcessor impls + one GraphRuntimeObserver impl);
  crates/graph/src/lib.rs:160-303 (GraphResourceEstimate, GraphCompileCaps, GraphDiagnostic,
  GraphDiagnosticSet); crates/graph/src/program.rs:487-503 (lower)
• Current code:

// crates/builtins-compiler/src/lib.rs:388, :547, :618, :2964, :2976, :2988, :3023, :3071, :3095, :3121
impl GraphPreparedBuiltinBankProcessor for BuiltinBankProcessor { fn process(..) { .. } }
impl GraphRuntimeProcessor for ConsoleInputProcessor {
    fn process(&mut self, block: GraphBindingBlock<'_>) -> Result<(), RenderError> { .. }
}
impl GraphRuntimeObserver for MeterObserver { fn observe(..) -> Result<(), RenderError> { .. } }

// crates/graph/src/lib.rs:1-4 (the crate's own statement of its scope)
//! Immutable render-reachable graph data and scalar routing primitives.
//! Parsing, hashing, validation, and lowering live in `graph-compiler`; this crate
//! only retains the already-validated immutable result and its preallocated render state.

• Problem: the boundary is violated in both directions and each crate's own doc says so.
  (a) builtins-compiler — a crate whose name says it compiles — holds ~470 lines of render-thread
  process/observe bodies for the input, fader and matrix stages, both per-node and banked. Those
  are the render kernels' call sites, not compilation. (b) graph — the crate that declares itself
  "immutable render-reachable graph data" — holds GraphCompileCaps (11 fields, produced by exactly
  one production caller, host-core/src/prepare.rs:732, and consumed by exactly one,
  graph-compiler/src/compile.rs), GraphResourceEstimate (a compiler output),
  GraphDiagnostic/GraphDiagnosticSet (only graph-compiler constructs them), and program::lower
  — a 300-line compilation pass that the crate header explicitly assigns to graph-compiler.
• Proposed change:
  • Move the ten render impls and their state structs out of builtins-compiler into builtins
    (which already owns InputBuiltins, FaderMuteBuiltins, MatrixBuiltins, MeterAccumulator
    and the kernels they call), as builtins::graph_bindings. builtins would need a dependency on
    graph for the traits; if that is unwanted, make the traits' signatures the seam by defining
    graph::GraphBindingBlock/GraphObservationBlock in engine::realtime instead — they are just
    {left, right, first_sample}. builtins-compiler then only constructs them.
  • Move GraphCompileCaps, GraphResourceEstimate, GraphBuiltinBankResourceEstimate,
    GraphDiagnostic and GraphDiagnosticSet to graph-compiler. PreparedGraphPlan::estimate
    becomes a generic or a small render-relevant subset; nothing on the render path reads any of
    these today.
  • Either move program::lower to graph-compiler (and have the compiler build
    ExecutionProgram and hand it to PreparedGraphPlan::new), or amend graph/src/lib.rs:1-4 to
    say lowering lives here. The first is the honest one and it also fixes CP-2 for free: with
    lower on the compiler side, the plan holds the program and never re-derives it.
• Expected effect: ~470 lines leave builtins-compiler (3 310 -> ~2 840 production lines);
  ~150 leave graph; graph's public surface stops exporting compile-time vocabulary to render
  consumers. graph-compiler gains what its name already claims.
• Rulings / constraints checked: AGENTS.md's naming rule is about package names, and this
  finding is about matching code to the names that already exist. No render arithmetic moves —
  every process body is transplanted verbatim.
• Verification gate: cargo test --workspace; scripts/check-realtime-policy.sh (the
  REALTIME_POLICY blocks travel with the code); bit-identity fixtures for the builtins chain
  (cargo test -p builtins, cargo test -p graph-compiler console fixtures) must produce identical
  digests.

---

CP-13: the render loop dispatches on every unit twice per block, and calls observe_unit on units that have no observers

• Category: perf
• Class: A (bit-identical)
• Severity: medium
• Location: crates/graph/src/lib.rs:1416-1419, crates/graph/src/runtime.rs:890-902,
  crates/graph/src/runtime.rs:944-958, crates/graph/src/runtime.rs:1187-1190
• Current code:

// crates/graph/src/lib.rs:1416 -- REALTIME_POLICY block, per render block
for unit in 0..runtime.units.len() {
    runtime.execute(unit, time.absolute_sample)?;
    runtime.observe_unit(unit, time.absolute_sample)?;
}
// crates/graph/src/runtime.rs:901 and :950 -- each is a separate bounds-checked index + discriminant
    match &mut units[index] { RuntimeUnit::Op(op) => .., RuntimeUnit::Bank { .. } => .. }
// crates/graph/src/runtime.rs:1187
fn observe(op: &mut RuntimeOp, lease: &ArenaLease, first_sample: u64) -> Result<(), RenderError> {
    if op.observers.is_empty() { return Ok(()); }

• Problem: per unit per block the loop performs two slice index operations (each a bounds
  check the compiler cannot elide across the two separate &mut self method calls) and two
  enum-discriminant loads on the same RuntimeUnit. For a Bank unit, observe_unit then walks
  every member — dereferencing each member's observers: Box<[..]> pointer, an extra cache line
  per member — only to find it empty; docs/rulings/effect-floor-accounting.md:56 names "the
  graph's per-node dispatch" as an unlocated gap term and Boundary 5 says the idle row's cost "is
  almost entirely the AoSoA transposes and the graph dispatch that the fixed points cannot skip".
  This is that code. On the 64-track fixture the arena holds 193 buffers and the program's op count
  is in the low hundreds; at 48 kHz / 128-frame quantum (375 blocks/s) that is on the order of
  10^5 redundant bounds-check-plus-discriminant pairs per second, plus one pointer chase per bank
  member for a Box<[GraphNodeObserverBinding]> that is empty in every session with no console.
• Proposed change: two class-A changes, both bind-time decisions:
  1. Fuse the two calls so the discriminant is read once:

// crates/graph/src/runtime.rs
pub(crate) fn execute_and_observe(&mut self, index: usize, first_sample: u64)
    -> Result<(), RenderError> {
    match &mut self.units[index] {
        RuntimeUnit::Op(op) => { execute_op(op, ..)?; observe(op, ..) }
        RuntimeUnit::Bank { members, lanes, chain, fold, master } => { /* existing body */
                                                                       /* then observe members */ }
    }
}

 and iterate `for unit in self.units.iter_mut()` in the caller rather than by index, so the
 bounds check disappears entirely.

2. Compute at bind a observed_units: Box<[u32]> (or a Box<[bool]> parallel to units) listing
   the units that hold at least one observer, and skip the observation pass for the rest. Every
   production session with no console has this empty, so the whole observation walk becomes a
   single is_empty() test per block instead of one per unit and one per bank member.

• Expected effect: one bounds check and one discriminant load removed per unit per block; the
  entire observer walk removed for unobserved plans. No arithmetic changes — the ops execute in the
  same order with the same inputs, and observe is a no-op today wherever it would be skipped.
• Rulings / constraints checked: docs/rulings/effect-floor-accounting.md Boundary 5 names this
  cost without locating it and does not rule against fixing it; nothing here is class B. This is not
  simd-wrapper-around-scalar-inner-loop.md (no API shape change around a scalar loop) and not
  d7-check-block-fusion.md (no check is removed, only relocated to bind).
• Verification gate: scripts/check-realtime-policy.sh; cargo test -p graph -p graph-compiler -p host-core; digest-identity on fixtures/session/v1/console-sixty-four-track.json and
  console-sixty-four-track-intended.json; scripts/run-console-benchmark.sh on the
  sixty_four_track_idle and dispatch_only rows, which are exactly the rows Boundary 5 says this
  dominates; objdump instruction count of GraphExecutor::render.

---

CP-14: the runtime un-flattens ExecutionProgram's contiguous SoA into three Box<[..]> per op

• Category: perf
• Class: A (bit-identical)
• Severity: medium
• Location: crates/graph/src/program.rs:106-124, crates/graph/src/runtime.rs:415-430,
  crates/graph/src/runtime.rs:2564-2588
• Current code:

// crates/graph/src/program.rs:106 -- the good shape: 6 contiguous allocations for the whole program
pub struct ExecutionProgram {
    pub ops: Box<[Op]>,
    pub inputs: Box<[InputRef]>,      // Op::inputs is a half-open (u32, u32) range into this
    pub delays: Box<[DelaySpec]>,
    pub node_buffer: Box<[BufferRef]>,
    pub node_op: Box<[Option<OpIndex>]>,
    pub taps: Box<[Tap]>,
}
// crates/graph/src/runtime.rs:415 -- and the shape it is converted into
pub(crate) struct RuntimeOp {
    pub(crate) inputs: Box<[u32]>,
    pub(crate) staged: Box<[StagedInput]>,
    pub(crate) sidechain: Option<u32>,
    pub(crate) output: u32,
    pub(crate) kind: NodeKind,
    pub(crate) observers: Box<[GraphNodeObserverBinding]>,
}
// crates/graph/src/runtime.rs:2581
    RuntimeOp { inputs: inputs.into_boxed_slice(), staged: staged.into_boxed_slice(), .. }

• Problem: ExecutionProgram is already exactly the shape the brief asks for — a small number
  of large contiguous allocations with (start, end) ranges, documented at program.rs:74-76
  ("inputs is a half-open range into ExecutionProgram::inputs"). GraphExecutor::new then
  converts it into Box<[RuntimeUnit]> where every op owns three separate heap allocations.
  For a ~300-op plan that is ~900 small allocations and, at render, three independent pointer
  chases per op (inputs, staged, observers) instead of three offsets into arrays that are
  already resident. The inputs slice for a typical op has length 1 — a 16-byte fat pointer to an
  8-byte heap block. The bank case is worse: RuntimeUnit::Bank { members: Box<[RuntimeOp]>, .. }
  nests a Box<[..]> of structs that each hold three more.
• Proposed change: keep the SoA shape through the runtime. In crates/graph/src/runtime.rs:

pub(crate) struct Runtime {
    op_inputs: Box<[u32]>,           // one arena
    op_staged: Box<[StagedInput]>,   // one arena
    op_observers: Box<[GraphNodeObserverBinding]>, // one arena
    units: Box<[RuntimeUnit]>,
    ..
}
pub(crate) struct RuntimeOp {
    inputs: (u32, u32),     // range into Runtime::op_inputs
    staged: (u32, u32),     // range into Runtime::op_staged
    observers: (u32, u32),  // range into Runtime::op_observers
    sidechain: Option<u32>, output: u32, kind: NodeKind,
}

RuntimeOp shrinks from 3×16 + … bytes to a (u32,u32)×3 + Option<u32> + u32 + NodeKind
header — small enough that a Bank's members slice is dense and prefetch-friendly. execute_op
takes (&mut RuntimeOp, &[u32], &mut [StagedInput], ..); the arenas are built once at bind by
concatenating in unit order, which is also the render access order. Consider
#[repr(C)] on RuntimeOp and asserting size_of::<RuntimeOp>() at a cache-line-friendly value
— crates/graph/src/lib.rs:227-229 already documents size_of::<RuntimeOp>() as a reported byte,
so the number is already tracked.

• Expected effect: ~900 heap allocations at bind reduced to ~4; per-op render loads drop from
  three pointer dereferences (likely cold) to three offsets into three sequentially-scanned arrays.
  RuntimeOp roughly halves in size, so more ops per cache line in the members walk. No
  arithmetic changes at all — the same u32s are read in the same order.
• Rulings / constraints checked: class A by construction (identical values, identical order).
  Not covered by cross-bank-interleave.md (no register pressure change) or
  simd-wrapper-around-scalar-inner-loop.md (no API-shape-over-scalar-loop). The realtime rule is
  strengthened, not weakened: the arenas are allocated at bind exactly as the Box<[..]>s are today.
• Verification gate: scripts/check-realtime-policy.sh; digest identity on every session
  fixture (cargo test -p graph-compiler, cargo test -p host-core);
  crates/graph-compiler's reported size_of::<RuntimeOp>() assertion updated deliberately;
  scripts/run-console-benchmark.sh on sixty_four_track_idle and dispatch_only.

---

[tamashi095]

Audit report — Control plane: session, compilers, graph (control half), host-core, effect-package (CP-*), part 2/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

CP-15: program.rs's test oracle is a verbatim copy of runtime::op_dataflow, so it proves nothing

• Category: dry
• Class: N/A
• Severity: medium
• Location: crates/graph/src/runtime.rs:2618-2637 vs crates/graph/src/program.rs:1624-1643;
  see also program.rs:1590-1618 (units_in_runtime_order vs runtime::units_of),
  program.rs:1646-1672 (chains_into_model vs runtime::chains_into),
  program.rs:1675-1720 (runs_in_runtime_order vs runtime::cohort_runs)
• Current code:

// crates/graph/src/runtime.rs:2618            // crates/graph/src/program.rs:1624 (in `mod tests`)
fn op_dataflow(program: &ExecutionProgram)      fn op_dataflow_model(program: &ExecutionProgram)
    -> (Vec<Vec<usize>>, Vec<Option<usize>>) {      -> (Vec<Vec<usize>>, Vec<Option<usize>>) {
  let mut owner = vec![None; program.buffers ..];   let mut owner = vec![None; program.buffers ..];
  let mut readers = vec![Vec::new(); ops.len()];    let mut readers = vec![Vec::new(); ops.len()];
  let mut first_producer = vec![None; ..];          let mut first = vec![None; ..];
  for (index, op) in program.ops.iter().enum..{     for (index, op) in program.ops.iter().enum..{
    for (position, input) in inputs_of(op)..{         for (position, input) in inputs_of(op)..{
      if let Some(producer) = owner[input..] {          if let Some(producer) = owner[input..] {

• Problem: op_dataflow_model is byte-identical to op_dataflow modulo indentation and one
  local variable rename (first_producer -> first). It is presented as an independent oracle
  ("runtime::op_dataflow, restated for the interpreter") for the property tests
  bank_window_hoisting_preserves_dataflow_on_random_graphs and
  cohort_chain_merging_preserves_dataflow_on_random_graphs — the tests that
  crates/graph/src/program.rs:460-484 cites as the evidence for a rejected alternative
  (285/3617 divergences). A copy is not an oracle: it will agree with the implementation for
  every bug that is in the implementation. Both functions are in the same crate (graph), so the
  copy exists only because op_dataflow is declared fn rather than pub(crate) fn.
  units_in_runtime_order, chains_into_model and runs_in_runtime_order (~130 lines) are the
  same pattern with more paraphrase; chains_into_model's doc honestly admits it omits two
  clauses, which makes it a weaker oracle rather than an independent one.
• Proposed change: make runtime::op_dataflow pub(crate) and delete op_dataflow_model
  (18 lines). For the other three, either (a) also call the real implementation and keep the tests
  as dataflow-preservation properties (which is what they actually assert — that the lowering
  does not change what each op reads), or (b) if a genuinely independent model is wanted, write one
  from the semantic graph (GraphSpec edges) rather than from the lowered program, which is the
  only formulation that can disagree with the implementation for a real reason. State which in the
  test module doc so the next reader is not misled.
• Expected effect: 18 lines deleted immediately; ~130 more if (a) is taken; the property tests
  stop advertising independence they do not have.
• Rulings / constraints checked: none. Note program.rs:460-484 records a measured, rejected
  alternative on the strength of these tests — that ruling's evidence should be re-confirmed once
  the oracle question is settled, but nothing in it needs reopening.
• Verification gate: cargo test -p graph — the two *_on_random_graphs property tests must
  still pass at the same seeds and report the same divergence counts (285 / 3617 for the
  counterfactual arm).

---

CP-16: caps residue — 4 of CompileCaps's 6 fields are documented-inert, 8 of GraphCompileCaps's 11 are always u64::MAX

• Category: dead-code
• Class: N/A
• Severity: low
• Location: crates/session/src/compile.rs:17-43, crates/session/src/compile.rs:178-243,
  crates/graph/src/lib.rs:250-283, crates/host-core/src/prepare.rs:732-743,
  crates/graph-compiler/src/compile.rs:604-616
• Current code:

// crates/session/src/compile.rs:17
/// Four of these six are **inert since issue #241** and are retained, not enforced. ... so
/// `estimate_session_resources` now reports a literal zero for `queue_items`, `queue_bytes`,
/// `source_ring_frames`, `source_ring_bytes` and `requested_runtime_bytes`. A cap
/// compared against a constant zero can never refuse.

// crates/host-core/src/prepare.rs:732 -- the only production producer of GraphCompileCaps
        caps: GraphCompileCaps {
            maximum_nodes: u64::MAX,           maximum_edges: u64::MAX,
            maximum_schedule_items: u64::MAX,  maximum_dependency_levels: u64::MAX,
            maximum_audio_buffer_samples: u64::MAX,
            maximum_delay_samples_per_edge: u64::MAX,
            maximum_total_delay_samples: u64::MAX,
            maximum_graph_bytes: caps.maximum_graph_session_plus_plan_bytes,
            maximum_plan_bytes: caps.maximum_graph_session_plus_plan_bytes,
            maximum_single_allocation_bytes: caps.maximum_named_allocation_bytes,
            maximum_finite_tail_samples: u64::MAX,
        },

• Problem: session::check_caps (compile.rs:178-243) is a 66-line table of six comparisons,
  four of which are documented as comparing a caller value against a literal zero and therefore
  cannot refuse. GraphCompileCaps has eleven fields and exactly one production producer, which
  sets eight to u64::MAX; graph-compiler/src/compile.rs:604-616 then evaluates eight comparisons
  per compile that provably cannot fire, and GraphCompileCaps::all_nonzero (graph/src/lib.rs:264)
  checks eleven values that are all u64::MAX in production. check_caps also takes
  _session: &SessionModel and never reads it. Separately,
  builtins_compiler::track_mono_source (builtins-compiler/src/lib.rs:2805) takes a
  &CompiledSession and opens with let _ = session; — an unused parameter frozen into a pub API.
  GraphPreparedEffectBank::active_mask (graph/src/lib.rs:415-417) is a Box<[bool]> documented
  as "all true today" for a padded-group case that does not exist — one speculative allocation per
  bank.
• Proposed change: delete the four inert CompileCaps fields and their four table rows and the
  _session parameter (dead_resource_caps_cannot_refuse_any_session becomes unnecessary and goes
  too); the doc says the budgets moved to host-core's prepare and the C ABI, which already enforce
  them. Delete the eight always-u64::MAX GraphCompileCaps fields and their comparisons, leaving
  maximum_graph_bytes, maximum_plan_bytes, maximum_single_allocation_bytes — or, if the
  bounded fields are wanted for a future host, give GraphCompileCaps a const UNBOUNDED: Self
  so the intent is one word rather than eight literals. Drop the unused session parameter from
  track_mono_source. Replace active_mask with members.len() (which is already the mask, as
  GraphPreparedBuiltinBank's doc at graph/src/lib.rs:513-517 says for the builtin case).
• Expected effect: ~90 lines deleted; 8 branch-per-compile removed; one Box<[bool]> per bank
  removed; two public APIs stop advertising parameters and fields that do nothing.
• Rulings / constraints checked: crates/session/src/compile.rs:17-28 is the ruling for the
  session half and it explicitly says the fields "survive because CompileCaps is public and three
  in-flight workstreams construct it" — that is a scheduling reason, not a design one, and should be
  re-checked against the current tree before deleting. The GraphCompileCaps half has no such note.
• Verification gate: cargo test -p session -p graph -p graph-compiler -p host-core -p capi;
  crates/session/tests/invalid_matrix.rs:1183
  (compile_caps_reject_before_semantic_validation) must still pass for the two live caps.

---

CP-17: route_source_node / route_destination_node return Option but have no None arm; three dead diagnostic branches, and a panic where a diagnostic is claimed

• Category: dead-code
• Class: N/A
• Severity: medium
• Location: crates/graph-compiler/src/ids.rs:120-138, crates/graph-compiler/src/ids.rs:108-110,
  crates/graph-compiler/src/compile.rs:372-386, crates/graph-compiler/src/compile.rs:403-411,
  crates/graph-compiler/src/compile.rs:354-360, crates/session/src/validate.rs:391-450
• Current code:

// crates/graph-compiler/src/ids.rs:120 -- every arm is Some
pub(crate) fn route_source_node(source: &RouteSource) -> Option<GraphNodeId> {
    match source {
        RouteSource::Track { track_id, tap } => Some(track_node(track_id.as_str(), stage(*tap))),
        RouteSource::SubmixOutput { submix_id } => Some(GraphNodeId::Submix { submix_id: gid(submix_id.as_str()) }),
    }
}
pub(crate) fn gid(value: &str) -> StableGraphId {
    StableGraphId::parse(value).expect("accepted stable session ID")   // <- the real failure mode
}
// crates/graph-compiler/src/compile.rs:372 -- three copies of an unreachable branch
        let Some(source) = route_source_node(&route.source) else {
            diagnostics.push(diag("graph.port.unknown", &format!("$.routes[id={}].source", route.id)));
            continue;
        };

• Problem: both functions are total — Option is never None. The three
  "graph.port.unknown" diagnostics at compile.rs:374, :381 and :407 are therefore dead code,
  and the diagnostic code itself is unreachable from the production path. Worse, the actual
  failure they appear to guard (an id that does not satisfy the stable-id grammar) is handled by
  gid's .expect() — a panic on the control plane where the surrounding function's contract
  is to return a diagnostic set. The Option wrapper makes the code read as if that case is
  handled. Separately, route_transform (ids.rs:208-223) re-tests gain_db.is_finite() and the
  four matrix coefficients' finiteness, which session::validate_routes
  (crates/session/src/validate.rs:377-389) has already guaranteed via validate_finite — only the
  post-conversion gain.is_finite() && !gain.is_subnormal() and the matrix subnormal tests are new
  information.
• Proposed change: change both functions to return GraphNodeId and delete the three else
  branches. Make gid return Option<StableGraphId> and thread one real diagnostic
  ("graph.id.invalid") from the one place a session id enters the graph vocabulary — or, better,
  adopt CP-5's shared StableId so no re-parse happens at all and the question disappears. In
  route_transform, drop the gain_db.is_finite() and the four v.is_finite() tests and keep the
  subnormal and post-conversion checks, with a comment naming session::validate_routes as the
  guarantor (this is the redundant-validation-layer instance the brief asks about).
• Expected effect: ~20 lines deleted; one unreachable diagnostic code retired; a panic path on
  the control plane converted to a diagnostic or eliminated; 5 redundant is_finite tests per route
  removed from the compile path.
• Rulings / constraints checked: none. Confirm with rg 'graph.port.unknown' that no test or
  fixture asserts the dead code (the sidechain arm at compile.rs:407 reaches the same code but
  through route_source_node(&sidechain.source), which is equally total).
• Verification gate: cargo test -p graph-compiler -p host-core; grep the fixtures and
  crates/host-core/tests/source_diagnostics.rs for graph.port.unknown before deleting it.

---

CP-18: session_structural_symmetry runs twice per prepare, and the console track list is allocated three times

• Category: perf
• Class: N/A
• Severity: low
• Location: crates/host-core/src/prepare.rs:656-698, crates/host-core/src/prepare.rs:900-906,
  crates/graph-compiler/src/compile.rs:520-521, crates/builtins-compiler/src/lib.rs:2848-2872,
  crates/builtins-compiler/src/lib.rs:2914-2919
• Current code:

// crates/host-core/src/prepare.rs:656 -- allocation 1: Box<str> per track
let console_tracks: Vec<Box<str>> = model.tracks.iter()
    .map(|track| Box::<str>::from(track.id.as_str())).collect();
// :663 -- allocation 2
    Some(depth) => console_tracks.iter().map(|track| TrackControlRequest {
        track_id: track.to_string(), queue_capacity: depth }).collect(),
// :673 -- allocation 3
    Some(period) => console_tracks.iter().enumerate().map(|(index, track)| { ..
        Ok(MeterRequest { .., track_id: track.to_string(), .. }) }).collect(),
// :902 -- second full run of session_structural_symmetry
let mono_source: BTreeSet<Box<str>> = session_structural_symmetry(compiled).into_iter()
    .filter(|(_, witness)| witness.eligible()).map(|(track, _)| track).collect();

// crates/graph-compiler/src/compile.rs:520 -- first full run, inside the compile
let mut pool_classes = SessionPoolClasses::from_session(&session);   // -> session_structural_symmetry

• Problem: session_structural_symmetry (builtins-compiler/src/lib.rs:2848) walks every track
  and allocates a Box<str> per track; it runs once inside GraphCompiler::compile_with_builtins
  (via SessionPoolClasses::from_session) and again in host-core at line 902, on the same
  CompiledSession, producing the identical vector — 128 Box<str> allocations on a 64-track
  session where 64 would do, plus a BTreeSet<Box<str>> whose only use is a &dyn Fn(&str) -> bool
  string lookup per lane at arm time. Separately console_tracks exists only as a source for two
  to_string() loops over the same ids, so each track id is heap-allocated three times
  (Box<str> + two Strings) when both request loops could read model.tracks directly.
• Proposed change: expose the structural half of the witness the compile already computed —
  PreparedGraphArtifact/PreparedBuiltinsGraphArtifact already carries pool_classes: SessionPoolClasses (graph-compiler/src/lib.rs:53-63), so add
  pub fn structural_symmetry(&self) -> impl Iterator<Item = (&str, ChannelSymmetryWitness)> and
  have host-core read it instead of recomputing. (The conjoined pool_classes witness is
  stricter than the structural one, so the artifact must expose the structural term specifically —
  keep the seed vector alongside the conjoined map.) Build control_requests and meter_requests
  directly from model.tracks.iter() and keep console_tracks only for the
  HostConsoleHandles::tracks field it is actually returned in.
• Expected effect: one full track walk and 64 Box<str> + one BTreeSet removed per prepare;
  128 redundant String allocations removed from the console request build.
• Rulings / constraints checked: docs/rulings/builtins-input-liveness-d2.md and the mono-collapse
  M1/M2 comments at graph-compiler/src/compile.rs:504-519 and host-core/src/prepare.rs:888-899
  are emphatic that one derivation must feed both planners. This finding strengthens that: today
  host-core forms a third opinion from a second call. The proposal makes the arming read the same
  object the planners read, which is exactly what the M1 comment asks for.
• Verification gate: cargo test -p host-core (tests/symmetry_witness.rs, 739 lines),
  cargo test -p graph-compiler (the_two_planners_agree_on_every_track_class); digest identity on
  fixtures/session/v1/console-sixty-four-track-mono.json.

---

CP-19: graph-compiler clones the entire CompiledSession (model plus canonical JSON) on every compile, and clones the estimate three more times

• Category: perf
• Class: N/A
• Severity: medium
• Location: crates/graph-compiler/src/compile.rs:160-169, :553, :572, :652,
  crates/graph/src/lib.rs:159-192
• Current code:

// crates/graph-compiler/src/compile.rs:160
        // NOT YET REMOVED (#99 F5, deliberately; tracked by #162): this clones the whole
        // `CompiledSession`, canonical JSON included, purely to satisfy the borrow checker --
        // ... Left as a bounded successor rather than rushed: the shape is a
        // `build(&effects) -> Result<Built, Vec<GraphDiagnostic>>` that returns owned outputs,
        // with `failure(effects, ..)` called only on its `Err`.
        let session = effects.session.clone();
// :553, :572, :652
        let semantic_estimate = estimate.clone();
        let mut capped_estimate = estimate.clone();
            estimate: estimate.clone(),

• Problem: confirming the tracked item with a number: console-sixty-four-track.json is
  294 KB of canonical JSON, and CompiledSession retains it as a String alongside the full
  SessionModel (64 tracks × 3 racks × effects × params, plus two BTreeMap<StableId, u64> index
  maps). effects.session.clone() deep-copies all of it on every structural mutation, purely
  to satisfy the borrow checker — the clone is never mutated and never outlives the function. The
  proposed fix is already written down in the comment; this finding is here to attach the size to
  it. Separately, GraphResourceEstimate (graph/src/lib.rs:159-192) is 23 u64 fields and
  nothing else but derives only Clone, so .clone() appears at three sites in compile.rs,
  once inside checked_add_builtin_banks (graph/src/lib.rs:216), and once in
  host-core/src/prepare.rs:758 — all of them 184-byte memcpys wearing a method call.
• Proposed change: (a) implement the build(&effects) -> Result<Built, Vec<GraphDiagnostic>>
  refactor the comment describes, so model borrows effects.session and the transactional
  failure(effects, ..) happens only on the Err arm after the borrow ends. (b) add Copy to
  GraphResourceEstimate (all fields are u64) and delete the five .clone() calls; rewrite
  checked_add_builtin_banks as let mut next = *self;.
• Expected effect: (a) removes a 294 KB + model deep copy per structural mutation on the
  64-track fixture — the largest single allocation on the compile path. (b) is cosmetic but removes
  five misleading .clone()s and makes the 184-byte copies visible as what they are.
• Rulings / constraints checked: #99 F5 removed the canonical dump / SHA / Graphviz from the
  compile path and explicitly left this as issue Graph compiler: remove the per-compile CompiledSession clone (#99 F5 successor) #162. This finding does not re-propose a
  rejected candidate — it is the named successor, with the byte count attached.
• Verification gate: cargo test -p graph-compiler (the transactional-failure tests must still
  receive effects back by value on every early return); cargo test -p host-core;
  crates/graph-compiler/tests/scale.rs and crates/session/tests/descriptive_scale.rs for the
  compile-time regression.

---

CP-20: three hex encoders and a hand-maintained node_text / node_text_len twin

• Category: dry
• Class: N/A
• Severity: low
• Location: crates/graph-compiler/src/canonical.rs:363-372,
  crates/graph-compiler/src/canonical.rs:27-91, crates/graph-compiler/src/canonical.rs:162-170,
  tools/bench-support/src/digest.rs:71-83, tools/wasm-gates/src/lib.rs:169-179, plus
  crates/math/tests/m3_determinism.rs:44, crates/math/tests/m2_lane_identity.rs:149,
  crates/compressor/tests/cross_target.rs:26, crates/parametric-eq/tests/determinism.rs:22,
  crates/true-peak-limiter/tests/determinism.rs:76,
  crates/transient-shaper/tests/cross_target.rs:100,
  crates/effect-runtime/tests/determinism.rs:26, tools/bench/src/builtins.rs:1778,
  tools/native-pcm-runner/src/lib.rs:1572, crates/protocol/src/{controller,session_wire,message_wire}.rs
• Current code:

// crates/graph-compiler/src/canonical.rs:366     // tools/bench-support/src/digest.rs:75
pub(crate) fn hex_digest(digest: &[u8]) -> String { fn hex(digest: &[u8]) -> String {
    let mut output = String::with_capacity(64);        let mut text = String::with_capacity(len*2);
    for byte in digest {                               for byte in digest {
        write!(&mut output, "{byte:02x}")..;               text.push(char::from_digit(byte >> 4, 16)..);
    }                                                      text.push(char::from_digit(byte & 0xf, 16)..);
    output                                             }
}                                                      text }

// crates/graph-compiler/src/canonical.rs:43-51 -- the twin, with its own gate test
/// Byte length of [`node_text`] without building it (#99 F5). ... Every arm mirrors
/// the corresponding `node_text` arm exactly; `node_text_len_matches_node_text_for_every_variant`
/// is the gate that keeps them in step.
pub(crate) fn node_text_len(node: &GraphNodeId) -> usize { .. }

• Problem: at least 14 distinct hex-encoding implementations across the workspace in three
  different styles (write!("{:02x}"), char::from_digit nibbles, format! + collect), one of
  which already lives in a shared crate (bench_support::sha256_hex). Separately,
  node_text/node_text_len and edge_text/edge_text_len (canonical.rs:27-91, ~65 lines) are
  hand-maintained twins guarded by a test — and the file already contains the mechanism that makes
  the twin unnecessary: Sha256Writer (canonical.rs:164-170) is a core::fmt::Write sink proving
  the "stream instead of materialise" pattern.
• Proposed change: (a) put one pub fn hex_lower(bytes: &[u8]) -> String in engine (the
  dependency-free foundation crate every consumer already has — it needs no sha2) and delete the
  other thirteen. Pin the encoding with one test. (b) collapse the twins with a second fmt::Write
  sink:

// crates/graph-compiler/src/canonical.rs
struct CountWriter(usize);
impl core::fmt::Write for CountWriter { fn write_str(&mut self, s: &str) -> .. { self.0 += s.len(); Ok(()) } }
pub(crate) fn write_node(out: &mut impl core::fmt::Write, node: &GraphNodeId) -> core::fmt::Result;
pub(crate) fn node_text_len(node: &GraphNodeId) -> usize {
    let mut w = CountWriter(0); let _ = write_node(&mut w, node); w.0
}
pub(crate) fn node_text(node: &GraphNodeId) -> String {
    let mut s = String::new(); let _ = write_node(&mut s, node); s
}

Same for edge_text/edge_text_len. node_text_len_matches_node_text_for_every_variant becomes
true by construction and can be deleted.

• Expected effect: ~90 lines deleted across the workspace for the hex helpers; ~35 lines and one
  gate test deleted in canonical.rs; the graph_metadata_bytes compile-path length computation
  keeps its zero-allocation property (CountWriter allocates nothing) while sharing one
  implementation with the evidence path.
• Rulings / constraints checked: none. The canonical text bytes are unchanged, so
  GraphCompiler::sha256 is unchanged.
• Verification gate: cargo test --workspace; every determinism/cross-target digest test that
  currently defines its own hex must produce the identical lowercase string;
  cargo test -p graph-compiler canonical SHA-256 fixtures.

---

Summary table

id	category	class	severity	location	one-line
CP-1	architecture	N/A	high	graph-compiler/src/schedule.rs:9-278, ids.rs:50-110	Whole compile front-half keyed by heap-String GraphNodeId; ~15-20k allocations per 64-track compile that lower then interns to u32
CP-2	perf	N/A	high	graph/src/lib.rs:840-868,906,824,1017	program::lower runs 3× per plan; cached program discarded at bind because 8 fields are pub for tests
CP-3	architecture	N/A	medium	graph/src/lib.rs:630-716	has_valid_structural_layout re-runs the topological/permutation checks the compiler and lower both already prove
CP-4	perf	N/A	medium	graph/src/lib.rs:958-996	Bind builds six string-keyed BTreeSets and then .clone()s one of them
CP-5	dry	N/A	medium	session/src/model.rs:536, effect-compiler/src/prepare.rs:844, graph/src/lib.rs:28,50, rack/src/lib.rs:42	Four rack enums (two with conflicting Ord), two identical stable-id newtypes, two conversions, two token tables
CP-6	dry	N/A	medium	effect-compiler/src/diagnostic.rs:1-20, builtins-compiler/src/lib.rs:233-250, graph/src/lib.rs:284-303	Three identical {code, path} diagnostic types; the three sorted() copies already disagree about dedup
CP-7	dry	N/A	low	host-core/src/prepare.rs:382,419,568,613,641,716,747	Seven verbatim copies of the same 9-line diagnostic-mapping closure
CP-8	crate-boundary	N/A	high	effect-package/src/wire.rs:1303-1633 vs effect-contract/src/lib.rs:460-773	effect-package restates ~400 lines of effect-contract's descriptor law; the _parts fix pattern already exists for one rule
CP-9	dry	N/A	medium	effect-package/src/diagnostic.rs:1-197	Three near-identical #[repr(C)] wire diagnostics; only one has as_str and a frozen-numbering test
CP-10	dry	N/A	medium	effect-package/src/wire.rs:403-470,786-1030	~200 naked wire-offset literals hand-kept in three parallel tables
CP-11	crate-boundary	N/A	medium	graph-compiler/src/lib.rs:264-10166 and 3 others	Four giant files (one 97% inline tests); concrete per-item module assignments given
CP-12	crate-boundary	N/A	medium	builtins-compiler/src/lib.rs:364-666,2963-3131; graph/src/lib.rs:160-303; graph/src/program.rs:487	Compiler crate holds 10 render process/observe impls; render crate holds the compiler's caps, diagnostics and the lowering pass
CP-13	perf	A	medium	graph/src/lib.rs:1416-1419, graph/src/runtime.rs:890-958	Two bounds checks + two discriminant loads per unit per block; observer walk runs on every unit including unobserved banks
CP-14	perf	A	medium	graph/src/runtime.rs:415-430,2564-2588 vs graph/src/program.rs:106-124	Runtime un-flattens ExecutionProgram's contiguous SoA into three Box<[..]> per op (~900 small allocations)
CP-15	dry	N/A	medium	graph/src/runtime.rs:2618-2637 vs graph/src/program.rs:1624-1643	Property-test "independent oracle" is a verbatim copy of the implementation it checks
CP-16	dead-code	N/A	low	session/src/compile.rs:17-243, graph/src/lib.rs:250-283, host-core/src/prepare.rs:732	4/6 CompileCaps fields documented-inert; 8/11 GraphCompileCaps fields always u64::MAX; unused _session params; speculative active_mask
CP-17	dead-code	N/A	medium	graph-compiler/src/ids.rs:108-138, compile.rs:354-411	Total functions returning Option; three unreachable graph.port.unknown branches; the real failure is a .expect() panic
CP-18	perf	N/A	low	host-core/src/prepare.rs:656-698,900-906	session_structural_symmetry computed twice per prepare; each track id heap-allocated three times
CP-19	perf	N/A	medium	graph-compiler/src/compile.rs:169,553,572,652	294 KB CompiledSession deep-cloned per structural compile (tracked #162); GraphResourceEstimate is 23 u64s but not Copy
CP-20	dry	N/A	low	graph-compiler/src/canonical.rs:27-91,363-372 + 12 sites	14 hex encoders in 3 styles; node_text/node_text_len twin kept in step by a test when a fmt::Write sink already exists in the file

Things I checked that are fine

• host-core is correctly scoped and does not duplicate graph-compiler's prepare, engine's
  plan exchange, or protocol's decoding. Its dependency list contains no protocol, and
  crates/host-core/src/prepare.rs:1-5 and src/source.rs:1-5 document it as the deduplication of
  what capi and host-web each carried privately. It orchestrates; it does not re-implement.
  src/solo.rs is genuinely control-plane-only state (solo.rs:1-40 explains why solo adds zero
  render code) and belongs where it is.
• crates/session does not do work that belongs in the compilers. validate.rs checks the
  document grammar and referential integrity; the one overlap found is route_transform's
  duplicate finiteness tests, reported under CP-17.
• graph-compiler's evidence path is correctly off the compile path. #99 F5 moved the
  canonical text, SHA-256 and Graphviz to GraphCompiler::evidence/::sha256
  (compile.rs:26-64), and compile_with_builtin_tails produces none of them. The
  node_text_len twin exists to keep it that way; CP-20 keeps the property while removing the twin.
• effect-package's package/CID half is correctly minimal. effect_package_required_size
  delegates to the same descriptor_layout the encoder uses (wire.rs:376-381), so there is no
  encode/size duplication; cid.rs (367 lines) is a thin CIDv1 wrapper. The scope problem is
  descriptor validation (CP-8), not packaging.
• rack-compiler is genuinely small and single-purpose — 447 production lines, one public
  planner (plan_bank_groups) plus compare_programs, generic over Id and K: BankSlotKey so it
  serves both the builtin-stage and rack-chain planners without duplication.
• The test-support feature is correctly wired. builtins-compiler's 155-line allocation
  tracker is #[cfg(feature = "test-support")] and graph-compiler activates it only as a
  dev-dependency (crates/graph-compiler/Cargo.toml:28), so it is not in production builds.
  It should move to its own module (CP-11) but it is not leaking.
• ExecutionProgram's own shape is exemplary — 6 contiguous Box<[T]> arenas with (u32, u32)
  ranges, NodeIndex/OpIndex/BufferRef as u32 newtypes, no String anywhere. It is the model
  CP-1 and CP-14 propose extending backwards and forwards.
• The reduction order is single-sourced. graph::reduce_left_to_right
  (graph/src/lib.rs:305-333) is exported specifically so the fixture oracle uses the production
  order rather than a private copy, and Op::inputs is filled in spec.edges order (sorted by
  GraphEdgeId) exactly as master plan 083 Audit: workspace numeric contract, kernel API shape, and cross-crate duplication #83 D9 requires. No duplication and no drift risk here.
• GraphNodeId::CompensationDelay { edge_id: Box<GraphEdgeId> } is correctly boxed to break the
  recursive type; it is not an unnecessary indirection.

[tamashi095]

Audit report — Boundaries and I/O: protocol, capi, hosts, source, flac sidecar (IO-*), part 1/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

IO — boundaries and I/O audit (protocol, capi, host-web, host-native, host-mobile, source, flac-decoder, target-smoke)

Scope measured (wc -l, current tree):

module	lines	inline #[cfg(test)] lines	library lines
crates/protocol/src/controller.rs	7,185	3,367	3,818
crates/protocol/src/message_wire.rs	5,993	1,931	4,062
crates/protocol/src/session_wire.rs	3,167	1,267	1,900
crates/protocol/src/queue.rs	1,645	384	1,261
crates/protocol/src/schema.rs	1,640	171	1,469
crates/protocol/src/typed_frame.rs	1,510	748	762
crates/protocol/src/model.rs	1,226	249	977
crates/protocol/src/btlv.rs	1,186	282	904
crates/protocol/src/wire.rs	1,109	250	859
crates/protocol/src/conformance.rs	487	0 (all fixture)	487
crates/protocol/src/lib.rs + bin	147	0	147
protocol total	25,625	8,649 (33.8 %)	16,976
crates/capi/src/ffi.rs	2,474	—	—
crates/capi/src/runtime/*	3,266 (of which tests.rs 1,827)	1,827	1,439
crates/capi/tests/resource_lifecycle.rs	2,349	—	—
hosts/host-web/src/lib.rs	2,956	—	—
hosts/host-web/src/tests.rs	4,668	—	—
hosts/host-web/src/ffi.rs	678	—	—
hosts/host-native/src/main.rs	30	—	—
hosts/host-mobile/src/lib.rs	26	—	—
crates/source/src/native_source.rs	4,273	~2,400	~1,870
crates/source/src/lib.rs	2,702	~840	~1,860
crates/source/src/native_wave.rs	1,597	~600	~1,000
sidecars/flac-decoder	869	—	—
crates/target-smoke/src/lib.rs	59	17	42

protocol carries 17 message IDs (crates/protocol/src/wire.rs:98-133). 25,625 lines / 17 messages ≈ 1,507 lines per message. IO-1 through IO-3 account for most of that.

---

IO-1: protocol ships its conformance corpus and a mock provider inside the library crate

• Category: crate-boundary
• Class: N/A (non-render)
• Severity: medium
• Location: crates/protocol/src/lib.rs:8 (mod conformance;), crates/protocol/src/lib.rs:74-77 (pub use conformance::{COMPLETE_SCHEMA_HASH, ConformanceDecoder, ConformanceFrame, complete_schema_corpus}), crates/protocol/src/conformance.rs:1-487, crates/protocol/src/controller.rs:618-810 (MockProviderConfig, MockProvider, impl ControlProvider for MockProvider), crates/protocol/src/session_wire.rs (complete_all_opcode_fixture, re-exported at crates/protocol/src/lib.rs:41); a real conformance crate already exists at crates/conformance/src/ (2,403 lines).
• Current code:

// crates/protocol/src/lib.rs
pub use conformance::{COMPLETE_SCHEMA_HASH, ConformanceDecoder, ConformanceFrame, complete_schema_corpus};
pub use controller::{ ... MockProvider, MockProviderConfig, ... };
pub use session_wire::{DecodedSessionTransaction, SessionTransactionFrame, complete_all_opcode_fixture};

// crates/protocol/src/conformance.rs:43-48
pub fn complete_schema_corpus() -> Vec<ConformanceFrame> {
    let codec = ProtocolCodec::default();
    let request = RequestId::new(1).expect("literal request ID");
    ...

• Problem: 487 lines of fixture-corpus construction plus ~200 lines of MockProvider/MockProviderConfig are compiled into every consumer of protocol (capi, tools/audit, tools/bench). They allocate Vec<ConformanceFrame> with a Vec<u8> per frame and exist only for the native/wasm parity gate. The workspace already has crates/conformance (its stated purpose: shared cross-tool fixtures), and the corpus is consumed by exactly two callers: crates/protocol/tests/conformance_corpus.rs and crates/protocol/src/bin/protocol_wasm_golden.rs. Both are inside this package and could take it from a [dev-dependencies]/[features]-gated module or from crates/conformance. Additionally 8,649 of 25,625 lines (33.8 %) are inline #[cfg(test)] mod tests blocks; controller.rs alone is 3,367 test lines inside a 7,185-line file, which is why the file resists splitting along real seams.
• Proposed change:
  1. Move conformance.rs and complete_all_opcode_fixture into crates/conformance as a protocol_corpus module (it may depend on protocol), and make src/bin/protocol_wasm_golden.rs a bin of conformance instead. Delete the three pub use lines from protocol/src/lib.rs.
  2. Gate MockProvider/MockProviderConfig behind #[cfg(any(test, feature = "test-support"))] — the pattern crates/source/Cargo.toml already uses (test-support feature). See IO-4 first: capi currently depends on MockProvider in production and must be fixed before this gate can be applied.
  3. Move the inline test modules of controller.rs, message_wire.rs and session_wire.rs to crates/protocol/tests/. That splits controller.rs 7,185 → 3,818 and message_wire.rs 5,993 → 4,062 without moving a line of logic.
• Expected effect: ~700 lines of fixture/mock code out of the shipped library; ~6,500 lines out of the three giant source files; protocol's library surface drops from 82 exported names to ~76.
• Rulings / constraints checked: No ruling covers this. AGENTS.md "the ceremony boundary" explicitly warns against evidence machinery colonising product code, which is this exact shape. Names stay unversioned/unprefixed per the naming rule.
• Verification gate: cargo test -p protocol, cargo test -p conformance, scripts/check-protocol-wasm-parity.sh, scripts/check-conformance-boundaries.sh, scripts/check-protocol-control-policy.sh.

---

IO-2: 42 hand-written encode entry points repeat an identical three-statement body

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/protocol/src/message_wire.rs:862-1980 (the impl ProtocolCodec block: 42 pub fn encode_*, 16 pub fn encoded_*_len, 27 pub fn decode_*); the duplicated one_spec!/values_spec! macros at crates/protocol/src/message_wire.rs:28-48 and crates/protocol/src/session_wire.rs:210-223.
• Current code:

// crates/protocol/src/message_wire.rs:914-941 — the shape repeated 23 times verbatim
pub fn encoded_capabilities_len(&self, value: &Capabilities<'_>) -> Result<usize, EncodeError> {
    let mut sink = CountSink::new(self.limits());
    write_capabilities(&mut sink, value)?;
    checked_sink_len(self, &mut sink)
}
pub fn encode_capabilities(&self, value: &Capabilities<'_>, output: &mut [u8]) -> Result<usize, EncodeError> {
    let required = self.encoded_capabilities_len(value)?;
    if output.len() < required { return Err(EncodeError::OutputTooSmall { required }); }
    let mut writer = SliceSink::new(output, self.limits());
    write_capabilities(&mut writer, value)?;
    checked_writer_len(&writer, required)
}
pub fn decode_capabilities<'a>(&self, payload: &'a [u8], count: u32) -> Result<DecodedCapabilities<'a>, DecodeError> {
    decode_capabilities(self, Message::top_level(payload, count, self.limits())?)
}

• Problem: Occurrence counts in message_wire.rs: SliceSink::new(output, self.limits()) × 23, CountSink::new × 20, return Err(EncodeError::OutputTooSmall { required }) × 23, Message::top_level(payload, count, self.limits())? × 23, against only 12 fn write_* bodies that actually differ. The variable part of each triple is one function name. That is roughly 23 × 14 ≈ 320 lines of pure boilerplate plus 23 × 3 ≈ 70 lines of decode preamble. one_spec!/values_spec! are byte-identical in two files (14 duplicated lines).
• Proposed change: In crates/protocol/src/btlv.rs, add

pub(crate) trait WirePayload {
    fn write<S: Sink>(&self, codec: &ProtocolCodec, sink: &mut S) -> Result<(), EncodeError>;
    const SPEC: &'static schema::MessageSpec;
}
impl ProtocolCodec {
    pub(crate) fn encoded_len<P: WirePayload>(&self, v: &P) -> Result<usize, EncodeError> { /* the CountSink body, once */ }
    pub(crate) fn encode_into<P: WirePayload>(&self, v: &P, out: &mut [u8]) -> Result<usize, EncodeError> { /* the SliceSink body, once */ }
    pub(crate) fn decode_top<'a>(&self, p: &'a [u8], n: u32, spec: &schema::MessageSpec) -> Result<Message<'a>, DecodeError> { /* once */ }
}

Keep the 42 public encode_* names as one-line #[inline] pub fn encode_capabilities(..) { self.encode_into(value, output) } shims so the frozen public surface and scripts/check-protocol-control-policy.sh are untouched. Move one_spec!/values_spec!/optional_spec!/write_spec! into btlv.rs with macro_rules! + pub(crate) use and delete the session_wire.rs copies.

• Expected effect: ~350 lines deleted from message_wire.rs; the "encode a new message" checklist drops from three functions to one impl WirePayload. Zero wire-byte change (the same write_* bodies run in the same order).
• Rulings / constraints checked: No ruling. docs/CONTROL_BTLV_V1.md "Codec and FFI ownership" requires exact-required-length reporting and no partial write on short output — preserved because the shared body is the current body.
• Verification gate: cargo test -p protocol, crates/protocol/tests/conformance_corpus.rs (frozen COMPLETE_SCHEMA_HASH = 0xbdeb_b0f8_1c38_ec42), scripts/check-protocol-wasm-parity.sh, scripts/run-protocol-fuzz.sh.

---

IO-3: the 17-message registry is spelled out in seven hand-maintained tables

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location:
  1. crates/protocol/src/wire.rs:98-165 — enum MessageId + MessageId::from_raw
  2. crates/protocol/src/typed_frame.rs:41-54 CommandPayload, :66-78 SuccessResponsePayload, :99-106 EventPayload, :116+ DecodedCommandPayload (+ DecodedSuccessResponsePayload, DecodedEventPayload) — 93 MessageId:: mentions in this one file
  3. crates/protocol/src/typed_frame.rs:394-... — the decode match header.message_id arms
  4. crates/protocol/src/controller.rs:1036-1080 — enum ControlCommand + ControlCommand::message_id()
  5. crates/protocol/src/controller.rs:2340-2402 — the encode_success! match (message_id, body) (58 MessageId:: mentions in this file)
  6. crates/protocol/src/schema.rs:259-... — one pub(crate) mod <message> { … static SPEC: MessageSpec } per message
  7. crates/protocol/src/conformance.rs:43-487 — the corpus, one command!/success!/event! invocation per message
• Current code:

// controller.rs:2373-2379 — table 5, one arm per message, mechanically derivable from tables 1+2
(MessageId::ParameterMetadataGet, Body::ParameterMetadata(value)) => {
    encode_success!(SuccessResponsePayload::ParameterMetadata(value))
}
(MessageId::ParameterStateGet, Body::ParameterState(value)) => {
    encode_success!(SuccessResponsePayload::ParameterState(value))
}

• Problem: Adding one message requires seven coordinated edits in four files, and the only thing holding them together is a test (parameter_enum_wire_mappings_are_exhaustive_and_roundtrip, referenced at message_wire.rs:207). Tables 2, 3, 4 and 5 carry no information that tables 1 and 6 do not.
• Proposed change: Add to crates/protocol/src/schema.rs a single declarative table and a macro that emits tables 1-5 from it:

messages! {
    CapabilitiesGet          = 0x0001, cmd  CapabilitiesGet,           resp Capabilities,          spec capabilities_request::SPEC / capabilities::SPEC;
    SessionSnapshotGet       = 0x0002, cmd  SessionSnapshotGet(SessionSnapshotRequest), resp SessionSnapshot, spec snapshot_request::SPEC / snapshot::SPEC;
    ...
    Diagnostic               = 0x8030, event Diagnostic(&'a Diagnostic), spec diagnostic::SPEC;
}

The macro generates MessageId + from_raw, the three payload enums and their Decoded* twins, message_id(), and the (message_id, body) dispatch. Table 6 (the SPEC statics) stays hand-written — it is the schema. Table 7 moves out with IO-1.

• Expected effect: ~600-900 lines removed across wire.rs, typed_frame.rs and controller.rs; "add a message" drops from seven edits to two (a messages! row and a SPEC module). Same bytes on the wire.
• Rulings / constraints checked: No ruling. The frozen-ID contract in docs/CONTROL_BTLV_V1.md "Compatibility" is strengthened: IDs, kinds and specs become one literal instead of four.
• Verification gate: cargo test -p protocol, crates/protocol/tests/conformance_corpus.rs hash, scripts/check-protocol-control-policy.sh, scripts/check-conformance-boundaries.sh.

---

IO-4: the shipped C ABI instantiates protocol::MockProvider as its production control provider

• Category: architecture
• Class: N/A (non-render)
• Severity: high
• Location: crates/capi/src/runtime/compile.rs:485-508, crates/capi/src/runtime/control.rs:196-208, crates/capi/src/runtime/mod.rs:35; the type's own doc at crates/protocol/src/controller.rs:637-639.
• Current code:

// crates/protocol/src/controller.rs:637-639
/// Small deterministic provider suitable for protocol conformance fixtures.
#[derive(Clone, Debug)]
pub struct MockProvider {

// crates/capi/src/runtime/compile.rs:485-508
let provider = MockProvider::try_with_retained_capacity_and_automation(
    retained_capacity,
    protocol::ParameterDescriptor {
        handle: u32::MAX,
        track_id: "capi".to_owned(),
        rack: protocol::ParameterRack::Dynamic,
        effect_id: "control".to_owned(),
        parameter_id: 1,
        ...

// crates/capi/src/runtime/control.rs:196
pub(crate) inner: ProtocolController<MockProvider>,

• Problem: capi is the production native/mobile ABI. Its ControlProvider — the thing that answers PARAMETER_METADATA_GET, PARAMETER_STATE_GET, COUNTERS_GET, DIAGNOSTICS_GET, TRANSPORT_GET, TRANSPORT_SET and validates AUTOMATION_ENQUEUE domains — is a fixture type whose catalog is empty except for one synthetic descriptor addressed to a nonexistent track "capi" / effect "control" at handle u32::MAX. docs/CONTROL_PROVIDER_BOUNDARY.md says "A provider offers typed bounded capabilities, parameter pages/state/descriptor lookup, counters, diagnostics, absolute transport get/set … and endpoint current sample"; none of those answers is derived from the compiled session on the C ABI today. crates/capi/src/runtime/compile.rs:160-168 even budgets memory for the mock's strings (// The automation-only descriptor is inline in the provider; charge its two strings. / checked_layout::<u8>(4)? / checked_layout::<u8>(7)? — the byte lengths of "capi" and "control").
• Proposed change: Add crates/host-core/src/control_provider.rs with a SessionControlProvider that implements protocol::ControlProvider from a &CompiledSession + the live PreparedRenderPlan handle: the parameter catalog walks graph's prepared effect descriptors (the same walk tools/parameter-metadata already does for the browser metadata asset), current_sample reads plan.next_absolute_sample(), transport reads the host's transport state, counters/diagnostics read the existing RenderDiagnosticSlots. Change crates/capi/src/runtime/control.rs:196 to ProtocolController<host_core::SessionControlProvider>. Then apply IO-1 item 2 and feature-gate MockProvider.
• Expected effect: The C ABI's control plane answers from the session instead of a fixture. Enables IO-1's test-support gate. This is a prerequisite for IO-5.
• Rulings / constraints checked: No ruling. docs/CONTROL_PROVIDER_BOUNDARY.md is the normative contract and is currently unmet on this transport. All work is control-plane; no render bit moves.
• Verification gate: cargo test -p capi, crates/capi/tests/resource_lifecycle.rs (the retained-byte projections change and must be re-derived), scripts/check-capi-abi.sh, scripts/check-abi-layout-v1.py, docs/C_ABI_V1_QUALIFICATION.md evidence refresh.

---

IO-5: the accepted-automation queue has no render-side drain; two disconnected automation models exist

• Category: architecture
• Class: N/A (non-render)
• Severity: high
• Location: producer/validator crates/protocol/src/queue.rs:196-283 + :804-836 + :1098-1211; the only consumer crates/protocol/src/controller.rs:3643-3675 (cancellation). The actual render automation path is crates/effect-contract/src/live.rs:44-90 (EffectControlRecord) and :184-262 (EffectControlLane::stage), fed only from hosts/host-web/src/lib.rs:1878-1916.
• Current code:

// crates/protocol/src/controller.rs:3663-3667 — the ONLY dequeue outside tests
let batch = match self.queues.try_dequeue_automation() {
    Ok(batch) => batch,
    Err(_) => unreachable!("reservation and control-side cancellation are exclusive"),
};

// crates/effect-contract/src/live.rs:19-22 — the frozen rule of the path that DOES render
// A drained record takes effect at the **first sample of the next rendered block** …
// emits `AutomationSpanKind::Point` spans whose `start_sample` and `end_sample` are that
// block's `first_sample`.

• Problem: Grepping AutomationBatchSlot / AutomationRecord across crates/engine, crates/graph, crates/host-core, hosts/ returns nothing outside crates/capi/{tests,src/runtime/tests}.rs. The 32-byte record carries start, end, Step/Linear/Exponential kinds and a per-block density budget (docs/CONTROL_PROTOCOL_SIZING.md, "For the mandated 10,000-record fixture, ceil(10000/256) = 40") — all of it validated, stored, density-accounted, and then only ever cancelled. Meanwhile the path that reaches an effect (EffectControlRecord::Parameter) carries no sample time at all and is produced only by the wasm host. So the engine has two automation models: a sample-accurate one nothing renders, and a block-boundary one only the browser can drive. This is why capi needed IO-4's mock: there is no real endpoint for the queue to serve.
• Proposed change: Pick one and delete the other's dead half.
  • Preferred: make the protocol queue the source of truth. Add a render-side drain in crates/host-core: fn drain_automation(&mut self, queues: &mut ProtocolQueues, first_sample: u64, frames: u32) that pops batches whose start falls in [first_sample, first_sample + frames) and lowers each AutomationRecord to a PreparedAutomationSpan on the addressed instance's EffectControlLane, keeping the existing stage() staging window. The queue is already sorted by (start, handle) and density-bounded per block (queue.rs:1116-1128), so the drain is a bounded head-scan with no sort and no search: pop while head.start < block_end. Handle→(effect slot, parameter_index, channel) resolution is plan-invariant and belongs in the PreparedRenderPlan as a dense Box<[(u32,u32,ParameterChannel)]> built at prepare.
  • Or: if sample-accurate automation is out of scope for launch, delete AutomationKind::{Step,Linear,Exponential}, the density/interval tables (queue.rs:648-663, :1143-1211) and AUTOMATION_ENQUEUE entirely, and say so in docs/CONTROL_PROTOCOL_SIZING.md. That removes ~600 lines and the whole of IO-6.
• Expected effect: Either the C ABI gains sample-accurate automation, or ~600 lines of validated-but-unreachable queue machinery leaves the tree. Today neither is true.
• Rulings / constraints checked: The #139/#140 "acked batch" invariant is intact today (see Things I checked that are fine), and the preferred design preserves it: the ack is still emitted only after try_push returns Ok. AGENTS.md render rules are respected — the drain is bounded by the per-block density budget, allocates nothing, and reuses the existing preallocated staging window.
• Verification gate: cargo test -p protocol, cargo test -p host-core, scripts/check-realtime-policy.sh, scripts/run-protocol-allocation-audit.sh, plus a new eval booting the mandated 10,000-record fixture and asserting the rendered PCM changes at the declared samples.

---

IO-6: automation admission is O(records × queued_records) and validates every batch twice

• Category: perf
• Class: N/A (non-render, control thread)
• Severity: medium
• Location: crates/protocol/src/queue.rs:243-278 (validate_records), :232 and :1103 (the two call sites), :1098-1140 (validate_automation_admission), :1143-1148 (density_for_block), :1218-1231 (automation_records_overlap).
• Current code:

// queue.rs:1113-1140
for record in records {
    if self.automation_intervals.iter().any(|entry| {          // O(slots * 256) linear scan
        entry.occupied && entry.record.handle == record.handle
            && automation_records_overlap(entry.record, *record)
    }) { return Err(AutomationBatchError::Overlap); }
    let block = record.start.0 / u64::try_from(self.config.quantum_frames.get()).unwrap_or(u64::MAX);
    let density = self.density_for_block(block).saturating_add(  // another O(slots * 256) scan
        records.iter().filter(|candidate| {                      // and a rescan of the batch
            candidate.start.0 / u64::try_from(self.config.quantum_frames.get()).unwrap_or(u64::MAX) == block
        }).count(),
    );
    if density > self.config.per_block_automation_density.get() { return Err(AutomationBatchError::DensityExceeded); }
}

• Problem: With the sizing doc's mandated 40 automation slots, automation_density and automation_intervals are each 40 * 256 = 10,240 entries (queue.rs:743-747). Per 256-record batch admission that is 256 * (10,240 + 10,240 + 256) ≈ 5.3 M iterations, each with a 64-bit division inside, and the 10,000-record fixture is 40 such batches ≈ 210 M iterations. Separately, validate_records is O(n²) over the batch (256²/2 = 32,640 pairwise comparisons, queue.rs:259-276) and is run twice per batch: once in AutomationBatchSlot::new (:232) and again from validate_automation_admission (:1103). And queue.rs:262-275 inlines a third copy of the exact predicate that automation_records_overlap (:1218-1231) already implements.
• Proposed change: In crates/protocol/src/queue.rs:
  1. Delete the batch.validate_records()? at :1103. AutomationBatchSlot is only constructible through new (:212), which already validated; the fields are pub but records/len are Copy and the type is never mutated after construction. If the redundancy is deliberate, make it debug_assert!(batch.validate_records().is_ok()).
  2. Replace the inline overlap block at :262-275 with if automation_records_overlap(*left, *right) { return Err(AutomationBatchError::Overlap); }.
  3. Hoist let quantum = u64::try_from(self.config.quantum_frames.get()).unwrap_or(u64::MAX); and let block_of = |s: SampleTime| s.0 / quantum; out of the per-record loop (one division per record instead of 1 + records.len()).
  4. Replace the two linear scans with the fact that records are already sorted by (start, handle): keep automation_density as a ring indexed by block % density_entries (blocks are monotone because automation_frontier forbids going backwards, :1105-1109), and keep automation_intervals as a per-handle last-end map sized by the same budget. Both become O(1) per record.
  5. Compute the in-batch per-block start counts in one forward pass before the loop (the batch is sorted by start, so blocks are contiguous runs).
• Expected effect: admission drops from ~5.3 M iterations to ~1 K per 256-record batch; the 10,000-record fixture drops from ~210 M to ~40 K. Deletes ~15 lines. Same acceptance/rejection decisions.
• Rulings / constraints checked: No ruling. docs/CONTROL_PROTOCOL_SIZING.md "Admission sequence" step 4 requires the density budget to be checked before mutation — preserved; only the data structure changes. Do this only if IO-5 keeps the queue.
• Verification gate: cargo test -p protocol queue, scripts/run-protocol-benchmark.sh (descriptive), scripts/run-protocol-fuzz.sh, and the 10,000-record fixture named in docs/CONTROL_PROTOCOL_SIZING.md.

---

IO-7: host-web zeroes the whole (3T + E)-entry in-flight table on the render thread every block

• Category: perf
• Class: A (bit-identical — the table is control-plane accounting only)
• Severity: high
• Location: hosts/host-web/src/lib.rs:1244; the table at :573 and :2810; its size at :2751-2754; its writers at :2172 and :2186.
• Current code:

// hosts/host-web/src/lib.rs:1238-1245 — inside render_next(), the AudioWorklet process() path
match result {
    Ok(report) => {
        self.status.next_absolute_sample = report.next_absolute_sample;
        self.status.rendered_quanta = self.status.rendered_quanta.saturating_add(1);
        // Issue #137 D1: the matrix stage drained every control queue at the top of this
        // block, so the exact free-slot count is the whole capacity again.
        ready.in_flight.fill(0);

// hosts/host-web/src/lib.rs:2751-2754
let queue_count = track_count
    .checked_mul(3)
    .and_then(|value| value.checked_add(total_effects as usize))

• Problem: in_flight is Box<[u32]> of length 3 * track_count + total_effects. The fill(0) runs unconditionally on every successful render, whether or not a single command was submitted. For a 200-track session with 800 effects that is 1,400 u32 = 5.6 KB memset per block; at a 128-frame quantum and 48 kHz that is 375 blocks/s ≈ 2.1 MB/s of stores on the render thread, and it grows linearly with the track count the product principle says must be unbounded. In the overwhelmingly common case the table is already all-zero (no commands were submitted since the last render), so every one of those stores is dead.
• Proposed change: In hosts/host-web/src/lib.rs, add one field to ReadyOwnership beside in_flight:

/// Nonzero exactly when some entry of `in_flight` is nonzero, so the block-boundary reset is
/// one predicted branch for a session that submitted no commands.
in_flight_dirty: bool,

Set ready.in_flight_dirty = true; in admit_commands where ready.in_flight[slot] += 1; runs (:2186), and change :1244 to:

if ready.in_flight_dirty {
    ready.in_flight.fill(0);
    ready.in_flight_dirty = false;
}

in_flight_dirty is a plain bool on a single-threaded host, so no atomic and no allocation. The fill(0) is preserved verbatim on the blocks that need it.

• Expected effect: 3T + E stores per block become one load and one predicted branch on every block that admitted no command. At 200 tracks / 800 effects: 5.6 KB → 1 byte per block. No rendered bit moves — in_flight is read only by admit_commands (:2172, :2186), never by a DSP stage.
• Rulings / constraints checked: No ruling covers this. It is class A by construction (control-plane accounting, no signal path). It respects the MAX_TRACKS ban — it removes a per-track render cost rather than capping tracks. The check-web-audioworklet-callgraph.py gate bans panic edges in the render export; a bool read and a fill add none.
• Verification gate: cargo test -p host-web, scripts/check-web-audioworklet.sh, scripts/check-web-audioworklet-callgraph.py, scripts/test-web-audioworklet.mjs (command backpressure evals E3/E4 are the ones that would catch a stale in_flight), then re-pin hosts/host-web/web/miso-engine-v1-audio-worklet-artifact.sha256 via MISO_ENGINE_WEB_AUDIOWORKLET_REPIN=1 scripts/build-web-audioworklet.sh.

---

IO-8: two scalar master-peak folds, one per host, neither lane-generic

• Category: dry
• Class: A (bit-identical — max over non-NaN f32 is associative and commutative, and both folds already discard NaN)
• Severity: medium
• Location: crates/capi/src/ffi.rs:823-837 and hosts/host-web/src/lib.rs:1252-1269.
• Current code:

// crates/capi/src/ffi.rs:823-836
let peak = if state.render_peak_observed() {
    let mut peak = 0.0_f32;
    for channel in 0..2_usize {
        let plane = channel * stride;
        for frame in 0..frames {
            // SAFETY: The validated two-plane layout proves this exact sample index is
            // initialized and readable after the exclusive render borrow ended.
            let sample = unsafe { *samples_pointer.add(plane + frame) };
            peak = peak.max(sample.abs());
        }
    }
    peak
} else { f32::NAN };

// hosts/host-web/src/lib.rs:1252-1269
let mut peaks = ready.master_peak;
for (plane, peak) in peaks.iter_mut().enumerate() {
    let start = plane * quantum;
    let Some(samples) = buffers.output_pcm.get(start..).and_then(|tail| tail.get(..quantum)) else { break };
    for sample in samples { let magnitude = sample.abs(); if magnitude > *peak { *peak = magnitude; } }
}
ready.master_peak = peaks;

• Problem: The same reduction — max of |x| over two planes of one quantum — is written twice, in two crates, both scalar, both on the render thread. At a 256-frame quantum that is 512 scalar loads + 512 abs + 512 max per block per host. crates/lane exists precisely to make this one lane-generic block kernel, and the capi copy additionally uses raw-pointer arithmetic inside unsafe at the ABI boundary to re-read memory the render just wrote. The two also disagree in shape (capi resets per block and returns; host-web accumulates into master_peak across a window) and in NaN comparison operator (f32::max vs >), which is a latent divergence between the native and browser meter readings of the same session.
• Proposed change: Add to crates/host-core (it already owns the host callback contract and both hosts depend on it):

/// Fold `max(|x|)` over one planar stereo block into a running per-plane accumulator.
/// Lane-generic; reduction order is a max-tree, which is exact for f32 max.
pub fn fold_planar_peak(block: engine::realtime::PlanarBuffer<'_>, into: &mut [f32; 2]);

implemented over lane::Lane with the existing Lane::max/Lane::abs block form and a scalar tail, marked #[inline(always)]. capi calls it with into = &mut [0.0, 0.0] and publishes into[0].max(into[1]); host-web calls it with into = &mut ready.master_peak. The capi unsafe re-read disappears — PlanarBufferMut can hand back a PlanarBuffer reborrow after render returns.

• Expected effect: ~30 lines deleted; the scalar loop becomes quantum/W vector max operations (64 vs 512 at W8/quantum 256, 128 at W4); one unsafe block removed from crates/capi/src/ffi.rs; native and browser meters provably agree.
• Rulings / constraints checked: docs/rulings/simd-wrapper-around-scalar-inner-loop.md rejects wrapping a scalar inner loop in a bank-shaped API; this is the opposite — the inner loop becomes genuinely lane-wide. This is metering, not signal: the rendered PCM is untouched, so docs/rulings/unfused-multiply-add-audit.md does not apply. max is exact in f32 (no rounding), so reduction-order change is bit-identical for non-NaN inputs, and abs() never produces NaN from a finite sample.
• Verification gate: cargo test -p capi, cargo test -p host-core, cargo test -p host-web, scripts/check-realtime-policy.sh (the new unsafe count must go down, not up), scripts/test-web-audioworklet.mjs meter evals, and an added test asserting the native and wasm folds agree bit-for-bit on a fixture block.

---

IO-9: issue #292 — console track IDs are read through the source-ID buffer, which is sized only for source IDs

• Category: architecture
• Class: N/A (non-render, boot path)
• Severity: high
• Location: sizing crates/host-core/src/shape.rs:26-28 and :58-66; consumption hosts/host-web/src/lib.rs:832, :2372, :2407, :2427, :2444-2448; the defective read hosts/host-web/src/lib.rs:1091-1109; its twin :1113-1132; the export hosts/host-web/src/ffi.rs:492-500.
• Current code:

// crates/host-core/src/shape.rs:26-28
    /// Longest declared source ID in bytes, or zero when there are no sources.
    pub longest_source_id_bytes: u64,

// hosts/host-web/src/lib.rs:1091-1109
pub(crate) fn copy_console_track_id(&mut self, index: u32) -> u32 {
    let Some(ready) = self.ready.as_ref() else { return 0 };
    let Some(id) = ready.tracks.get(index as usize) else { return 0 };
    let bytes = id.as_bytes();
    let length = bytes.len();
    let Some(buffers) = self.buffers.as_mut() else { return 0 };
    let Some(target) = buffers.source_id.get_mut(..length) else { return 0 };   // <- silent 0
    target.copy_from_slice(bytes);
    u32::try_from(length).unwrap_or(0)
}

• Problem: buffers.source_id is allocated at hosts/host-web/src/lib.rs:2444-2448 with exactly report.source_id_bytes = shape.longest_source_id_bytes bytes. A track ID longer than every source ID makes get_mut(..length) return None, the export returns 0, and the JS bindConsole reports RESULT_INTERNAL (255) with no diagnostic — a document-shape-dependent failure surfaced as an internal error, which the engine's own rule forbids. There is a second, quieter defect: the doc comment at :1113-1115 claims compile_ready refuses web.source.id.capacity for oversized source IDs, but that diagnostic string does not exist anywhere in the tree; the guarantee is vacuous only because the buffer is sized as the max over sources. Also copy_console_track_id and copy_session_source_id are 17-line near-duplicates differing only in which list they index.
• Proposed change:
  1. crates/host-core/src/shape.rs: add pub longest_track_id_bytes: u64 to HostSessionShape and populate it in compiled_session_shape with the same count(...) helper over model.tracks.iter().map(|t| t.id.as_str().len()).max().unwrap_or(0).
  2. hosts/host-web/src/lib.rs:826-833: pass shape.longest_source_id_bytes.max(shape.longest_track_id_bytes) into project_buffers, and rename that parameter and the WebResourceReport field from source_id_bytes to id_staging_bytes (an ABI field rename needs the layout re-pin; keep the wire offset).
  3. Collapse copy_console_track_id/copy_session_source_id into one fn copy_id_into_staging(&mut self, bytes: &[u8]) -> u32 plus two three-line lookups, and make the over-capacity branch impossible rather than silent: with (1) it cannot be reached, so debug_assert! it and keep returning 0 only for "no such index".
  4. The app-side guard assertTrackIdsFitSourceIdBuffer shipped in App integration + launch E2E: SDK boot + store adoption, MSF/MDC1 deletion, full-app gate (#239 Phase 5) #246 becomes dead and should be removed in the same change.
• Expected effect: every session whose track IDs are longer than its source IDs boots; the failure mode for any future over-capacity ID becomes a typed compile refusal instead of RESULT_INTERNAL; ~15 duplicated lines deleted.
• Rulings / constraints checked: No ruling. Matches the issue's stated eval shape.
• Verification gate: the eval named in console track ids are read through the source-id buffer — silent RESULT_INTERNAL when a track id outsizes every source id #292 — boot a session whose track IDs are strictly longer than all source IDs and assert it boots; plus cargo test -p host-web, cargo test -p host-core, scripts/check-web-audioworklet.sh, scripts/check-browser-expected-resources.py (the resource row changes), and the artifact re-pin.

---

IO-10: the two ABIs' RESULT_* spaces diverge at two values, with nothing asserting the divergence and two ungenerated JS copies

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/capi/src/abi.rs:11-29, hosts/host-web/src/lib.rs:69-100, sidecars/flac-decoder/src/lib.rs:23-39; JS copies at hosts/host-web/web/miso-engine-v1-audio-worklet.js:5-10, hosts/host-web/web/miso-engine-v1-audio-worklet-host.js:1-5, and the shipped sdk/dist/assets/flac-decoder.js:7.
• Current code:

// crates/capi/src/abi.rs:11-29        // hosts/host-web/src/lib.rs:69-100      // sidecars/flac-decoder/src/lib.rs:23-39
RESULT_OK               = 0;          RESULT_OK               = 0;             RESULT_OK                    = 0;
RESULT_INVALID_ARGUMENT = 1;          RESULT_INVALID_ARGUMENT = 1;             RESULT_END                   = 1;
RESULT_ABI_MISMATCH     = 2;          RESULT_ABI_MISMATCH     = 2;             RESULT_INVALID_ARGUMENT      = 2;
RESULT_WRONG_HANDLE     = 3;          RESULT_WRONG_STATE      = 3;             RESULT_DECODE_REFUSED        = 3;
RESULT_BUFFER_TOO_SMALL = 4;          RESULT_BUFFER_TOO_SMALL = 4;             RESULT_BIT_DEPTH_UNSUPPORTED = 4;
RESULT_COMPILE_REJECTED = 5;          RESULT_REFUSED_BUDGET   = 5;             RESULT_SHAPE_MISMATCH        = 5;
RESULT_BACKPRESSURE     = 6;          RESULT_BACKPRESSURE     = 6;             RESULT_RESOURCE_LIMIT        = 6;
RESULT_UNSUPPORTED      = 7;          RESULT_UNSUPPORTED      = 7;             RESULT_OUTPUT_WRITE          = 7;
RESULT_RENDER_REJECTED  = 8;          RESULT_RENDER_REJECTED  = 8;
RESULT_INTERNAL         = 255;        RESULT_REPREPARE_REQUIRED = 9;           RESULT_INTERNAL              = 255;
                                      RESULT_INTERNAL         = 255;

• Problem: capi and host-web agree on eight of eleven codes and disagree on 3 and 5 — the same integer means WRONG_HANDLE/COMPILE_REJECTED natively and WRONG_STATE/REFUSED_BUDGET in the browser. One SDK (sdk/) already ships both the worklet and the FLAC decoder, whose code 1 is RESULT_END rather than RESULT_INVALID_ARGUMENT. The sdk/src/generated/ chain is regenerated and gated by scripts/check-sdk-generated.sh, but the two hand-written JS copies (miso-engine-v1-audio-worklet.js:5-10, -host.js:1-5) are not generated at all — VALID_RESULTS = new Set([0,…,9,255]) in -host.js:5 is a hand-maintained fourth copy.

  The same shape recurs one layer down for the launch sample-rate set, which is declared three times: engine::LAUNCH_SAMPLE_RATES (crates/engine/src/lib.rs:36-41, the authority, with is_launch_sample_rate at :62-65), host_core::LAUNCH_SAMPLE_RATES_HZ (crates/host-core/src/prepare.rs:36, a [u32; 4] restatement whose only consumers are crates/host-core/tests/prepare.rs:388-410 — a public API item used by nothing but its own tests), and capi::abi::RATE_44_100..RATE_96_000 + EXACT_LAUNCH_RATE_MASK (crates/capi/src/abi.rs:41-50, a bitmask whose only assertion is assert_eq!(EXACT_LAUNCH_RATE_MASK, 0x0f) at :469 — nothing cross-checks it against engine::LAUNCH_SAMPLE_RATES). Delete host_core::LAUNCH_SAMPLE_RATES_HZ outright and derive EXACT_LAUNCH_RATE_MASK from engine::LAUNCH_SAMPLE_RATES in a const fn so the bitmask cannot disagree with the set.

• The repo's stated reason, and why it does not close the finding. crates/host-core/src/diagnostics.rs:19-21 says exactly why there is no shared table: "Hosts map this onto their own result codes; the facade never defines result codes because the C ABI and the browser ABI number them differently (issue 022 vs issue 024)." I accept that: the two ABIs are separately versioned and separately frozen, and hoisting one enum into host-core would couple two release surfaces that are deliberately independent. So do not unify the spaces. What that reasoning does not cover is (a) that the divergence at 3 and 5 is asserted by nothing — crates/capi/src/abi.rs:469 only checks EXACT_LAUNCH_RATE_MASK == 0x0f, and no test anywhere states that codes 3 and 5 are intended to differ, so a future editor "fixing" one to match the other would pass every gate; (b) that the same shared PrepareRejection is projected inconsistently — hosts/host-web/src/lib.rs:2318-2326 maps PrepareRejection::{Resource,Platform} to RESULT_REFUSED_BUDGET and everything else to RESULT_REFUSED_DOCUMENT, while crates/capi/src/runtime/compile.rs:368-380 never inspects PrepareRejection at all and collapses every prepare failure into RESULT_COMPILE_REJECTED, so a budget refusal is a budget refusal in the browser and a compile refusal natively; and (c) that the two JS constant blocks are hand-copied while the TypeScript beside them is generated and gated.

• Proposed change: Three narrow changes, none of which renumbers a frozen code.

  1. Add a cross-crate test (in crates/capi/tests/) that names the deliberate divergences explicitly: assert_ne!(capi::RESULT_WRONG_HANDLE_MEANING, host_web::RESULT_WRONG_STATE_MEANING) is not expressible, so instead assert the intended table as data — a const EXPECTED: [(u32, &str); 11] per ABI with a comment pointing at issues 022/024 — so that changing either code is a deliberate edit to a stated table rather than an invisible one.
  2. Make capi project PrepareRejection the way host-web does: map PrepareRejection::{Resource, Platform} to a budget-shaped code rather than collapsing to RESULT_COMPILE_REJECTED. capi has no REFUSED_BUDGET slot today, so this either reuses RESULT_UNSUPPORTED/adds code 9, or — if no ABI value may be added before launch — is recorded as a known asymmetry in docs/C_ABI_V1_QUALIFICATION.md. The current state, where capi silently discards a classification host-core computes specifically so hosts can use it, is the defect.
  3. Extend scripts/check-sdk-generated.sh (whose header already describes the Rust constants → parameter-metadata → sdk/assets/*.json → sdk/src/generated/*.ts chain) to also derive the constant blocks in hosts/host-web/web/miso-engine-v1-audio-worklet.js:1-25 and -host.js:1-5, including VALID_RESULTS. Today a hand edit at that layer is the one link in the chain nothing checks.
     sidecars/flac-decoder keeps its own space — it is a separate artifact with a separate ABI version — but its overlap with 1..=9 should be called out in docs/FLAC_DELIVERY_V1.md since sdk/dist/assets/ ships both modules to the same consumer.

• Expected effect: no ABI value changes; the two deliberate divergences become testable statements instead of accidents; capi stops discarding a classification it is handed; the last ungenerated link in the SDK constant chain is closed.

• Rulings / constraints checked: crates/host-core/src/diagnostics.rs:19-21 is the standing decision against a shared table and is respected — this proposal does not create one. docs/C_ABI_V1_QUALIFICATION.md and the worklet artifact pin are untouched by items 1 and 3; item 2 touches the C ABI's observable behaviour and needs an owner ruling before it ships.

• Verification gate: scripts/check-capi-abi.sh, scripts/check-abi-layout-v1.py, scripts/check-sdk-generated.sh (extended), scripts/check-web-audioworklet.sh, scripts/check-flac-decoder.sh, cargo test -p capi, cargo test -p host-web.

---

IO-11: the parameter vocabulary is declared three times and the automation-kind enum twice

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location:
  • ParameterUnit: crates/effect-contract/src/lib.rs:133, crates/session/src/model.rs:341-357, crates/protocol/src/message_wire.rs:222-233
  • ParameterChannel: crates/effect-contract/src/lib.rs:137, crates/session/src/model.rs:327-338, crates/protocol/src/message_wire.rs:212-221
  • ParameterDomain: crates/effect-contract/src/lib.rs:134, crates/protocol/src/message_wire.rs:183-189, and effect_runtime::ParameterKind at crates/effect-runtime/src/params.rs:37-45
  • ParameterMapping: crates/effect-contract/src/lib.rs:135, crates/protocol/src/message_wire.rs:234-243, crates/effect-runtime/src/params.rs:26-33
  • AutomationRate: crates/effect-contract/src/lib.rs:136, crates/protocol/src/message_wire.rs:244-250
  • AutomationSpanKind/AutomationKind: crates/effect-contract/src/lib.rs:141-142, crates/protocol/src/queue.rs:30-42
  • the bridging conversions: crates/protocol/src/message_wire.rs:252-350 and crates/protocol/src/schema.rs:8-80
• Current code:

// crates/effect-contract/src/lib.rs:133-141
scalar_enum!(ParameterUnit {Db=1,Hz=2,Milliseconds=3,Samples=4,Linear=5,Ratio=6});
scalar_enum!(ParameterDomain {Continuous=1,Boolean=2,Enumeration=3});
scalar_enum!(ParameterMapping {Linear=1,Logarithmic=2,Exponential=3,Stepped=4});
scalar_enum!(AutomationRate {Sample=1,Block=2,None=3});
scalar_enum!(ParameterChannel {Left=1,Right=2,Both=3});
scalar_enum!(AutomationSpanKind {Point=1,Step=2,Linear=3,Exponential=4});
pub type AutomationKind = AutomationSpanKind;

// crates/protocol/src/queue.rs:33-42 — same name, same discriminants, different crate
#[repr(u8)]
pub enum AutomationKind { Point = 1, Step = 2, Linear = 3, Exponential = 4 }

• Problem: Six vocabularies, each declared 2-3 times with the same members and the same discriminants, plus crates/protocol/src/message_wire.rs:252-350 (~100 lines of From impls) and crates/protocol/src/schema.rs:8-80 (~72 lines of *_wire/*_from_wire const fns) whose only job is to convert between the copies. The comment at message_wire.rs:207 names the single test that holds them together (parameter_enum_wire_mappings_are_exhaustive_and_roundtrip) — a test is the only thing preventing a silent divergence between three enums that must always agree. protocol::AutomationKind and effect_contract::AutomationKind even share a name.
• Proposed change: Make crates/effect-contract the sole owner of the parameter vocabulary — it already is the semantic authority (ParameterDescriptor, ParameterChannelPolicy, parameter_value_valid at crates/effect-contract/src/lib.rs:487-492) and every consumer depends on it. protocol re-exports effect_contract::{ParameterUnit, ParameterDomain, ParameterMapping, AutomationRate, ParameterChannel, AutomationSpanKind} and deletes its own copies plus the From impls; schema.rs's *_wire/*_from_wire become as u8 / from_raw, since the scalar_enum! discriminants already match the wire values exactly. session's closed_tokens! variants carry a string token in addition, so they stay but should be generated from the contract enum by a macro that takes the token string, guaranteeing member parity by construction. effect_runtime::{ParameterMapping, ParameterKind} (crates/effect-runtime/src/params.rs:26-45) is a deliberately reduced no_std subset — leave it, but add a compile-time assertion that its variants are a subset.
• Expected effect: ~180 lines of conversion code and ~60 lines of enum declarations deleted from protocol; three sources of truth become one; the parity test becomes unnecessary rather than load-bearing.
• Rulings / constraints checked: docs/rulings/de-versioning-inventory.md and docs/rulings/prefix-strip-inventory.md govern naming, not ownership; nothing here renames a wire tag. docs/CONTROL_BTLV_V1.md "Compatibility" freezes the numeric values, which are preserved exactly. protocol already depends on session; adding an effect-contract dependency is a new edge — check it does not create a cycle (effect-contract depends on engine and lane only, so it does not).
• Verification gate: cargo test -p protocol, cargo test -p effect-contract, cargo test -p session, crates/protocol/tests/conformance_corpus.rs hash, scripts/check-effect-contract.sh, scripts/check-parameter-metadata-v1.py.

---

IO-12: the native decode worker memcpys a whole planar quantum into the ring slot it could have decoded into

• Category: perf
• Class: A (bit-identical — a pure copy_from_slice of identically laid-out f32 planar data)
• Severity: medium
• Location: crates/source/src/native_source.rs:1007-1014 (the staging allocation), :1687-1698 (decode into staging), :1635-1642 (submit from staging); crates/source/src/lib.rs:923-948 (submit_native_planar), :849-854 (the copy loop); the budget row crates/source/src/native_source.rs:1411-1416.
• Current code:

// crates/source/src/native_source.rs:1690-1695
let frames = job.planar_staging.len() / channels;
let decoded = job.decoder.decode_planar(&mut job.planar_staging, frames)
    .map_err(NativeSourceWorkerExit::DecodeFailed)?;

// crates/source/src/lib.rs:944-947 — chunks_exact over the staging, then …
self.producer.submit_planes(generation, start_frame, frames, end_of_region,
    native_decoder_sanitized_samples, planar_quantum.chunks_exact(quantum))

// crates/source/src/lib.rs:849-854 — … a straight memcpy into the ring slot
for (channel, plane) in planes.enumerate() {
    let offset = channel.checked_mul(quantum).expect("prepared channel offset");
    block.samples[offset..offset + frames].copy_from_slice(&plane[..frames]);
}

• Problem: File bytes reach the render buffer in four steps: (1) read_exact into NativeWaveDecoder::scratch (interleaved source bytes, crates/source/src/native_wave.rs:416); (2) decode_planar converts and de-interleaves into job.planar_staging (native_source.rs:1693); (3) submit_planes copy_from_slices planar_staging into block.samples (lib.rs:853); (4) render copy_channel copies block.samples into the track's arena plane (lib.rs:1197). Step 3 is pure waste: planar_staging and block.samples have the same [channel][quantum] contiguous layout with the same stride, so it is a byte-for-byte memcpy of channels * quantum * 4 bytes plus a whole extra worker_planar_staging_bytes allocation per source (native_source.rs:1411-1416). The ideal the audit brief names — "decode writes f32 planar directly into ring slots" — is one restructure away: PcmSourceProducer::take_recycled_block() (lib.rs:800-807) already hands the worker an owned Box<TransferBlock> and already returns HostChunkError::Full on exactly the backpressure condition the worker handles at native_source.rs:1674-1681.
• Proposed change: In crates/source, add

// PcmSourceProducer, alongside submit_native_planar
#[cfg(not(target_arch = "wasm32"))]
pub(crate) fn take_native_block(&mut self) -> Result<Box<TransferBlock>, HostChunkError>;
#[cfg(not(target_arch = "wasm32"))]
pub(crate) fn submit_native_block(&mut self, block: Box<TransferBlock>, generation: SourceGeneration,
    start_frame: SourceFrame, frames: u32, end_of_region: bool, sanitized: u64)
    -> Result<SubmitReport, HostChunkError>;

and restructure SourceJob so pending: Option<(Box<TransferBlock>, PendingBlock)> holds the block the decoder wrote into. The worker's step order becomes: take a recycled block → decoder.decode_planar(&mut block.samples[..], frames) → submit_native_block. planar_staging: Box<[f32]> (native_source.rs:640) and worker_planar_staging_bytes disappear from the resource report. decode_planar already takes &mut [f32] with the Strided { out, stride: frames } shape (native_wave.rs:337-359), so its signature does not change.

• Expected effect: one full channels * quantum * 4-byte memcpy per submitted block per source removed from the worker thread (2 KB per block at stereo/quantum 256), and worker_planar_staging_bytes per source removed from the engine-owned budget. Render-path copy count unchanged at one (ring slot → arena); the total drops from 4 copies to 3.
• Rulings / constraints checked: No ruling. The decoded f32 values are unchanged — this deletes a memcpy, not an arithmetic step, so docs/rulings/unfused-multiply-add-audit.md is not engaged. Worker-thread work, so the render rules are untouched. Backpressure semantics are preserved because take_recycled_block and data_producer.try_push fail under the same condition today.
• Verification gate: cargo test -p source, scripts/trace-source-audit.sh, scripts/check-native-pcm-runner.sh (the reference runner's PCM digest must be unchanged), and the NativeSourceResourceReport assertions in crates/source/src/native_source.rs tests (worker_planar_staging_bytes rows go to zero and the projections must be re-derived).

---

IO-13: the source render pull re-derives plan-invariant shape and carries 16 expect panic edges per block

• Category: realtime-safety
• Class: A (bit-identical)
• Severity: medium
• Location: crates/source/src/lib.rs:1160-1210 (copy_channel), :1074-1100 (read_block_contiguous), :1250-1262 (validate_output_shape), and the caller crates/source/src/lib.rs:1558-1594 (GraphPreparedSourceSetDriver::copy_track_input).
• Current code:

// crates/source/src/lib.rs:1160-1194 — runs twice per track per block (left, right)
pub fn copy_channel(&self, channel: u32, destination: &mut [f32]) -> Result<(), SourceReadError> {
    if channel >= self.channel_count { return Err(SourceReadError::ChannelCount { .. }); }
    let quantum = usize::try_from(self.quantum_frames).expect("u32 fits usize");
    if destination.len() != quantum { return Err(SourceReadError::PlaneLength { .. }); }
    match self.played.as_ref() {
        Some(block) => {
            let frames = usize::try_from(self.played_frames).expect("u32 fits usize");
            let offset = usize::try_from(channel).expect("u32 fits usize")
                .checked_mul(quantum).expect("prepared channel offset");

• Problem: crates/source/src/lib.rs:1060-1260 — the render pull path — contains 16 .expect(...) calls. None is data-dependent (they are all u32→usize widenings that cannot fail on any supported target), but each one puts a core::panicking::panic_fmt edge in the render call graph. That is exactly the standard the browser artifact already enforces on itself: hosts/host-web/src/lib.rs:1249-1251 says "a slice index would put slice_index_fail in the render export's call graph, and the shipped artifact's gate would — correctly — refuse the build", and hosts/host-web/src/lib.rs:1218 avoids try_from for the same reason. crates/source is held to no such gate. Separately, channel_count, quantum_frames and the per-channel offset are fixed at PcmSourceRing::prepare, yet copy_channel recomputes all three (2 widenings, 1 checked_mul, 2 compares) on every call — twice per track per block, so 400 redundant conversions per block for a 100-track session.
• Proposed change: In crates/source/src/lib.rs, store the shape as usize in PcmSourceConsumer at construction:

quantum_frames_usize: usize,   // = quantum_frames as usize, set once in prepare
channel_count_usize: usize,
plane_offsets: Box<[usize]>,   // channel * quantum, computed once at prepare

and rewrite copy_channel to index plane_offsets with get(channel as usize) (returning the existing typed SourceReadError::ChannelCount on None) instead of the try_from/checked_mul/expect chain. Do the same in read_block_contiguous and validate_output_shape. Wrap the render-path functions (begin_block, copy_channel, end_block, read_block_contiguous) in // REALTIME_POLICY_BEGIN / END markers and fix the gate (IO-14) so this file is actually scanned.

• Expected effect: 16 panic edges removed from the native render call graph; ~400 conversions and 200 checked_muls per block eliminated at 100 tracks. No rendered bit moves — the copied samples and the zero-fill regions are identical.
• Rulings / constraints checked: No ruling. AGENTS.md "Approved audio architecture" bans data-dependent unbounded calls and panic paths on render; this closes the gap between what hosts/host-web enforces on itself and what crates/source does. docs/REALTIME_MEMORY.md "Panic behaviour by profile" is the standing reference.
• Verification gate: scripts/check-realtime-policy.sh after IO-14's root-list fix, scripts/trace-source-audit.sh, cargo test -p source, and cargo objdump on PcmSourceConsumer::copy_channel to confirm the panic_fmt call sites are gone.

---

IO-14: three files carry REALTIME_POLICY markers that the gate never scans

• Category: realtime-safety
• Class: N/A (gate coverage)
• Severity: medium
• Location: scripts/check-realtime-policy.sh:34-48 (the scan root); the unscanned marked files crates/graph/src/runtime.rs, crates/graph/src/lib.rs, crates/effect-contract/src/live.rs.
• Current code:

# scripts/check-realtime-policy.sh:12-13
realtime_root="crates/engine/src/realtime"
[[ -d "$realtime_root" ]] || fail "missing realtime module"
...
# scripts/check-realtime-policy.sh:48
done < <(find "$realtime_root" -name '*.rs' -type f | sort)

• Problem: grep -rl REALTIME_POLICY_BEGIN crates/ hosts/ returns nine files, six under crates/engine/src/realtime and three outside it: crates/graph/src/runtime.rs (the per-node render dispatch), crates/graph/src/lib.rs, and crates/effect-contract/src/live.rs (EffectControlLane::stage — the one function that applies live parameter changes on the render thread). The gate's find root is a single directory, so those three files' markers are decorative: the banned-token regex at :53-57 never sees them, and the "unmatched markers" check at :39-41 never runs on them either. I checked the current contents of all three marked regions against the gate's own regex and they are clean today, so this is a coverage gap rather than a live violation — but nothing prevents the next edit to EffectControlLane::stage from adding a Vec:: or an .expect( under a marker that claims to forbid it.
• Proposed change: In scripts/check-realtime-policy.sh, replace the single root with the set of files that actually carry markers, discovered rather than listed:

mapfile -t marked < <(rg -l 'REALTIME_POLICY_BEGIN' crates hosts --glob '*.rs' | sort)
(( ${#marked[@]} >= 9 )) || fail "expected at least nine marked realtime files"
for source in "${marked[@]}"; do ... done

Keep the >= 4 marked-region floor and add a floor on the file count so deleting a marker to silence the gate fails it. Then add markers to crates/source/src/lib.rs's render pull (see IO-13) and hosts/host-web/src/lib.rs::render_next.

• Expected effect: the gate covers the whole marked render path instead of one third of it; three files' worth of markers stop being decoration.
• Rulings / constraints checked: No ruling. docs/REALTIME_DEPENDENCY_POLICY.md is the normative document the gate enforces; nothing in it limits enforcement to crates/engine/src/realtime.
• Verification gate: scripts/test-realtime-policy.sh (the gate's own test — add a red mutation that puts vec![] inside crates/effect-contract/src/live.rs's marked region and assert the gate fails), then scripts/check-realtime-policy.sh.

---

[tamashi095]

Audit report — Boundaries and I/O: protocol, capi, hosts, source, flac sidecar (IO-*), part 2/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

IO-15: two hand-maintained resource projections, one per host, that must both track every allocation

• Category: dry
• Class: N/A (non-render)
• Severity: medium
• Location: crates/capi/src/runtime/compile.rs:106-205 (capi_resources), hosts/host-web/src/lib.rs:2362-2434 (project_buffers); the shared helpers they each re-implement, crates/capi/src/runtime/compile.rs:20-27 and :73-79 versus hosts/host-web/src/lib.rs:2367 and :2411-2420.
• Current code:

// crates/capi/src/runtime/compile.rs:149-166 — 19 hand-listed rows
let fixed_allocation_rows = [
    checked_byte_layout(limits.maximum_diagnostic_bytes)?,
    checked_byte_layout(limits.maximum_control_frame_bytes)?,
    checked_byte_layout(limits.maximum_control_frame_bytes)?,
    checked_layout::<SharedArcAllocation<AtomicU64>>(1)?,
    ...
    // ProtocolController and MockProvider each retain their own complete telemetry config.
    checked_layout::<u32>(maximum_configuration_items)?,
    ...
    // The automation-only descriptor is inline in the provider; charge its two strings.
    checked_layout::<u8>(4)?,
    checked_layout::<u8>(7)?,

// hosts/host-web/src/lib.rs:2402-2412 — the same idea, nine rows, different helpers
let rows = [
    u64::from(BOOT_OPTIONS_BYTES), u64::from(STATUS_BYTES), u64::from(document_bytes),
    u64::from(DIAGNOSTIC_BYTES), longest_source_id_bytes, source_pcm_bytes,
    output_pcm_bytes, command_bytes, bridge_metadata,
];
let retained = rows.into_iter().try_fold(0_u64, |total, row| total.checked_add(row).ok_or_else(arithmetic))?;
let largest = rows.into_iter().max().unwrap_or(0).max(host_shell_bytes).max(plane_reference_bytes);

• Problem: Both hosts pre-flight the same thing — total retained bytes and largest single allocation, checked against a budget before allocating — with two independent implementations, two checked_add/max fold idioms, two overflow-diagnostic vocabularies (capi.resource.arithmetic vs host.budget.arithmetic), and two hand-maintained row lists. capi's list has 22 rows of which only 2 read a mirror from the owning crate (host_core::control_table_bytes, host_core::source_id_arena_bytes, :143-149); the other 20 are literal restatements of allocations made elsewhere and drift silently — the two rows charging 4 and 7 bytes for the strings "capi" and "control" (:169-171) are a live example of how tightly this couples to an implementation detail that IO-4 is about to delete.

  The same split shows up one level out, in the two #[repr(C)] structs the projections fill: PlanResourceReport (crates/capi/src/abi.rs:230-291, 30 fields) and WebResourceReport (hosts/host-web/src/lib.rs:460-523, 26 fields) share eleven field names and semantics verbatim — sample_rate_hz, quantum_frames, graph_session_plus_plan_bytes, graph_incremental_plan_bytes, graph_metadata_bytes, graph_delay_bytes, effect_scalar_state_bytes, effect_scalar_scratch_bytes, source_total_bytes, source_overhead_bytes, largest_named_allocation_bytes — each with its own hand-written doc comment. The divergent rows are genuinely per-ABI (capi_retained_bytes vs bridge_retained_bytes, bridge_metadata_bytes, output_pcm_bytes), so the two structs should stay two structs, but the shared eleven should be one host-core-owned #[repr(C)] SharedResourceProjection that each ABI struct embeds at a fixed offset. That is what makes the ledger above worth building: the ledger produces the shared sub-struct, and each host adds only its own rows.

• Proposed change: In crates/host-core, add a ResourceLedger:

pub struct ResourceLedger { total: u64, largest: u64 }
impl ResourceLedger {
    pub fn charge_bytes(&mut self, bytes: u64) -> Result<(), ResourceOverflow>;
    pub fn charge_array<T>(&mut self, count: usize) -> Result<(), ResourceOverflow>;
    pub fn report(&self) -> ResourceReport; // { retained_bytes, largest_allocation_bytes }
}

and give every crate that allocates a prepared resource a fn charge(&Config, &mut ResourceLedger) next to its fn prepare(&Config), so the projection and the allocation are edited together. ProtocolQueues::resource_report_for_config (crates/protocol/src/queue.rs:678-732) and PcmSourceRing::resource_report already have exactly this shape — this generalises them. capi_resources and project_buffers shrink to "make a ledger, call each subsystem's charge, compare to the limit".

• Expected effect: ~120 lines of hand-listed rows replaced by ~30; each allocation's byte count lives beside the allocation instead of in another crate; drift becomes a compile error rather than a silently wrong budget.
• Rulings / constraints checked: No ruling. docs/REALTIME_MEMORY.md requires the projection to be exact and pre-flight — preserved, and made more so.
• Verification gate: crates/capi/tests/resource_lifecycle.rs (its projections are the oracle and must be bit-equal before and after), cargo test -p host-web, scripts/check-browser-expected-resources.py, hosts/host-web/tests/boot_transient_budget.rs.

---

IO-16: every control response is encoded twice and staged in a freshly zeroed max-size Vec

• Category: perf
• Class: N/A (non-render, control thread)
• Severity: medium
• Location: crates/protocol/src/controller.rs:2407-2418 (encode_outcome_frame); the two-pass encoder crates/protocol/src/typed_frame.rs:278-314; the pass counters that acknowledge it, crates/protocol/src/typed_frame.rs:20-38.
• Current code:

// crates/protocol/src/controller.rs:2407-2418
fn encode_outcome_frame(&self, message_id: MessageId, request_id: RequestId, outcome: Outcome)
    -> Result<Vec<u8>, EncodeError> {
    #[cfg(test)]
    RESPONSE_STAGING_VECS.with(|allocations| { allocations.set(allocations.get().saturating_add(1)); });
    let mut output = vec![0_u8; self.replay.config.max_response_bytes];
    let written = self.encode_outcome_into(message_id, request_id, outcome, &mut output)?;
    output.truncate(written);
    Ok(output)
}

// crates/protocol/src/typed_frame.rs:278-314 — measure pass, then write pass
pub fn encode_success_response_frame_into(&self, frame: &TypedSuccessResponseFrame<'_>, output: &mut [u8]) -> Result<usize, EncodeError> {
    let measure = self.measure_success_response_frame(frame)?;     // full CountSink walk
    self.encode_success_response_frame_measured_into(frame, measure, output)  // full SliceSink walk
}

• Problem: Two costs. (a) encode_outcome_frame allocates and zeroes max_response_bytes for every response, then truncates — with the BTLV default 1 MiB frame limit (docs/CONTROL_BTLV_V1.md, "The default limits are 1 MiB complete frame") that is a 1 MiB memset plus a malloc/free pair per response, to produce a frame that is typically a few dozen bytes. The crate already has a #[cfg(test)] counter for exactly this (RESPONSE_STAGING_VECS), so it is known. (b) Every response payload is serialised twice — once into a CountSink to learn the length, once into the SliceSink — with FRAME_COUNT_PASSES/FRAME_SLICE_PASSES at typed_frame.rs:20-38 counting the two passes.
• Proposed change:
  1. Replace the per-response vec![0; max_response_bytes] with one response_staging: Box<[u8]> field on ProtocolController, allocated once in try_with_config_and_retained_capacity (the controller already takes a ReplayCacheConfig carrying max_response_bytes, and crates/capi/src/runtime/compile.rs:180-183 already charges two such buffers to the resource budget). encode_outcome_frame writes into it and returns &staging[..written]; only the replay cache's retained copy needs an owned allocation, and it needs exactly written bytes, not max_response_bytes.
  2. Make the caller-buffer frame encode single-pass: the outer header is a fixed 48 bytes (crates/protocol/src/lib.rs:66), so write the payload into output[48..] first, then patch payload_length and tlv_count into the header. The CountSink pass is then needed only on the encoded_*_len query path (docs/CONTROL_BTLV_V1.md, "reports the exact required length on output-too-small"), which can be served by attempting the write into the staging buffer and reporting written. "Writes no partial frame" is preserved because the staging buffer is the controller's own.
• Expected effect: one zeroing allocation of up to 1 MiB per response removed; payload serialisation halved on the response path. Identical output bytes.
• Rulings / constraints checked: No ruling. docs/CONTROL_BTLV_V1.md "Codec and FFI ownership" and docs/CONTROL_PROTOCOL_SIZING.md "Prepared resources" both require an exact-length report and no partial write on short caller output — both preserved, and the staging buffer is the "caller output for a new stateful command ingress" reservation the sizing doc already mandates.
• Verification gate: cargo test -p protocol (including the RESPONSE_STAGING_VECS assertions, which should now be zero after prepare), scripts/run-protocol-allocation-audit.sh, scripts/run-protocol-benchmark.sh, crates/protocol/tests/conformance_corpus.rs hash.

---

IO-17: LocalRing, target-smoke and the two host stubs are a dead branch that keeps two unsafe blocks alive

• Category: dead-code
• Class: N/A (non-render)
• Severity: low
• Location: crates/engine/src/realtime/spsc.rs:456-556 (LocalRing), crates/target-smoke/src/lib.rs:31-41 (local_realtime_ring_smoke, its only non-test caller), hosts/host-native/src/main.rs:1-30, hosts/host-mobile/src/lib.rs:1-26.
• Current code:

// crates/engine/src/realtime/spsc.rs:456-457
/// Browser/single-owner fallback ring. It contains no atomics and makes no shared-memory claim.
pub struct LocalRing<T: Copy> {

// crates/target-smoke/src/lib.rs:31-41
/// Exercise the browser single-owner queue path without shared memory or atomics.
pub fn local_realtime_ring_smoke(value: u32) -> bool {
    let mut ring = engine::realtime::LocalRing::new(NonZeroUsize::new(1).expect("one-slot smoke ring"), ...

• Problem: LocalRing is documented as the browser ring, but hosts/host-web does not use it — grep -rn LocalRing crates hosts returns only crates/engine/src/realtime/spsc.rs, crates/engine/src/realtime/mod.rs:38 (the re-export) + :190 (a unit test), and crates/target-smoke/src/lib.rs:34. host-web uses bounded_spsc throughout. So ~100 lines of ring, including two of the workspace's small stock of unsafe blocks in the one allowlisted file (spsc.rs:512 and :524), exist to serve a 10-line smoke function called only by its own test. Similarly hosts/host-native/src/main.rs (30 lines) and hosts/host-mobile/src/lib.rs (26 lines) attest and print target_smoke() — neither depends on capi, host-core or engine, so the C ABI the workspace ships has no in-tree host exercising it, and the two "hosts" duplicate the same attest-then-return body.
• Proposed change: Delete LocalRing and its re-export, delete local_realtime_ring_smoke, and fold target-smoke's remaining 30 lines into crates/engine (engine::target_smoke()) so the workspace loses a package whose entire content is four constants. Then either make hosts/host-native a real minimal host over capi (it would be the first in-tree exercise of the C ABI, and would be worth more than the current print) or delete both stubs and record in docs/TARGET_MATRIX.md that the native/mobile targets are proven by crates/capi and the target-matrix builds instead of by placeholder binaries. If LocalRing is retained for a future non-atomic browser build, say so in its doc comment and add the issue number — right now the comment asserts a use that does not exist.
• Expected effect: ~200 lines and one package removed; two unsafe blocks removed from the allowlisted realtime file, shrinking the surface scripts/check-realtime-policy.sh:26 must exempt.
• Rulings / constraints checked: No ruling. AGENTS.md naming rules govern names, not existence. Verify against docs/TARGET_MATRIX.md before deleting the host shells — if a target build gate compiles them, they must be replaced rather than removed.
• Verification gate: scripts/check-workspace-policy.sh, scripts/check-realtime-policy.sh, cargo build --workspace, and the per-target builds listed in docs/TARGET_MATRIX.md.

---

IO-18: the entire live-console command ABI lives in the wasm host, so the C ABI cannot reach it

• Category: crate-boundary
• Class: N/A (non-render)
• Severity: high
• Location: hosts/host-web/src/lib.rs:1594-1660 (CommandRecord + decode), :1671-1810 (into_track_record), :1812-1845 (into_observe_record), :1847-1920 (into_effect_records), :1960-2190 (admit_commands), :721-730 (enum AdmittedCommand), :679-700 (push), :2879-2903 (boxed_command_staging) — roughly 600 lines. crates/capi contains none of it: grep -rn 'TrackControlRecord\|EffectControlRecord' crates/capi/src returns nothing.
• Current code:

// hosts/host-web/src/lib.rs:721-730
enum AdmittedCommand {
    Matrix(TrackControlRecord),
    Fader(TrackFaderRecord),
    Input(TrackInputRecord),
    Effect(EffectControlRecord),
}

// hosts/host-web/src/lib.rs:1884-1896
if !parameter_value_valid(parameter, self.values[0]) { return Err(COMMAND_REASON_DOMAIN); }
...
AdmittedCommand::Effect(EffectControlRecord::Parameter { parameter_index, channel, value })

• Problem: miso.command.v1 — the 48-byte fixed control record with eleven kinds (COMMAND_PAN, COMMAND_MATRIX, COMMAND_FADER_DB, COMMAND_MUTE, COMMAND_EFFECT_PARAM, COMMAND_EFFECT_BYPASS, COMMAND_OBSERVE_SUBSCRIBE/UNSUBSCRIBE, COMMAND_SOLO, COMMAND_TRIM_DB, COMMAND_POLARITY_INVERT), its decode, its domain and channel-policy validation, its solo/mute coalescing and its two-pass all-or-nothing admission — is a second, complete control protocol implemented entirely inside hosts/host-web. crates/protocol's BTLV protocol expresses the same operations and is used only by capi. The consequence is concrete: the browser can change a running plan's parameters, and the C ABI can only rebuild the plan. hosts/host-web/Cargo.toml:14-27 documents the boundary intent — "The compile pipeline lives in host-core (103 Audit: miso-engine-capi #103); this crate keeps only the render types it names in its own ABI and the facade" — and the command admission violates it, because none of AdmittedCommand, CommandRecord::decode, into_effect_records or admit_commands names anything wasm-specific.
• Proposed change: Move the transport-neutral half into crates/host-core as host_core::console:
  • pub enum ConsoleCommand { Matrix(..), Fader(..), Input(..), Effect(EffectControlRecord) } (today's AdmittedCommand)
  • pub fn lower_console_command(session: &PreparedConsole, request: ConsoleRequest) -> Result<ConsoleCommand, ConsoleRefusal> — today's into_track_record / into_observe_record / into_effect_records, taking a decoded typed request rather than 48 raw bytes
  • pub fn admit_console_batch(...) — today's two-pass admit_commands including the solo coalescing pass, which is pure control-plane bookkeeping
    hosts/host-web keeps only CommandRecord::decode (the wasm-specific 48-byte wire shape) and the staging-buffer plumbing. crates/capi then gains a live-command entry point by mapping BTLV AUTOMATION_ENQUEUE / a new PARAMETER_SET onto the same lower_console_command, which is also the natural landing site for IO-5's preferred design.
• Expected effect: ~450 lines move out of the wasm host into the crate whose name covers them; the C ABI gains a live control path for the first time; the two transports validate parameter domains through one code path instead of one host having the only copy.
• Rulings / constraints checked: No ruling. This is hosts/host-web/Cargo.toml's own stated boundary and docs/CONTROL_PROVIDER_BOUNDARY.md's adapter/controller split, applied. No render code moves; the EffectControlLane drain (crates/effect-contract/src/live.rs:184) is untouched, so no rendered bit moves.
• Verification gate: cargo test -p host-web, cargo test -p host-core, cargo test -p capi, scripts/check-host-core-policy.sh, scripts/check-command-kind-vocabulary.py, scripts/check-command-reason-vocabulary.py, scripts/test-web-audioworklet.mjs (the full Web console ABI: live control path, meter streaming, telemetry, and parameter metadata for the app mixer #137/Automation-span feed: route live parameter and fader commands into the running plan #140/Strip and console scope: chassis-intrinsic features, solo, N-output buses, monitor mixes #210 command evals), then the artifact re-pin.

---

IO-19: the browser artifact ships without wasm-opt

• Category: perf
• Class: A (binaryen preserves IEEE float semantics by default; --fast-math must not be passed)
• Severity: medium
• Location: scripts/build-web-audioworklet.sh:37-38 and :56-60; the size evidence in its own comment at :31-35.
• Current code:

# scripts/build-web-audioworklet.sh:31-38
# 2,153,061 bytes before D12, 16,661,225 with `debug = 1`, 1,940,863 with the debug
# information stripped -- fat LTO alone makes the module *smaller* than it was, and the whole of
# the growth is DWARF.
strip_flag="-C strip=${MISO_ENGINE_WEB_STRIP:-debuginfo}"
...
CARGO_TARGET_DIR="$simd_target" RUSTFLAGS="-C target-feature=+simd128 $strip_flag $remap" \
  cargo build --locked --release --target wasm32-unknown-unknown -p host-web

• Problem: The shipped AudioWorklet module is 1,940,863 bytes and goes straight from cargo build to cp. No wasm-opt pass runs, so the module keeps rustc's unoptimised-for-size wasm: the producers section, the target-features section, dead function bodies LTO could not prove unreachable across the 25 #[no_mangle] exports, and the default dlmalloc code paths. wasm-opt -O2 --strip-producers --strip-target-features typically removes 10-25 % of a Rust wasm32-unknown-unknown module of this shape; on this artifact that is roughly 200-450 KB off every page load of the worklet.
• Proposed change: Add a wasm-opt step to scripts/build-web-audioworklet.sh between the cargo build and the digest, pinned by version so the content-addressed pin stays reproducible:

# Binaryen preserves IEEE-754 semantics unless --fast-math is passed; it is NOT passed.
wasm_opt_version=$(wasm-opt --version | awk '{print $3}')
[[ "$wasm_opt_version" == "$MISO_ENGINE_WASM_OPT_VERSION" ]] || { echo "wasm-opt version pin mismatch" >&2; exit 2; }
wasm-opt -O2 --strip-producers --strip-target-features \
  "$artifact" -o "$artifact.opt" && mv "$artifact.opt" "$artifact"

with MISO_ENGINE_WASM_OPT_VERSION pinned in the script beside the sha256 pin, then re-pin hosts/host-web/web/miso-engine-v1-audio-worklet-artifact.sha256.

• Expected effect: an estimated 200-450 KB smaller worklet download (unverified — measure before claiming a number). Cost: binaryen becomes a build-time dependency of the browser artifact and a new input to reproducibility, which the version pin has to cover. If the owner judges that cost too high for the benefit, this is a legitimate "no" — but it should be a recorded decision, and the script's comment currently reads as if stripping DWARF were the whole of artifact-size work.
• Rulings / constraints checked: docs/rulings/wasm-simd8-null.md and docs/rulings/wasm-kernel-timing-interim.md cover lane width and kernel timing, not artifact size; no ruling rejects this. Bit identity is the binding constraint: wasm-opt without --fast-math does not reassociate or fuse float operations, so docs/rulings/unfused-multiply-add-audit.md is respected — but this must be proven, not assumed, by the gate below rather than accepted on the basis of binaryen's documentation.
• Verification gate: scripts/check-unfused-seal.sh, the native↔simd128 session PCM parity gate (hosts/host-web dev-dependency sha2 digest test, scripts/run-web-audioworklet-browser-correctness.sh), scripts/check-web-audioworklet.sh (frozen export set — wasm-opt must not drop an export), scripts/check-web-audioworklet-callgraph.py, scripts/check-web-boot-budget.mjs. A single differing PCM byte rejects the change outright.

---

IO-20: the RIFF/RF64 fixture writer is reimplemented five times

• Category: dry
• Class: N/A (test-only)
• Severity: low
• Location: crates/source/src/native_wave.rs:1510-1596, crates/source/src/native_source.rs:4190-4272, tools/audit/src/source_fixture.rs:489-600, tools/audit/src/source_duration.rs:197-247, tools/audit/src/fixture_builtins_listening.rs:521-548 — ~361 lines total.
• Current code:

// crates/source/src/native_wave.rs:1549-1556
fn append_chunk(out: &mut Vec<u8>, id: &[u8; 4], data: &[u8]) {
    out.extend_from_slice(id);
    out.extend_from_slice(&u32::try_from(data.len()).expect("test chunk").to_le_bytes());
    out.extend_from_slice(data);
    if data.len() % 2 == 1 { out.push(0); }
}
// crates/source/src/native_source.rs:4265-4272 — same function, `payload` for `data`, `"len"` for `"test chunk"`

• Problem: WAV/RF64 parsing and int→f32 conversion are correctly single-homed in crates/source/src/native_wave.rs (parse_native_wave at :433-603, parse_format at :657-713, parse_ds64 at :715-751, convert_frames at :771-880), and tools/stem-hasher/src/lib.rs:189-196, tools/stem-publisher/src/lib.rs:249-254 and crates/source/src/native_source.rs:963 all call into it rather than reimplementing — that half of the DRY question comes back clean. What is duplicated is the mirror-image writer: five hand-rolled RIFF/RF64/fmt /data byte builders. Copies 1-3 are near-identical including the ds64 size patch-back; copies 4 and 5 are a near-identical pair of hardcoded 44-byte float32 headers. Two of the five are in the same crate, two files apart.
• Proposed change: Add a wave_fixture module to crates/conformance (already the shared cross-tool fixture crate, already a dependency of tools/audit) exposing append_chunk, riff_wave, rf64_wave, classic_format, extensible_format. Make it the single dev-dependency for all five sites. Do not put it in crates/source — that crate should stay parse-only so the writer cannot become a second authority on the format the parser reads.
• Expected effect: ~300 of ~361 lines deleted; one shape of test fixture instead of five, which matters because copies 4 and 5 hardcode float32 and therefore silently cannot exercise the 16/24/32-bit conversion paths.
• Rulings / constraints checked: No ruling. Test-only; no shipped byte changes.
• Verification gate: cargo test -p source, cargo test -p conformance, cargo test -p audit, scripts/trace-source-audit.sh.

---

IO-21: host-core re-checks the launch sample rate with its own hand-typed array, on a path where the check cannot fire

• Category: dead-code
• Class: N/A (non-render)
• Severity: low
• Location: crates/host-core/src/prepare.rs:36 (the duplicate array) and :129-133 (the unreachable branch); the authority crates/session/src/validate.rs:36-42 + crates/engine/src/lib.rs:36-41,62-65; the sole construction path crates/session/src/compile.rs:121-174. Related: crates/session/src/diagnostic.rs:12 vs crates/host-core/src/diagnostics.rs:15.
• Current code:

// crates/host-core/src/prepare.rs:36
pub const LAUNCH_SAMPLE_RATES_HZ: [u32; 4] = [44_100, 48_000, 88_200, 96_000];

// crates/host-core/src/prepare.rs:129-133
match self.shape {
    HostShapePolicy::AnyLaunchRate => {
        if !LAUNCH_SAMPLE_RATES_HZ.contains(&compiled.sample_rate().0) {
            return Err(shape("host.sample_rate.unsupported"));
        }
    }

• Problem: CompiledSession's fields are private and its only constructor is session::compile_session (crates/session/src/compile.rs:121-174), which calls validate_session(session)? at :128 before building the value; validate_session rejects any rate outside engine::LAUNCH_SAMPLE_RATES at crates/session/src/validate.rs:36-42. So no CompiledSession reaching validate_shape can carry a non-launch rate, and the AnyLaunchRate branch is unreachable. It is also the second of three hand-typed statements of the same four numbers (engine::LAUNCH_SAMPLE_RATES is the first, capi::abi::RATE_*/EXACT_LAUNCH_RATE_MASK the third — see IO-10's addendum), and the only consumers of the public LAUNCH_SAMPLE_RATES_HZ are crates/host-core/tests/prepare.rs:388-410, i.e. a public API item used by nothing but its own tests. Note that the doc comment at crates/host-core/src/prepare.rs:122-126 — "the check is pure, so calling it twice is free and cannot disagree" — justifies validate_shape being called twice within host-core; it does not address, and does not excuse, the duplication against session::validate. Separately, MAXIMUM_SESSION_DIAGNOSTICS = 64 (crates/session/src/diagnostic.rs:12) and MAXIMUM_PREPARE_DIAGNOSTIC_LINES = 64 (crates/host-core/src/diagnostics.rs:15) are the same bound for the same reason, and session's own doc comment at :10-11 says so out loud: "The host encoder independently keeps the same 64-line defense for diagnostics produced by later compilers." Nothing enforces that they stay equal.
• Proposed change: Delete crates/host-core/src/prepare.rs:36 and replace the branch body with if !engine::is_launch_sample_rate(compiled.sample_rate()) { return Err(shape("host.sample_rate.unsupported")); } — keeping the defence-in-depth check but sourcing it from the one authority. (Deleting the branch entirely is also defensible, but keeping a cheap unreachable guard against a future non-compile_session constructor is the safer read.) Export MAXIMUM_SESSION_DIAGNOSTICS from session and have crates/host-core/src/diagnostics.rs:15 re-export it rather than restate the literal. HostShapePolicy::Exact (used by hosts/host-web/src/lib.rs:2599) is a genuinely different check — a host-pinned rate/quantum against the document's — and stays.
• Expected effect: one hand-typed copy of the launch-rate set removed and one dead public constant removed from host-core's API; the two 64s become one. No behaviour change.
• Rulings / constraints checked: No ruling. docs/rulings/de-versioning-inventory.md and the naming rules are untouched. The AnyLaunchRate branch is reached only from crates/capi/src/runtime/compile.rs:347; host-web uses Exact and never enters it, so the change cannot affect the browser artifact digest.
• Verification gate: cargo test -p host-core, cargo test -p session, cargo test -p capi, scripts/check-host-core-policy.sh, scripts/check-session-policy.sh.

---

Summary table

id	category	class	severity	location	one-line
IO-1	crate-boundary	N/A	medium	crates/protocol/src/{lib.rs:74-77,conformance.rs:1-487,controller.rs:618-810}	conformance corpus + MockProvider ship inside the library; 33.8 % of the crate is inline tests
IO-2	dry	N/A	medium	crates/protocol/src/message_wire.rs:862-1980	42 encode entry points repeat one three-statement body; one generic codec + the existing MessageSpec table replaces ~350 lines
IO-3	dry	N/A	medium	wire.rs:98-165, typed_frame.rs:41-106, controller.rs:1036-1080, :2340-2402, schema.rs:259+	the 17-message registry is spelled out in seven hand-maintained tables
IO-4	architecture	N/A	high	crates/capi/src/runtime/compile.rs:485-508, control.rs:196	the shipped C ABI uses protocol::MockProvider — a conformance fixture — as its production control provider
IO-5	architecture	N/A	high	crates/protocol/src/queue.rs:196-283, controller.rs:3643-3675, crates/effect-contract/src/live.rs:44-90	the accepted-automation queue has no render-side drain; two disconnected automation models exist
IO-6	perf	N/A	medium	crates/protocol/src/queue.rs:243-278, :1098-1211	admission is ~5.3 M iterations per 256-record batch and validates every batch twice
IO-7	perf	A	high	hosts/host-web/src/lib.rs:1244	(3T + E)-entry fill(0) on the render thread every block, unconditionally
IO-8	dry	A	medium	crates/capi/src/ffi.rs:823-837, hosts/host-web/src/lib.rs:1252-1269	two scalar master-peak folds; one lane-generic host-core kernel replaces both
IO-9	architecture	N/A	high	crates/host-core/src/shape.rs:26-28, hosts/host-web/src/lib.rs:1091-1109	issue #292: track IDs read through the source-ID buffer; silent RESULT_INTERNAL
IO-10	dry	N/A	medium	crates/capi/src/abi.rs:11-29, hosts/host-web/src/lib.rs:69-100, sidecars/flac-decoder/src/lib.rs:23-39	codes 3 and 5 mean different things natively and in the browser with no test saying so; capi discards PrepareRejection; two ungenerated JS copies
IO-11	dry	N/A	medium	effect-contract/src/lib.rs:133-142, session/src/model.rs:327-357, protocol/src/message_wire.rs:183-350	six parameter vocabularies declared 2-3× plus ~180 lines of conversions between the copies
IO-12	perf	A	medium	crates/source/src/native_source.rs:1690-1695, crates/source/src/lib.rs:849-854	the decode worker memcpys a whole planar quantum into the ring slot it could decode into
IO-13	realtime-safety	A	medium	crates/source/src/lib.rs:1160-1210, :1074-1100	16 expect panic edges and plan-invariant shape re-derivation in the render pull path
IO-14	realtime-safety	N/A	medium	scripts/check-realtime-policy.sh:12-48	three files' REALTIME_POLICY markers are never scanned by the gate that owns them
IO-15	dry	N/A	medium	crates/capi/src/runtime/compile.rs:106-205, hosts/host-web/src/lib.rs:2362-2434	two hand-maintained resource projections that must each track every allocation
IO-16	perf	N/A	medium	crates/protocol/src/controller.rs:2407-2418, typed_frame.rs:278-314	every response zeroes a max_response_bytes Vec and is serialised twice
IO-17	dead-code	N/A	low	crates/engine/src/realtime/spsc.rs:456-556, crates/target-smoke/src/lib.rs:31-41	LocalRing is unused by any host and keeps two unsafe blocks alive for a smoke test
IO-18	crate-boundary	N/A	high	hosts/host-web/src/lib.rs:1594-2190	~600 lines of transport-neutral console-command ABI live in the wasm host; the C ABI cannot reach it
IO-19	perf	A	medium	scripts/build-web-audioworklet.sh:37-60	the 1.94 MB browser artifact ships without any wasm-opt pass
IO-20	dry	N/A	low	5 sites, ~361 lines (see finding)	the RIFF/RF64 test-fixture writer is reimplemented five times
IO-21	dead-code	N/A	low	crates/host-core/src/prepare.rs:36, :129-133, crates/host-core/src/diagnostics.rs:15	host-core re-checks the launch rate with its own array on a path where the check provably cannot fire

---

Things I checked that are fine

• The "acked batch" rule (102 Audit: miso-engine-protocol #102, feat(host-web): the web console ABI — miso.command.v1, meter frames, telemetry, parameter metadata (#137) #139/Automation-span feed: route live parameter and fader commands into the running plan #140) is structurally guaranteed today. ProtocolQueues::try_enqueue_automation (crates/protocol/src/queue.rs:805-828) validates the entire batch first (validate_automation_admission, returning AutomationEnqueueError::Invalid { batch, .. } with the caller's whole slot intact), then does a single self.automation.producer.try_push(batch), and only updates density/interval/frontier state inside the Ok(()) arm; a full queue returns Full { batch: full.value, report } with the batch returned by value. The ack is emitted only in that Ok(()) arm: crates/protocol/src/controller.rs:3103-3112, match self.queues.try_enqueue_automation(...) { Ok(()) => { … self.ok(Body::AutomationEnqueued(…)) } }. There is no path that acks and then drops. (What is missing is a consumer — see IO-5.)
• Event delivery to effects is per-block, not per-sample, and does not scan. EffectControlLane::stage (crates/effect-contract/src/live.rs:184-262) drains a bounded SPSC into a preallocated staging window at the top of the block, collapsing last-wins per (parameter_index, channel) with a bounded insertion into an already-sorted window. It allocates nothing, takes no lock, and the drain is bounded by the queue capacity, which preparation refuses to make larger than the effect's automation_capacity (crates/graph/src/runtime.rs:336). There is no per-sample scan, no per-block sort, no binary search, and no O(events × lanes) or O(events × nodes) term — the cost is O(records × staged) with both bounded by automation_capacity, which is small. The frozen rule is stated at crates/effect-contract/src/live.rs:17-25. I have no better design to propose at the current capacities; a dense value-table + touched-bitset would be O(1) per record but is not worth the change at these sizes.
• capi renders directly into the caller's buffer — no intermediate buffer, no memcpy. crates/capi/src/ffi.rs:800-812 builds a PlanarBufferMut over the caller's output.samples and hands it to state.render. The per-call validation there (struct_size, reserved, channels != 2, is_aligned, sample_capacity fit, PlanarBufferMut::try_new layout) is genuinely per-call: the caller may pass a different descriptor on every block, so none of it is plan-invariant. The comment at :783-786 documents the one-validation-pass-per-owner split (audit 103 Audit: miso-engine-capi #103 F4) and it holds — nothing there recomputes a byte extent the layout check computes again.
• The host-web JS↔wasm boundary is already at the minimum copy count. output[0].set(this.outputLeft) / output[1].set(this.outputRight) (hosts/host-web/web/miso-engine-v1-audio-worklet.js:855-856) is one copy per plane per block, unavoidable because AudioWorklet output arrays are JS-heap-owned. The Float32Array views over wasm memory are created once at prepare (:240-241), not per block, and the memory-growth invalidation check (:821) correctly re-fails the node rather than reading a detached buffer. Source PCM (:623) and command records (:664) are copied on control messages, not per block.
• The render-side source pull is one copy. SourceGraphSourceSetDriver::copy_track_input (crates/source/src/lib.rs:1558-1594) copies ring slot → track arena plane directly; the ring slot is a Box<TransferBlock> moved through the SPSC as a pointer, so the queue itself copies no PCM. The underrun path zero-fills only the region the copy does not reach (crates/source/src/lib.rs:1185-1203), with the dead full-fill already removed and the reason documented. Seek generation tagging is one u64 compare per acquired block (:1288), not per sample.
• WAV/RF64 parsing and int→f32 conversion are already single-homed. crates/source/src/native_wave.rs is the only implementation; tools/stem-hasher, tools/stem-publisher and crates/source/src/native_source.rs all call parse_native_wave rather than reimplementing it. sidecars/flac-decoder is genuinely unrelated (symphonia → raw int PCM, no RIFF). Only the fixture writer is duplicated (IO-20).
• simd128 feature gating is correct. crates/lane/src/backend.rs:43-68 gates on all(target_arch = "wasm32", target_feature = "simd128", not(miso_wasm_simd8)) with a matching not(any(...)) scalar arm, so no configuration falls through two arms or none. miso_wasm_simd8 is declared in Cargo.toml:109 unexpected_cfgs, so a typo warns. The build script pins +simd128 in RUSTFLAGS (scripts/build-web-audioworklet.sh:58) and host.js probes WebAssembly.validate on a minimal v128 module before any network request (hosts/host-web/web/miso-engine-v1-audio-worklet-host.js:13-19) — the browser twin of the native D4 attestation, correctly done.
• Panic/formatting machinery in the wasm artifact is gated where it matters. [profile.release] sets panic = "abort", lto = "fat", codegen-units = 1 (Cargo.toml:127-131); the browser build strips DWARF in the delivery script rather than in the profile so native artifacts keep line tables (scripts/build-web-audioworklet.sh:31-38); and scripts/check-web-audioworklet-callgraph.py refuses a build whose render export reaches a panic path — which is why hosts/host-web/src/lib.rs:1218 and :1249-1251 avoid try_from and range indexing by hand. 25 exports, frozen exactly (not as a lower bound) by scripts/check-web-audioworklet.sh. The artifact is content-addressed with --remap-path-prefix on both CARGO_HOME and the repo root, so the digest is reproducible across machines.
• CPU and floating-point attestation is single-homed and every call site reuses it. attest_host (crates/lane/src/backend.rs:119-124) and attest_fp_environment (crates/lane/src/fpenv.rs) are defined once in lane and re-exported at crates/lane/src/lib.rs:83-84; the five call sites — crates/capi/src/ffi.rs:267 (boot) and :774-779 (first render re-attest), crates/host-core/src/render_session.rs:84, hosts/host-native/src/main.rs:15,24, hosts/host-mobile/src/lib.rs:24 — all call it rather than reimplementing a feature test. The x86-64-v3 pin itself is enforced once, at compile time, by the cfg-gated compile_error! at crates/lane/src/lib.rs:60-69. host-web correctly has no attestation call (wasm has no runtime feature detection; the simd128 probe is in JS, before instantiation). There is no MISO_ENGINE_V1 string constant in Rust source at all — it is a C header and file-naming convention only.
• The per-call channels != 2 check in capi is genuinely per-call and must not be hoisted. crates/capi/src/ffi.rs:756-761 validates a caller-owned PlanarOutput struct that crosses the FFI fresh on every render call; it is not a restatement of crates/session/src/validate.rs:60-66, which validates the document's output_profile.channels once at compile. host-web has no counterpart because it owns its output buffer internally and receives no per-call channel field — an architecture difference, not an omission.
• host-web's command admission is well-shaped where it lives. The two-pass all-or-nothing structure (hosts/host-web/src/lib.rs:2166-2188), the direct-indexed queue slots, the preallocated staging (:2879-2903), and the solo coalescing that avoids a 2 * track_count fan-out per transition (:2139-2164) are all correct and allocation-free; fail() (:1555-1564) is documented and provably render-safe (it copies a 'static byte string and never drops the plan). My objection is only to where the code lives (IO-18), not to how it is written.

[tamashi095]

Audit report — Tools, scripts, CI, artifacts (TOOL-*), part 1/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

TOOL — audit of tools/, scripts/, fuzz/, sdk/, .github/workflows/, clippy.toml, fixtures/, artifacts/

Scope measured at main @ 4797a544.

Scope inventory (measured, for context — not findings)

tools/ — 15 crates, 41,626 Rust lines:

crate	lines		crate	lines
audit	15,196		session-validator	897
bench	10,161		stem-hasher	880
console-workload	3,425		wasm-console	857
native-pcm-runner	2,565		bench-support	708
parameter-metadata	2,382		stem-publisher	568
wasm-gates	1,419		catalog-migrate	564
wasm-gate-corpus	1,259		wasm-console-guest	271
			wasm-gate-guest	115

tools/audit modules: fixture_builtins.rs 6025, unfused_fma.rs 1468, source_fixture.rs 1174,
builtins_graph.rs 868, fixture_builtins_listening.rs 850, builtins_fixture_check.rs 550,
protocol.rs 512, source.rs 490, vectorization.rs 454, capi.rs 342, source_duration.rs 336,
graph.rs 336, compressor.rs 292, gate_expander.rs 280, realtime.rs 261, builtins.rs 259,
delay.rs 188, fp_env.rs 181, parametric_eq.rs 169, main.rs 118, record.rs 43.

tools/bench modules: builtins.rs 2079, console.rs 1718, protocol.rs 1677,
effect_interchange.rs 1086, rack.rs 971, session.rs 641, graph.rs 619, floor.rs 511,
conformance.rs 383, effect_contract.rs 366, main.rs 110.

scripts/ — 110 .sh files totalling 13,108 lines, plus 20 .py (7,713), 14 .jq (1,343),
4 .mjs (2,023), 5 JSON fixtures, and scripts/operator/ (11 files). All of scripts/ = 27,590 lines.
Shell families: check-*.sh 44 files / 4,390 lines · test-*.sh 35 / 5,610 · run-*.sh 18 / 2,144 ·
trace-*.sh 6 / 252 · preflight-*.sh 2 / 318 · build-*.sh 2 / 162 · 3 singletons / 232.
Largest: test-console-benchmark.sh 903, test-builtins-benchmark.sh 747, run-console-benchmark.sh 606,
check-unfused-seal.sh 445, check-web-audioworklet.sh 403, test-effect-interchange-benchmark.sh 382,
test-workspace-policy.sh 363, test-rack-benchmark.sh 342, run-builtins-benchmark.sh 307,
test-wasm-console-benchmark.sh 279.

fuzz/ — 9 targets, 279 lines total, all thin fuzz_target! shells over protocol/session/
effect-package/effect-compiler public APIs. No duplication found; see "Things I checked that are fine".

fixtures/ 2.9 MB / 192 files · artifacts/ 9.6 MB / 285 files (42 directories) · sdk/ 30 MB
(17,447 TS/MJS lines excluding node_modules/dist). .git pack 50.4 MiB. No .gitattributes, no LFS.

Two open issues already cover gate vacuity and sidecar disjointness — #306 (rg exit 2 read as
"no violation"; ~40 sites; no non-vacuity assertions) and #307 (sidecar disjointness enforced by
nothing; packages+=(-p "${crate_dir#crates/}") basename trap). Findings below reference them rather
than restating them.

---

TOOL-1: tools/bench ships a hand-written SHA-256 next to the shared digest sink it depends on

• Category: dry
• Class: N/A (non-render)
• Severity: high
• Location: tools/bench/src/session.rs:446-585 (the function), tools/bench/src/session.rs:3-4
  (imports that already reach the harness), tools/bench/Cargo.toml:35 (sha2.workspace = true),
  tools/bench-support/src/digest.rs:69-72 (the shared one-shot), scripts/check-bench-policy.sh:40-41
  (the rule that fails to see it)
• Current code:

// tools/bench/src/session.rs:446
fn sha256_hex(input: &[u8]) -> String {
    const INITIAL: [u32; 8] = [
        0x6a09_e667, 0xbb67_ae85, 0x3c6e_f372, 0xa54f_f53a,
        0x510e_527f, 0x9b05_688c, 0x1f83_d9ab, 0x5be0_cd19,
    ];
    const K: [u32; 64] = [ /* 64 round constants, one per line, lines 458-521 */ ];
    // ... padding, message schedule, 64-round compression, hex output ... through line 585
}

# scripts/check-bench-policy.sh:40
sole_owner 'the counted SHA-256 sink has more than one implementation' \
    "$support/src/digest.rs" '^(pub )?struct Sha256Sink'

• Problem: 140 lines re-implement FIPS 180-4 SHA-256 from scratch inside a benchmark subject.
  bench-support — which this crate already depends on and this very file already imports
  (use bench_support::json::escape; at line 3) — exposes digest::sha256_hex(&[u8]) -> String
  (tools/bench-support/src/digest.rs:69) with published-vector tests. sha2 is a direct dependency
  of tools/bench at Cargo.toml:35, and the session module is cfg(not(target_arch = "wasm32"))
  gated exactly as that dependency block is, so there is no target-availability reason for the copy.
  The policy gate cannot see it: sole_owner matches only the type name struct Sha256Sink, never
  a second SHA-256 implementation, so the whole point of check-bench-policy.sh ("the second copy
  is the defect", tools/bench-support/src/lib.rs:3-8) is defeated by a function that spells itself
  differently. Two independent SHA-256s also means the session benchmark's fixture_sha256 column is
  produced by unreviewed code that no vector test covers.
• Proposed change: delete tools/bench/src/session.rs:446-585 and its use of core::fmt::Write
  if it becomes unused; call bench_support::digest::sha256_hex. Update the super::{…, sha256_hex, …}
  test import at tools/bench/src/session.rs:600. Then tighten the gate so it cannot happen again:

# scripts/check-bench-policy.sh, replacing the Sha256Sink rule
sole_owner 'a second SHA-256 implementation exists under tools/' \
    "$support/src/digest.rs" '0x6a09_e667|0x6a09e667|struct Sha256Sink'

• Expected effect: −140 lines; one SHA-256 in tools/; the gate's stated invariant becomes true.
• Rulings / constraints checked: non-render evidence code; no bit-identity surface (the digest is
  over fixture bytes and must equal the standard SHA-256, which is what the shared sink already
  produces). Not a rejected candidate — check-bench-policy.sh's own header asks for exactly this.
• Verification gate: cargo test -p bench --all-targets (the session subject's own tests assert
  the fixture digest), then bash scripts/check-bench-policy.sh and bash scripts/test-bench-policy.sh.

---

TOOL-2: a second, RFC-invalid JSON escaper in tools/audit, plus six json_string* copies the gate's regex cannot match

• Category: dry
• Class: N/A
• Severity: medium
• Location: tools/audit/src/vectorization.rs:293-295 (the invalid one);
  tools/bench/src/effect_interchange.rs:907-914, tools/bench/src/builtins.rs:1732-1749,
  tools/bench/src/session.rs:437-444, tools/bench/src/conformance.rs:338-345 (four more wrappers);
  scripts/check-bench-policy.sh:36-37 (the rule); tools/bench-support/src/json.rs:1-6 (why it exists)
• Current code:

// tools/audit/src/vectorization.rs:293 — does NOT use the shared escaper
fn json_string(value: &str) -> String {
    format!("\"{}\"", value.replace('\\', "\\\\").replace('\"', "\\\""))
}

# scripts/check-bench-policy.sh:36
sole_owner 'the JSON string escaper has more than one implementation' \
    "$support/src/json.rs" '^(pub )?fn (json_)?escape\('

• Problem: tools/bench-support/src/json.rs exists because audit 104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104 F4 found nine escapers, two
  of them emitting invalid JSON, and its header states the rule: "the second copy is the defect".
  tools/audit/src/vectorization.rs:293 is a tenth, and it is one of the broken kind — it escapes only
  \ and " and passes U+0000–U+001F through raw, which is precisely the defect the shared module
  documents (tools/bench-support/src/json.rs:1-6). tools/audit does not even list bench_support::json
  among its imports (it uses bench_support::alloc in nine modules and bench_support::json in exactly
  one, record.rs:10). The gate's regex is anchored to a function literally named escape or
  json_escape, so all six json_string / json_string_array / json_string_field spellings are
  invisible to it — four of them are harmless one-line wrappers over json::escape, and identifying
  which is which currently requires reading each.
• Proposed change: in tools/audit/src/vectorization.rs, add use bench_support::json::escape;
  and reduce json_string to format!("\"{}\"", escape(value)); delete the four duplicate wrappers in
  tools/bench/src/{effect_interchange,builtins,session,conformance}.rs in favour of two shared helpers
  added to tools/bench-support/src/json.rs:

pub fn string(value: &str) -> String;              // quoted + escaped
pub fn string_array(values: &[String]) -> String;  // "[\"a\",\"b\"]"

and widen the gate to '^(pub )?fn (json_)?(escape|string|string_array)\('.

• Expected effect: one escaper reachable from every subject; ~35 lines deleted; the
  control-character bug in the vectorization report's --allowlist echo is fixed.
• Rulings / constraints checked: non-render. The #104 F4 rule is the repo's own; this restores it.
  Note tools/bench/src/effect_interchange.rs:909-913 deliberately asserts no control characters
  rather than escaping them — keep that assertion at the call site, it is a different rule.
• Verification gate: bash scripts/check-bench-policy.sh, bash scripts/test-bench-policy.sh,
  cargo test -p audit -p bench --all-targets, then bash scripts/run-native-vectorization-report.sh
  and pipe its output through jq -e . to prove the record still parses.

---

TOOL-3: six tools/audit subjects — 4,720 lines, 31% of the crate — are invoked by nothing

• Category: dead-code
• Class: N/A
• Severity: medium
• Location: tools/audit/src/main.rs:31-50 (the SUBJECTS list),
  tools/audit/src/unfused_fma.rs (1468), tools/audit/src/source_fixture.rs (1174),
  tools/audit/src/fixture_builtins_listening.rs (850), tools/audit/src/builtins_fixture_check.rs (550),
  tools/audit/src/capi.rs (342), tools/audit/src/source_duration.rs (336)
• Current code:

// tools/audit/src/main.rs:31
const SUBJECTS: &[&str] = &[
    "builtins", "builtins-fixture", "builtins-graph", "capi", "compressor", "delay",
    "fixture-builtins", "fixture-builtins-listening", "fixture-source", "fp-env",
    "gate-expander", "graph", "parametric-eq", "protocol", "realtime", "source",
    "source-duration", "unfused-fma", "vectorization",
];

• Problem: grepping every scripts/**, .github/**, docs/** and AGENTS.md for each subject
  name in an invocation position finds callers for 13 of the 19: delay (ci.yml:173), compressor
  (ci.yml:189), parametric-eq (ci.yml:218), gate-expander (ci.yml:224), realtime
  (scripts/run-realtime-benchmark.sh:34, scripts/trace-realtime-audit.sh:23), builtins
  (scripts/trace-builtins-audit.sh:23), builtins-graph (scripts/trace-builtins-graph-audit.sh),
  graph (scripts/trace-graph-audit.sh), source (scripts/trace-source-audit.sh:8), protocol
  (scripts/run-protocol-allocation-audit.sh:7), fp-env (scripts/run-fp-environment-benchmark.sh:40),
  fixture-builtins (scripts/check-builtins-fixtures.sh:38), vectorization
  (scripts/run-native-vectorization-report.sh:25). Six have zero callers anywhere, including in
  prose: builtins-fixture, fixture-builtins-listening, fixture-source, source-duration,
  unfused-fma, capi. Together they are 4,720 lines. They are not free: ci.yml:68 runs
  cargo clippy --locked --workspace --all-targets --all-features -- -D warnings and ci.yml:70
cargo test --locked --workspace --all-targets, so all 4,720 lines are type-checked, linted and
  their unit tests run on every PR. unfused_fma.rs alone is 1,468 lines whose only trace in the
  repository is a citation in docs/rulings/unfused-multiply-add-audit.md:250 — it produced a ruling
  that is now frozen.
• Proposed change: classify each and act:
  (a) One-shot evidence that produced a frozen ruling — unfused_fma (1468). Delete it; the ruling
  records the numbers, and the git history records the instrument. If it must be re-runnable, move
  it behind a non-default cargo feature ([features] historical = [], #[cfg(feature = "historical")] mod unfused_fma;)
  so it leaves the default --all-targets build.
  (b) Fixture generators for frozen trees — source_fixture (1174), fixture_builtins_listening
  (850), source_duration (336). Keep, but each must be named by the docs/ page that owns the
  fixture tree it regenerates, and each of fixtures/sources, fixtures/builtins/v1/listening
  must carry a GENERATED-BY line pointing at its subject. A generator nothing documents is a
  generator nobody can re-run.
  (c) Checkers with no caller — builtins_fixture_check (550, subject builtins-fixture) and
  capi (342). Either wire them into ci.yml's host job next to their siblings or delete them.
  capi.rs is additionally one of the six approved allow(unsafe_code) owners under tools/
  (scripts/check-bench-policy.sh:76), so deleting it also removes an unsafe boundary.
• Expected effect: up to −4,720 lines from the workspace clippy/test graph; at minimum a documented
  owner for every subject. The list in main.rs:31-50 becomes checkable against callers.
• Rulings / constraints checked: non-render tooling only. Nothing under crates/ or hosts/
  depends on audit (it is a [[bin]]-only package). #307's point stands here too: a category
  asserted in prose and enforced by nothing decays.
• Verification gate: add a gate row — for every entry of SUBJECTS, rg -F "audit <subject>" over
  scripts .github docs AGENTS.md must match at least once, with an explicit exempt list carrying an
  owning issue number (and using the case $rc in 0|1|*) shape Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306 asks for, not a bare if rg).
  Then cargo test -p audit --all-targets and bash scripts/check-bench-policy.sh (the unsafe-owner
  list at :70-79 must be edited in the same change if capi.rs goes).

---

TOOL-4: tools/audit/src/fixture_builtins.rs contains two JSON readers, in one 6,025-line file, for the same records

• Category: crate-boundary
• Class: N/A
• Severity: medium
• Location: tools/audit/src/fixture_builtins.rs:2675-2710 (substring scraper),
  tools/audit/src/fixture_builtins.rs:2712-2824 (recursive-descent parser),
  tools/audit/src/fixture_builtins.rs:2826-2870 (accessors over the second),
  crates/session/src/parse.rs + crates/session/Cargo.toml:17 (jstrict = "=0.14.0", the workspace's
  strict JSON grammar)
• Current code:

// tools/audit/src/fixture_builtins.rs:2675 — reader #1: substring scraping
fn json_string_field<'a>(record: &'a str, key: &str) -> Result<&'a str, String> {
    let prefix = format!("\"{key}\":\"");
    let value = record
        .split_once(&prefix).map(|(_, value)| value)
        .and_then(|value| value.split_once('"').map(|(value, _)| value))
        .ok_or_else(|| format!("JSONL record is missing string field: {key}"))?;
    Ok(value)
}

// tools/audit/src/fixture_builtins.rs:2712 — reader #2: a real parser, same file, same records
impl<'a> JsonParser<'a> {
    fn object(input: &'a str) -> Result<BTreeMap<String, JsonValue>, String> { … }
    fn parse_object(&mut self) -> Result<BTreeMap<String, JsonValue>, String> { … }
    fn parse_value(&mut self) -> Result<JsonValue, String> { … }
    fn parse_string(&mut self) -> Result<String, String> { … }
    fn parse_unsigned(&mut self) -> Result<u64, String> { … }
}

• Problem: one file holds two JSON readers with different failure modes over the same JSONL fixture
  records. The scraper at :2675 finds "key":" anywhere in the line, so a key name appearing inside
  a preceding string value silently yields the wrong field, and it cannot see escapes; the parser at
  :2712 is correct but is used only by parse_meter_record/parse_resource_record. Neither is the
  workspace's JSON reader: crates/session already pins a strict grammar (jstrict =0.14.0,
  crates/session/Cargo.toml:17) and crates/session/src/parse.rs is the audited entry point.
  Separately, serde_json =1.0.151 is already a [dev-dependencies] of tools/session-validator and
  tools/native-pcm-runner, so a well-tested reader is already in the lockfile for tooling use.
  The 6,025-line file is itself the boundary problem: it is a fixture generator, a fixture checker,
  a DFT oracle (dft_magnitude_db:920), a memory-layout table (GRAPH_NODE_BINDING_BYTES:323 and
  fourteen sibling byte constants), a meter model, and two JSON readers.
• Proposed change: (1) delete json_string_field/json_u64_field/json_u32_hex_field/
  json_u64_hex_field (:2675-2710) and route their eleven call sites through the existing
  JsonParser; (2) move JsonParser + JsonValue + the json_object_* accessors (:2712-2870,
  ~160 lines) out of this file into tools/bench-support/src/json.rs as bench_support::json::read,
  the counterpart to the escaper already there, so tools/audit, tools/bench and any future record
  checker share one reader; (3) split fixture_builtins.rs along its real seams —
  fixture_builtins/generate.rs, fixture_builtins/check.rs, fixture_builtins/response_oracle.rs
  (the DFT/RBJ measurement, :786-1058), fixture_builtins/resource_model.rs (the byte-size table,
  :323-360).
• Expected effect: one JSON reader under tools/; ~35 lines deleted outright; a 6,025-line file
  becomes four files whose names describe them. No behaviour change (fixture bytes are frozen and the
  check is byte-exact).
• Rulings / constraints checked: non-render. docs/rulings/prefix-strip-inventory.md freezes
  fixtures/, so the generated bytes must not move — this change touches only the reader, and the
  --check mode's byte comparison is the proof.
• Verification gate: cargo test -p audit --all-targets, then
  bash scripts/check-builtins-fixtures.sh (which calls audit fixture-builtins --check at
  scripts/check-builtins-fixtures.sh:38 and compares the whole tree byte for byte).

---

TOOL-5: MANIFEST.tsv (path\tlength\tsha256) has four Rust owners and three shell verifiers, none shared

• Category: dry
• Class: N/A
• Severity: medium
• Location: writers — tools/audit/src/fixture_builtins.rs:34,
  tools/audit/src/builtins_fixture_check.rs:15, crates/graph-compiler/src/bin/graph_fixture.rs:20,
  crates/graph-compiler/src/bin/rack_fixture.rs:13; verifiers —
  scripts/check-builtins-fixtures.sh:11-33, scripts/check-effect-runtime-fixtures.sh:5-24,
  scripts/check-rack-benchmark-fixture.sh:7-31
• Current code:

# scripts/check-effect-runtime-fixtures.sh:5-24 — and, modulo the root path and the error prefix,
# scripts/check-builtins-fixtures.sh:11-33 verbatim
manifest="$root/MANIFEST.tsv"
[[ "$(head -n 1 "$manifest")" == $'path\tlength\tsha256' ]] || { …; exit 1; }
while IFS=$'\t' read -r path length hash; do
    [[ "$path" == path ]] && continue
    [[ "$path" > "$previous" ]] || { printf '… not strictly sorted\n' >&2; exit 1; }
    [[ "$(wc -c <"$file" | tr -d ' ')" == "$length" ]] || { …; exit 1; }
    [[ "$hash" =~ ^[0-9a-f]{64}$ ]] || { …; exit 1; }
    [[ "$(sha256sum "$file" | awk '{print $1}')" == "$hash" ]] || { …; exit 1; }
    printf '%s\n' "$path" >>"$listed"
done <"$manifest"
find "$root" -type f ! -name MANIFEST.tsv -printf '%P\n' | sort >"$actual"
cmp -s "$listed" "$actual" || { …; exit 1; }

const MANIFEST_HEADER: &str = "path\tlength\tsha256\n";   // ×4, four different files

• Problem: seven implementations of one three-column format. The two shell verifiers are
  line-for-line identical apart from root= and the message prefix — check-builtins-fixtures.sh is
  43 lines and check-effect-runtime-fixtures.sh is 25, and the 20 shared lines are the whole of the
  latter. check-builtins-fixtures.sh:5-7 carries a real bug fix (export LC_ALL=C, because a UTF-8
  locale reordered matrix-ramp-1 against matrix-ramp-127 and reddened an unchanged tree in 104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104
  phase A) that check-effect-runtime-fixtures.sh does not have — the copy drifted, and the second
  tree's sort check runs under the caller's collation. Separately,
  crates/graph-compiler/src/bin/{graph_fixture.rs,rack_fixture.rs} (403 + 216 lines) are fixture
  tooling living inside a production compiler crate while tools/ exists for exactly that;
  scripts/check-graph-determinism.sh:10 builds them with -p graph-compiler --bin graph_fixture.
• Proposed change: one owner, two edges.
  (1) New module tools/bench-support/src/manifest.rs (or a small tools/fixture-manifest rlib if
  bench-support's allocator policy is unwanted here) owning the format:

pub const HEADER: &str = "path\tlength\tsha256\n";
pub fn write(root: &Path) -> Result<String, Error>;          // walk, sort C-collated, digest
pub fn verify(root: &Path) -> Result<usize, Error>;          // header, strict sort, length, sha, no unlisted file

(2) Collapse the three shell verifiers into one scripts/check-fixture-manifest.sh <root> <label>
that shells to manifest verify, keeping LC_ALL=C in exactly one place; call it three times
from CI instead of maintaining three scripts.
(3) Move graph_fixture.rs and rack_fixture.rs out of crates/graph-compiler/src/bin/ into
tools/ (e.g. as two subjects of the existing audit dispatcher, alongside fixture-builtins),
and update scripts/check-graph-determinism.sh:10.

• Expected effect: −~60 shell lines, −3 duplicate Rust header constants, one collation rule instead
  of two-and-a-half; crates/graph-compiler loses 619 lines of tooling and its [[bin]] targets.
• Rulings / constraints checked: non-render, non-fixture-content — the manifest bytes themselves do
  not change, so the frozen-fixture rule (docs/rulings/prefix-strip-inventory.md) is untouched.
• Verification gate: bash scripts/check-builtins-fixtures.sh && bash scripts/check-effect-runtime-fixtures.sh && bash scripts/check-rack-benchmark-fixture.sh && bash scripts/check-graph-determinism.sh,
  plus git diff --stat fixtures/ must be empty.

---

TOOL-6: nine hand-rolled RIFF/WAVE writers; crates/source owns the reader and nothing owns the writer

• Category: dry
• Class: N/A
• Severity: medium
• Location: tools/audit/src/source_duration.rs:231-248 (wave_header),
  tools/audit/src/fixture_builtins_listening.rs:521-550 (wave),
  tools/audit/src/source_fixture.rs:540-552 (riff_wave) and :555-… (rf64_wave),
  tools/stem-hasher/src/lib.rs:588-596 and :605-613 (test waves),
  crates/source/src/native_wave.rs:1558-1570 (riff_wave, test helper),
  crates/source/src/native_source.rs:4209, :4232, :4255;
  owner-to-be: crates/source/src/native_wave.rs:1-13 (the reader, and the RIFF/RF64 constants)
• Current code:

// tools/audit/src/source_duration.rs:231
fn wave_header(data_bytes: u32) -> [u8; 44] {
    let riff_size = 36_u32.checked_add(data_bytes).expect("bounded RIFF size");
    let mut header = [0_u8; 44];
    header[..4].copy_from_slice(b"RIFF");
    header[4..8].copy_from_slice(&riff_size.to_le_bytes());
    header[8..12].copy_from_slice(b"WAVE");
    header[12..16].copy_from_slice(b"fmt ");
    header[16..20].copy_from_slice(&16_u32.to_le_bytes());
    header[20..22].copy_from_slice(&3_u16.to_le_bytes());   // IEEE float
    …
}
// tools/audit/src/fixture_builtins_listening.rs:533 — the same header, built by extend_from_slice,
// with the same magic 36/16/3 constants and a different overflow policy (Result, not expect).

• Problem: nine sites construct the same 44-byte canonical header with the same magic numbers
  (36 + data, fmt size 16, format tag 3 or 1, data). crates/source/src/native_wave.rs is the
  single audited parser — //! Native little-endian RIFF/WAVE and RF64/WAVE metadata parsing,
  const RIFF: [u8; 4] = *b"RIFF"; at :13 — and the workspace already grants
  source = { workspace = true, features = ["test-support"] } to tools/audit
  (tools/audit/Cargo.toml), which is the exact seam a shared writer belongs on. Nothing checks that
  the nine writers agree with the one parser; a writer that gets byte_rate wrong produces a fixture
  the parser accepts and the ear does not.
• Proposed change: add to crates/source, behind the existing test-support feature:

// crates/source/src/wave_writer.rs  (pub use under #[cfg(feature = "test-support")])
pub struct WaveSpec { pub channels: u16, pub rate_hz: u32, pub encoding: NativeWaveEncoding }
pub fn riff_wave(spec: WaveSpec, extra_chunks: &[(&[u8; 4], Vec<u8>)], pcm: &[u8]) -> Vec<u8>;
pub fn rf64_wave(spec: WaveSpec, extra_chunks: &[(&[u8; 4], Vec<u8>)], pcm: &[u8], frames: u64) -> Vec<u8>;

source_fixture.rs:540 already has exactly this shape and is the best of the nine — lift it, do not
rewrite it. Replace the other eight call sites. Add one round-trip test in crates/source:
parse_native_wave(riff_wave(spec, &[], pcm)) reproduces spec and pcm for every
NativeWaveEncoding — the writer/parser agreement that currently exists nowhere.

• Expected effect: −~120 lines across tools/; the writer and the parser gain a shared test;
  fixture generators stop each owning a private notion of the container.
• Rulings / constraints checked: non-render (all nine sites are fixture generation and tests, none
  on the render path). test-support is already the established feature seam for this crate.
• Verification gate: cargo test -p source --features test-support,
  cargo test -p audit -p stem-hasher --all-targets, bash scripts/check-builtins-fixtures.sh, and
  git diff --stat fixtures/ empty after regenerating.

---

TOOL-7: native-pcm-runner re-implements stem-hasher's wave→canonical-PCM→SHA-256 without depending on it

• Category: dry
• Class: N/A
• Severity: medium
• Location: tools/native-pcm-runner/src/lib.rs:393-419 (hash_canonical_wave) and :421-431
  (wave_bit_depth); tools/native-pcm-runner/Cargo.toml (deps: capi, session, source, sha2 —
  no stem-hasher); tools/stem-hasher/src/lib.rs:181-215 (canonicalize_wave, the owner)
• Current code:

// tools/native-pcm-runner/src/lib.rs:421
fn wave_bit_depth(encoding: NativeWaveEncoding) -> Option<SourceBitDepth> {
    match encoding {
        NativeWaveEncoding::SignedPcm16 => Some(SourceBitDepth::Pcm16),
        NativeWaveEncoding::SignedPcm24 => Some(SourceBitDepth::Pcm24),
        NativeWaveEncoding::Float32 => Some(SourceBitDepth::Float32),
        NativeWaveEncoding::UnsignedPcm8
        | NativeWaveEncoding::SignedPcm32
        | NativeWaveEncoding::Float64 => None,
    }
}

// tools/stem-hasher/src/lib.rs:198 — the same six arms, the same three rejections
let bit_depth = match metadata.encoding {
    NativeWaveEncoding::SignedPcm16 => CanonicalBitDepth::Pcm16,
    NativeWaveEncoding::SignedPcm24 => CanonicalBitDepth::Pcm24,
    NativeWaveEncoding::Float32     => CanonicalBitDepth::Float32,
    NativeWaveEncoding::UnsignedPcm8 | NativeWaveEncoding::SignedPcm32 | NativeWaveEncoding::Float64
        => return Err(StemHasherError::new("wave.bit_depth.unsupported")),
};

• Problem: tools/stem-hasher is explicitly "this native-only tool deliberately reuses the
  engine's RIFF/WAVE and RF64/WAVE parser" (tools/stem-hasher/src/lib.rs:3) and owns the
  wave→canonical-PCM→SHA-256 identity for the whole product; tools/stem-publisher and
  tools/catalog-migrate both take the dependency (stem-hasher.workspace = true in each manifest).
  native-pcm-runner alone re-derives it: its own 26-line chunked SHA-256 over data_offset_bytes .. data_length_bytes (:393-419) and its own copy of the launch bit-depth set (:421-431). Two
  consequences: the runner's fixture identities are computed by a second code path that
  fixtures/stem-identity does not cover, and the launch bit-depth set is stated twice so a future
  depth admitted in one place is silently rejected in the other.
• Proposed change: add stem-hasher.workspace = true to tools/native-pcm-runner/Cargo.toml and
  replace hash_canonical_wave + wave_bit_depth with stem_hasher::canonicalize_wave(&mut file, &mut io::sink()),
  reading report.sha256 and report.shape.bit_depth. If the runner genuinely needs the raw data
  chunk digest rather than the canonical-PCM digest, say so in a comment and expose the distinction
  from stem-hasher (pub fn data_chunk_sha256) rather than keeping a private second implementation.
• Expected effect: −~40 lines; one owner for the launch bit-depth set; the runner's identities
  become covered by fixtures/stem-identity.
• Rulings / constraints checked: non-render; native-pcm-runner already depends on source, so
  the stem-hasher edge adds no new transitive weight beyond sha2, which it already has.
  scripts/check-native-pcm-runner.sh:1-163 holds this tool's portability boundary — check that the
  new edge is admitted there (stem-hasher depends only on source + sha2, so it is).
• Verification gate: cargo test -p native-pcm-runner --all-targets,
  bash scripts/check-native-pcm-runner.sh, bash scripts/test-native-pcm-runner-v1-policy.sh,
  bash scripts/test-native-pcm-runner-portability-v1-policy.sh.

---

TOOL-8: the class-A floor table is stated twice (Rust + jq) and the two are never compared in CI

• Category: dry
• Class: N/A
• Severity: medium
• Location: tools/bench/src/floor.rs:47-131 (the constants) and :155-260 (floor_row);
  scripts/console-benchmark-record-lib.jq:53-72 (the restated constants) and :78-136 (floor_pins);
  scripts/console-benchmark-record-lib.jq:49-52 (the claim); docs/rulings/effect-floor-accounting.md
  (the derivation, third copy of the prose); scripts/test-console-benchmark.sh:208-214 +
  .github/workflows/ci.yml:120 (the only CI exercise of the jq side)
• Current code:

// tools/bench/src/floor.rs
const BANK_WIDTH: f64 = 8.0;                        // :50
const OPS_PER_CYCLE: f64 = 3.7;                     // :59
const COMPRESSOR_LANE_OPS: f64 = 94.0;              // :64
const EQ_LANE_OPS: f64 = 51.0;                      // :68
const LIMITER_LANE_OPS: f64 = 138.0;                // :72
const BUILTINS_LANE_OPS: f64 = 69.0;                // :77
const PLUMBING_LANE_OPS: f64 = ROUTE_LANE_OPS + REDUCTION_LANE_OPS;   // :110  (3 + 1)
const BUILTINS_IDENTITY_LANE_OPS: f64 = 22.0;       // :124
const RAGGED_NINE_TRACK_WIDTH_FACTOR: f64 = 16.0 / 9.0;               // :131

# scripts/console-benchmark-record-lib.jq
def lane_ops_per_cycle: 8 * 3.7;                    # :53   (BANK_WIDTH * OPS_PER_CYCLE, inlined)
def builtins_lane_ops: 69;                          # :54
def builtins_identity_lane_ops: 22;                 # :59
def plumbing_lane_ops: 3 + 1;                       # :66
def eq_lane_ops: 51;                                # :67
def compressor_lane_ops: 94;                        # :68
def limiter_lane_ops: 138;                          # :69
def ragged_nine_track_width_factor: 16 / 9;         # :72

• Problem: the jq header states the design honestly — "tools/bench/src/floor.rs is the authority
  … this is the independent copy that makes a subject which quietly re-tuned a floor fail here rather
  than publish" (:49-52) — and the Rust header agrees it is deliberate (floor.rs:10-13: "Three
  copies is two too many for a number, which is why only the inventories and the two machine constants
  are spelled here"). The design is sound; its enforcement is not. The two tables are only ever
  compared when a real record produced by floor.rs is fed through floor_shape
  (console-benchmark-record-lib.jq:148-165), and that happens only in
  scripts/run-console-benchmark.sh — 606 lines whose sole caller is
  scripts/operator/preflight-console-benchmark.sh, which no workflow runs. What CI does run,
  scripts/test-console-benchmark.sh at ci.yml:120, feeds the jq validator synthetic records it
  constructs itself (test-console-benchmark.sh:208-214), so it proves jq agrees with jq. There is
  also no key-set check: floor.rs's Workload match arms cover 16 kinds and floor_pins names 16,
  but nothing asserts the two sets are equal — a kind added to one and not the other is caught only at
  operator time, and only in one direction. BANK_WIDTH * OPS_PER_CYCLE is additionally inlined on
  the jq side as 8 * 3.7, so the two machine constants exist as four literals.
• Proposed change: keep the two implementations; make their agreement a CI row.
  (1) Add a bench floor --emit-pins mode to tools/bench/src/floor.rs printing one JSON object
  { "<workload_kind>": [lane_ops, width_factor, control, basis] } from the Rust table.
  (2) Add scripts/check-floor-pins.sh: run that mode, evaluate floor_pins with
  jq -n -L scripts 'include "console-benchmark-record-lib"; floor_pins', and diff the two —
  failing on any key present in one and not the other, and on any value disagreeing beyond the
  0.002 the validator already tolerates. Wire it into ci.yml's host job. This costs one
  cargo run -p bench that ci.yml:302 already performs.
  (3) Name lane_ops_per_cycle as bank_width * ops_per_cycle with the two numbers as separate
  defs, so the machine constants appear once per language rather than twice.
• Expected effect: the "independent restatement" becomes a checked restatement on every PR instead
  of on operator runs only; a new Workload can no longer reach a record without a floor. No numbers move.
• Rulings / constraints checked: docs/rulings/effect-floor-accounting.md is the derivation and
  stays the prose authority; this proposes no change to any inventory, so none of the class-B gap terms
  (bitselect lowering, vbroadcastss re-splat, compressor detector gather, lookahead rings, AoSoA
  transpose, elision gate compares, per-node dispatch) are touched. Deliberately does not propose
  generating the jq from the Rust, which would destroy the independence the two-copy design buys.
• Verification gate: the new bash scripts/check-floor-pins.sh; regression-prove it by editing one
  constant in tools/bench/src/floor.rs and confirming the gate reddens (and by editing the jq side and
  confirming the same), then reverting. Existing bash scripts/test-console-benchmark.sh must stay green.

---

TOOL-9: every bench subject hand-builds its own metadata block, percentile struct and record template

• Category: dry
• Class: N/A
• Severity: medium
• Location: seven private struct Metadata — tools/bench/src/session.rs:286, builtins.rs:1218,
  rack.rs:775, graph.rs:91, protocol.rs:1436, conformance.rs:178, effect_interchange.rs:917;
  four private struct Percentiles — tools/bench/src/console.rs:1678, builtins.rs:1751,
  rack.rs:890, tools/wasm-console/src/main.rs:825; duplicated formatters —
  microseconds/format_f64/backend_name/round_from_runner at tools/bench/src/console.rs:190,1704,1708,1712
  and tools/wasm-console/src/main.rs:189,198,851,855 and tools/bench/src/rack.rs:114,739;
  the shared pieces that exist — tools/bench-support/src/metadata.rs:41-53 (RECORD_NAMES),
  tools/bench-support/src/stats.rs
• Current code:

// tools/bench/src/console.rs:1678 — and, with min/p999/max varying, three more copies
struct Percentiles { min: u64, p50: u64, p95: u64, p99: u64, max: u64 }
impl Percentiles {
    fn from_samples(samples: &[u64]) -> Self {
        let mut sorted = samples.to_vec();
        sorted.sort_unstable();
        assert!(!sorted.is_empty(), "measured observations");
        let rank = |n: usize, d: usize| stats::nearest_rank(&sorted, n, d);
        Self { min: sorted[0], p50: rank(50,100), p95: rank(95,100), p99: rank(99,100),
               max: *sorted.last().expect("nonempty") }
    }
}
fn microseconds(nanoseconds: u64) -> String { format_f64(nanoseconds as f64 / 1_000.0) }
fn format_f64(value: f64) -> String { format!("{value:.3}") }

• Problem: bench-support fixed the primitives (one allocator, one escaper, one percentile
  function, one digest sink) but not the record, so the layer above them is still copy-pasted eleven
  ways. Concretely: seven Metadata structs each re-deriving missing_metadata from
  Metadata::gather() with their own optional_env/required_env helpers
  (tools/bench/src/effect_interchange.rs:889-905 is one such pair); four Percentiles structs
  differing only in which of {min,p50,p95,p99,p999,max} they carry; four copies each of
  microseconds, format_f64 and backend_name; and 18 record-emitting format! templates
  (tools/bench/src/{console.rs:259,438,829,893,1060,1272,1573; graph.rs:358; effect_interchange.rs:988; session.rs:215; effect_contract.rs:146,177,322; protocol.rs:1495,1638; rack.rs:852; conformance.rs:122}
  and tools/wasm-console/src/main.rs:740), several of them single string literals over 1,000
  characters (rack.rs:852 is one line of ~1,100 chars). The jq validators
  (scripts/*-benchmark-record-validator.jq, console-benchmark-record-lib.jq:20-34) restate every
  one of those key lists a second time. This is exactly the #104 F2 failure mode the harness was
  built to end: "a runner and its binary drifted until every accepted benchmark record carried
  all-null environment metadata and still passed validation" (scripts/check-bench-policy.sh:6-9).
• Proposed change: raise the shared layer from primitives to the record, in tools/bench-support:

// tools/bench-support/src/percentiles.rs
pub struct Percentiles { pub min: u64, pub p50: u64, pub p95: u64, pub p99: u64,
                         pub p999: u64, pub max: u64 }
impl Percentiles { pub fn from_samples(samples: &[u64]) -> Self; }

// tools/bench-support/src/record.rs
pub struct Record { … }                       // ordered key/value builder
impl Record {
    pub fn str(&mut self, key: &str, value: &str) -> &mut Self;   // escapes via json::escape
    pub fn u64(&mut self, key: &str, value: u64) -> &mut Self;
    pub fn f64_3(&mut self, key: &str, value: f64) -> &mut Self;  // the {:.3} spelling, once
    pub fn metadata(&mut self, m: &Metadata) -> &mut Self;        // the 11 RECORD_NAMES + missing_metadata
    pub fn finish(self) -> String;                                // one line, keys as inserted
}

Subjects keep their own key names and orders (records are sealed under artifacts/ and must not
move) but stop owning the escaping, the {:.3} spelling, the metadata projection and the
missing_metadata derivation. Then extend scripts/check-bench-policy.sh's sole_owner list with
rows for struct Percentiles, fn microseconds, fn format_f64 and fn backend_name.

• Expected effect: −~400 lines across tools/bench and tools/wasm-console; one metadata
  projection instead of seven; the 18 mega-templates become readable builder chains; check-bench-policy.sh
  gains four enforceable rows. Records must be byte-identical before and after — that is the gate.
• Rulings / constraints checked: non-render, non-timed (all of this is control-plane emission after
  started.elapsed(), which bench_support::timing::timed already enforces via the digest-update
  counter — tools/bench-support/src/digest.rs:8-14). Sealed records under artifacts/ predate the
  change and must still validate, so no key may move.
• Verification gate: for each converted subject, run it once and diff the emitted record against
  the sealed one under artifacts/ (byte-identical, modulo the metadata the runner supplies); then
  bash scripts/test-console-benchmark.sh, bash scripts/test-rack-benchmark.sh,
  bash scripts/test-builtins-benchmark.sh, bash scripts/test-protocol-benchmark.sh,
  bash scripts/check-bench-policy.sh.

---

TOOL-10: two independent wasmtime host embeddings; consolidate five wasm crates to four

• Category: dry
• Class: N/A
• Severity: low
• Location: tools/wasm-gates/src/lib.rs:251-262 (Guest::load) and :306-317 (digest);
  tools/wasm-console/src/main.rs:299-312 (Guest::compile) and :320-325 (instantiate);
  the pinned dependency, twice — tools/wasm-gates/Cargo.toml and tools/wasm-console/Cargo.toml
  (wasmtime = "=47.0.3", default-features = false, features = ["runtime","cranelift","std"])
• Current code:

// tools/wasm-gates/src/lib.rs:251
fn load(path: &Path) -> wasmtime::Result<Self> {
    let mut config = Config::new();
    config.wasm_simd(true);
    config.wasm_relaxed_simd(false);
    let engine = Engine::new(&config)?;
    let module = Module::from_file(&engine, path)?;
    let mut store = Store::new(&engine, ());
    let instance = Instance::new(&mut store, &module, &[])?;   // no imports

// tools/wasm-console/src/main.rs:299 — the same five calls, the same two Config flags
let mut config = Config::new();
config.wasm_simd(true);
config.wasm_relaxed_simd(false);
let engine = Engine::new(&config).map_err(|error| format!("wasmtime engine: {error}"))?;
let module = Module::from_file(&engine, path)…?;
// :322
let mut store = Store::new(engine, ());
let instance = Instance::new(&mut store, module, &[])…?;      // no imports

• Problem: the five-crate shape is largely justified and I would not collapse it: the two guests
  must be cdylib-only (a lib target that emits a cdylib is built with panic = "abort" and cannot
  be linked into an unwinding test harness — tools/wasm-gate-guest/Cargo.toml:8-13), and
  wasm-gate-corpus/console-workload must be rlibs so the native leg links the identical code
  rather than a transcription, which is the entire basis on which the two legs' comparison means
  anything. What is duplicated is the host half: two copies of the wasmtime boot sequence with the
  same two Config flags (the D3 relaxed-SIMD refusal is stated twice, in two comments), two copies of
  the "read a 32-byte digest out of the guest, eight little-endian u32 words at a time" protocol
  (wasm-gates/src/lib.rs:306-317 vs the miso_console_digest_word loop in
  wasm-console/src/main.rs), and two exact pins of wasmtime =47.0.3 with two long comments giving
  the same reason. tools/wasm-gates/src/lib.rs:545 and tools/bench/src/console.rs:1664 also both
  define fn paired_median.
• Proposed change: one new module tools/bench-support/src/wasm_host.rs (both crates already
  depend on bench-support), owning:

pub struct GuestModule { engine: Engine, module: Module }
impl GuestModule {
    /// The one approved Config: simd128 on, relaxed SIMD off, no imports, threads absent.
    pub fn compile(path: &Path) -> Result<Self, String>;
    pub fn instantiate(&self) -> Result<GuestInstance, String>;
}
impl GuestInstance {
    pub fn typed<P: WasmParams, R: WasmResults>(&mut self, name: &str) -> Result<TypedFunc<P,R>, String>;
    /// The shared word protocol: eight little-endian u32 words -> [u8; 32].
    pub fn digest_words(&mut self, f: &TypedFunc<u32, u32>) -> Result<[u8; 32], String>;
}
pub fn wasmtime_version() -> &'static str;

Move paired_median to bench_support::stats and delete both copies. Move the wasmtime pin to
[workspace.dependencies] so the version and its rationale are stated once.

• Expected effect: −~120 lines; one place where the relaxed-SIMD refusal and the no-imports rule
  are expressed, which matters because those two facts are load-bearing for D3 rather than incidental;
  a single point of change for the runtime pin. Crate count stays at five (four after wasm-gate-guest
  and wasm-console-guest are considered — they should stay separate, see above).
• Rulings / constraints checked: D3 (relaxed SIMD forbidden) is strengthened, not weakened, by
  having one Config. Master plan §3.6 / AGENTS.md — no engine crate, host or fixture may reach a Wasm
  runtime — is preserved: bench-support is test scaffolding and scripts/check-bench-policy.sh:99-112
  already bans production packages from depending on it. Caveat for the implementer: adding
  wasmtime to bench-support would pull the runtime into every crate that depends on bench-support
  (17 of them). Put wasm_host behind a non-default feature ([features] wasm-host = ["dep:wasmtime"])
  enabled only by wasm-gates and wasm-console, or make it its own tiny tools/wasm-host rlib.
• Verification gate: bash scripts/run-wasm-gates.sh, cargo test -p wasm-gates --release
  (ci.yml:487), bash scripts/check-wasm-realtime-atomics.sh, bash scripts/check-bench-policy.sh,
  and cargo tree -e features,no-dev -i wasmtime must list only the two tooling crates.

---

TOOL-11: 21 policy gates share one skeleton; 20 of them re-implement the broken rg shape their sibling already fixed

• Category: dry
• Class: N/A
• Severity: high
• Location: the fixed one — scripts/check-workspace-policy.sh:20-50 (scan_forbidden), called
  only from :166, :170, :178, :185; the 20 that re-implement it naively — check-rack-policy.sh:36,
  check-graph-policy.sh, check-realtime-policy.sh, check-protocol-control-policy.sh,
  check-session-policy.sh, check-effect-state-migration-v1.sh, check-env-vocabulary.sh,
  check-lane-policy.sh, check-effect-runtime-policy.sh, check-host-core-policy.sh,
  check-conformance-boundaries.sh, check-dsp-research.sh, check-bench-policy.sh,
  check-realtime-audit-leak.sh, check-unfused-seal.sh, check-native-pcm-runner.sh,
  check-effect-interchange-qualification.sh, check-effect-interchange-benchmark-108.sh,
  check-builtins-policy.sh, check-rack-benchmark-fixture.sh; the duplicated awk —
  check-builtins-policy.sh:9, check-effect-runtime-policy.sh:6, check-graph-policy.sh:17,
  check-rack-policy.sh:15, check-conformance-boundaries.sh:106
• Current code:

# scripts/check-rack-policy.sh:1-11 and :36-47 — the skeleton, in all 21
#!/usr/bin/env bash
set -euo pipefail
root=$(cd "${1:-$(dirname "${BASH_SOURCE[0]}")/..}" && pwd)
cd "$root"
fail() { printf 'rack policy failure: %s\n' "$1" >&2; exit 1; }
…
if rg -n '\bunsafe\b' crates/rack crates/rack-compiler --glob '*.rs'; then
    fail 'rack source has unsafe code'
fi
…
printf 'rack policy: PASS\n'

• Problem: these 21 files are 2,301 lines, of which a tight core of 13 (rack, graph, realtime,
  protocol-control, session, effect-state-migration-v1, env-vocabulary, lane, workspace, effect-runtime,
  host-core, conformance-boundaries, dsp-research) is 1,151 lines. Measured per file, the policy
  is a minority of each: check-rack-policy.sh is 47 lines for 5 rules; check-graph-policy.sh 57 for
  ~7; check-lane-policy.sh 194 lines containing 9 rg bans and 53 comment lines;
  check-unfused-seal.sh 445 lines containing 10 rg/grep calls and 150 comment lines.
  fail() is defined verbatim-modulo-prefix in 21 files. The Cargo [dependencies] extractor awk
  exists in five near-identical copies under three different variable spellings. Most importantly,
  check-workspace-policy.sh:20-50 already contains the abstraction — scan_forbidden "<description>" "<pattern>" "<glob>" <roots...>, with a 30-line comment explaining that rg exit 2 must not read as
  clean — and no other file in the repo calls it. That is Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306 restated as a DRY finding: the fix
  exists, in this tree, and 20 gates do not use it.
• Proposed change: two steps, in order.
  (1) Immediately, extract scan_forbidden (plus fail) into scripts/lib/gate.sh and have all
  21 gates source it. This is the mechanical half of Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306's fix and it is one edit per file:

# scripts/lib/gate.sh
gate_init() { gate_label="$1"; }
fail() { printf '%s failure: %s\n' "$gate_label" "$1" >&2; exit 1; }
scan_forbidden() {   # description pattern glob roots...
    local description=$1 pattern=$2 glob=$3; shift 3
    local matches rc
    set +e; matches=$(rg -n "$pattern" --glob "$glob" "$@"); rc=$?; set -e
    case $rc in
      0) fail "$description: $matches" ;;
      1) : ;;
      *) fail "$description: search failed (rc=$rc) — a scan root is missing" ;;
    esac
}
extract_dependencies() { … }   # the one copy of the five awk variants

(2) Then, move the 13 pure-grep gates' rule sets into one scripts/policy/gates.toml of
{gate, roots, globs, patterns, allowlist_paths, rationale} rows driven by a single
scripts/check-policy.sh <gate>, keeping rationale = """…""" so the prose survives. Expect
~200 declarative lines plus a ~120-line runner in place of 1,151.
Honest scope limits the implementer must respect: roughly six of the 21 do not fit a table and
must stay bespoke — check-conformance-boundaries.sh:16-38,98 derives its crate list from workspace
manifests at runtime; check-env-vocabulary.sh:51,57 is a bidirectional set-difference against a
Markdown table; check-session-policy.sh:20-26 asserts line ordering inside one source file;
check-unfused-seal.sh's rule set is explicitly documented as not expressible declaratively
(clippy.toml:34-43). Those should source the shared helper but keep their own bodies.

• Expected effect: the exit-code-2 blindness is fixed in 20 places by one edit instead of twenty;
  −500 lines at step (1) and −900 more at step (2); five awk copies become one.
• Rulings / constraints checked: this is the mechanical half of Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306 and should be implemented
  as part of it, not separately. It does not address Sidecar architectural disjointness is asserted in AGENTS.md but enforced by nothing #307 (sidecar disjointness), which needs a new
  rule, not a refactor — but a shared roots list is where that new rule would live. clippy.toml:5-13
  argues correctly that disallowed-methods beats a grep gate because it resolves paths, not
  directory strings; that argument applies to the call-site bans among these 21 and is worth revisiting
  per rule during step (2), but four of check-unfused-seal.sh's six rules are provably not expressible
  as #[expect] (clippy.toml:34-43) so the script layer does not disappear.
• Verification gate: every scripts/test-*-policy.sh mutation harness must stay green
  (ci.yml:78,135,…), plus a new mutation row per gate that deletes one scan root and asserts the
  gate goes red — the property Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306 asks for, which no gate currently has.

---

TOOL-12: 35 test-*.sh mutation harnesses, 5,610 lines, 12 verbatim copies of one function, and no shared harness — while the repo already solved this twice

• Category: dry
• Class: N/A
• Severity: medium
• Location: the 12 verbatim expect_failure copies — scripts/test-rack-policy.sh:20,
  test-host-core-policy.sh:41, test-lane-policy.sh:89, test-realtime-policy.sh:123,
  test-workspace-policy.sh:62, test-protocol-control-policy.sh:30, test-env-vocabulary.sh:17,
  test-bench-policy.sh:20, test-realtime-audit-leak.sh:24, test-artifact-evidence-leak.sh:19,
  test-effect-interchange-policy.sh:10, test-effect-interchange-benchmark-108-policy.sh:12;
  the two counter-conventions already adopted — scripts/check-capi-abi.sh:93 (folded self-test) and
  the 11 scripts/check-*.py gates with internal --self-test + scripts/fixtures/*.json
• Current code:

# scripts/test-rack-policy.sh:20 — identical in 12 files, only the message prefix differs
expect_failure() {
    local name=$1
    local mutation=$2
    local fixture="$scratch/$name"
    make_fixture "$fixture"
    eval "$mutation"
    if bash "$policy" "$fixture" >/dev/null 2>&1; then
        printf 'rack policy mutation unexpectedly passed: %s\n' "$name" >&2
        exit 1
    fi
}

• Problem: 35 files, 5,610 lines — 43% of all shell in scripts/. 27 of them build a scratch
  tree with mktemp -d + trap 'rm -rf' EXIT; 14 define a fixture builder under six different names
  (make_fixture, create_fixture, create_valid_fixture, new_case, make_case, write_fixture).
  The line count is driven by fixture construction, not by test count: test-workspace-policy.sh is
  363 lines for 26 mutations, test-realtime-policy.sh 195 for 24, test-lane-policy.sh 146 for 16 —
  because each hand-writes a synthetic workspace with printf (test-lane-policy.sh:10-60 writes six
  crates, a Cargo.toml and a Cargo.lock). The repo has already decided against this shape twice:
  check-capi-abi.sh states in its header that its mutation proof was "folded in from the former
  test-capi-abi.sh so the gate and its own mutation proof cannot drift apart", and all 11
  check-*.py gates carry --self-test internally with fixtures in scripts/fixtures/*.json and grew
  no sibling at all. Only check-ci-path-routing.py has a separate test-ci-path-routing.py.
• Proposed change: (1) extract the shared harness — scratch/trap, expect_failure,
  expect_success, and a make_workspace_fixture <dir> <crate>... builder — into
  scripts/lib/mutation.sh, deleting the 12 copies; (2) as gates move onto the shared runner from
  TOOL-11, fold each gate's mutation rows into the gate itself behind --self-test, following
  check-capi-abi.sh, so a gate and its proof cannot drift; (3) if step (2) of TOOL-11 lands as a Rust
  xtask, these become #[test] fn bodies over one tempfile-based fixture builder and the 5,610
  lines go away entirely.
• Expected effect: −1,000 lines at step (1) (the 12 copies plus the six fixture-builder variants);
  −4,000 at step (3). One place to fix a harness bug instead of 35.
• Rulings / constraints checked: non-render. The mutation coverage must not shrink: every named
  mutation in every test-*.sh must survive the move by name.
• Verification gate: count the mutations before and after —
  grep -c 'expect_failure' scripts/test-*.sh must be preserved in total, and every gate's harness must
  still red on a deliberately reintroduced violation. CI already runs these
  (ci.yml:78,135,…), so a green host job with an unchanged mutation count is the proof.

---

[tamashi095]

Audit report — Tools, scripts, CI, artifacts (TOOL-*), part 2/2

Full findings for this scope. Each finding is self-contained: location, verbatim current code, problem, proposed change, expected effect, rulings checked, verification gate.

TOOL-13: CI has no Rust cache, 12 cold-cache jobs, 27 wasm32 builds per PR, and builds the shipped worklet three times

• Category: architecture
• Class: N/A
• Severity: high
• Location: .github/workflows/ci.yml:68,70 (workspace compiled twice in one job);
  ci.yml:376,382,388 (three cold cargo check target dirs); ci.yml:440,
  browser-qualification.yml:66, sdk.yml:68 (worklet built three times);
  ci.yml:254→scripts/check-flac-decoder.sh:12 and browser-qualification.yml:68 (decoder twice);
  fuzz.yml:105,128 and nightly.yml:139 (cargo install cargo-fuzz from source, three times);
  ci.yml:31, browser-qualification.yml:30, sdk.yml:24 (three identical route jobs);
  ci.yml:157-227 vs release-build.yml:112→scripts/run-release-workspace-tests.sh:47
• Current code:

# .github/workflows/ci.yml:68-70 — two full workspace compiles, different feature resolutions
- run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
- run: cargo test --locked --workspace --all-targets

# ci.yml:376,382,388 — three cold dependency graphs for one 3-package check
CARGO_TARGET_DIR=target/ci/x86-scalar   cargo check --locked -p engine -p target-smoke -p math
CARGO_TARGET_DIR=target/ci/x86-avx2     cargo check --locked -p engine -p target-smoke -p math
CARGO_TARGET_DIR=target/ci/x86-avx2fma  cargo check --locked -p engine -p target-smoke -p math …

• Problem: measured across the six workflows (19 jobs, all ubuntu-24.04):
  Swatinem/rust-cache appears zero times; actions/cache appears zero times; sccache appears zero
  times. The only caching anywhere is npm (browser-qualification.yml:96, sdk.yml:56). Consequently
  12 jobs compile the Rust dependency graph from scratch — ci.host, ci.x86-probes, ci.wasm,
  ci.wasm-gates, browser-qualification.artifact, sdk.sdk, release-build.release-workspace,
  fuzz.session-fuzz, fuzz.protocol-fuzz, and three nightly jobs — each installing the toolchain
  fresh. Specific waste, all verified:
  • wasm32-unknown-unknown is compiled 27 times on one full-route PR across five jobs with no
    shared target dir (11 in ci.host, 11 in ci.wasm, 2 in ci.wasm-gates, 2 in
    browser-qualification.artifact, 1 in sdk.sdk).
  • The shipped AudioWorklet module is built three times and the FLAC decoder twice — five
    builds of two byte-identical, reproducibility-pinned artifacts.
    browser-qualification.artifact already upload-artifacts both (:70, :76) and its 3-way
    browser matrix correctly downloads them and compiles no Rust at all. That is the pattern the
    other four builds do not follow.
  • cargo install cargo-fuzz --locked --version 0.13.2 is a from-source build performed three
    times, never cached.
  • Three identical route jobs each do a fetch-depth: 0 full-history checkout on a separate runner
    to compute the same routing string from the same SHAs.
  • ci.yml:68 (--all-features) and :70 (no features) are different feature resolutions, so the
    whole workspace is compiled twice inside one job.
  • ci.host's 16 per-package cargo test --release (:157-227) and release-build's
    cargo test --locked --release --workspace --all-targets --no-run recompile the same release units
    in two jobs with two cold target dirs.
  • ~16 further scratch CARGO_TARGET_DIRs are created inside ci.host by gate scripts
    (check-parametric-eq-targets.sh:36,45, check-builtins-targets.sh:17,26,
    check-effect-interchange-targets.sh:78-82, check-effect-package-v1.sh:20,24,28,
    check-effect-descriptor-v1.sh:19,23).
    The path router (scripts/ci-path-router.py) skips whole jobs, it does not deduplicate: it
    removes work only for docs-only and SDK-only diffs, and any engine change takes the full route and
    pays all of the above.
• Proposed change:
  (1) Add Swatinem/rust-cache@v2 to all 12 compiling jobs, with the cache key including the target
  triple and the CARGO_TARGET_DIR. Cache ~/.cargo/bin for cargo-fuzz (or install a released
  binary).
  (2) Promote browser-qualification.artifact's pattern: build the worklet and the FLAC decoder in
  one job, upload-artifact both, and have ci.wasm and sdk.sdk download-artifact them.
  The build is already reproducibility-pinned and CARGO_HOME-independent
  (scripts/build-web-audioworklet.sh:47-54), so a downloaded artifact is provably the same bytes
  — and scripts/check-sdk-generated.sh compares digests anyway.
  (3) Collapse the three route jobs into one reusable workflow (workflow_call) whose outputs the
  three callers consume.
  (4) Merge ci.yml:68 and :70 onto one feature resolution, or accept the second compile and say so
  in a comment with the measured cost.
  (5) Decide whether release-build's workspace release build supersedes ci.host's 16 per-package
  release tests, or vice versa; today both run.
  (6) Have the ~16 gate scripts that create scratch target dirs accept an injected CARGO_TARGET_DIR
  so a caller can point them at the job's shared one.
• Expected effect: hard to state as a percentage without measuring a run, but the shape is
  unambiguous: 27 wasm builds → ~5 distinct artifacts; 5 pinned-artifact builds → 1 build + 4
  downloads; 3 cargo-fuzz source builds → 0 after the first cache hit; 3 full-history checkouts → 1.
  Every one of the 12 jobs currently pays a cold dependency graph that a cache eliminates.
• Rulings / constraints checked: the reproducibility argument cuts for artifact sharing, not
  against it: scripts/build-web-audioworklet.sh:47-54 deliberately makes the output
  CARGO_HOME-independent, which is exactly what makes a downloaded artifact substitutable. The
  x86-probe job's three separate target dirs (ci.yml:376-388) are deliberate and must stay — two
  of the three are expected to fail (leading !) and share nothing by design; only add caching there
  if the cache key includes the RUSTFLAGS.
• Verification gate: compare total host/wasm job wall-clock before and after on the same PR;
  assert scripts/check-sdk-generated.sh and scripts/check-browser-expected-resources.py still pass
  against the downloaded artifacts (they compare digests, so a substituted artifact reddens them if
  it is not byte-identical); bash scripts/test-ci-path-routing.py must stay green after the route
  job is made reusable.

---

TOOL-14: dead and broken tooling — three uninvoked binaries, two dead crate names, one orphan validator, and a deleted script still cited 24 times

• Category: dead-code
• Class: N/A
• Severity: medium
• Location: tools/stem-publisher/src/main.rs, tools/catalog-migrate/src/main.rs,
  tools/native-pcm-runner/src/main.rs (binaries nothing invokes);
  fixtures/flac-delivery/v1/generate.py:92 and :124 (dead crate names);
  scripts/protocol-benchmark-record-validator.jq (48 lines, referenced nowhere);
  scripts/trace-source-audit.sh:6-8 (stale rationale);
  scripts/check-effect-interchange-qualification.sh:88-92 (dead branch);
  scripts/check-sdk-types.sh:6, scripts/operator/README.md:17,
  scripts/operator/run-stem-store-browser-evals.cjs:18, docs/derivations/242-parameter-lattice.md:26,
  docs/derivations/243-sdk-boot.md:25,35,144,152, docs/derivations/274-parity-repin.md:130, and
  15 ci.yml comments (:103,114,149,203,241,251,257,266,271,295,306,316,331,336,348) — all naming
  scripts/sweep.sh, which does not exist
• Current code:

# fixtures/flac-delivery/v1/generate.py:92 and :124 — pre-#308 names, no longer in the workspace
"-p", "miso-engine-stem-publisher",
"-p", "miso-engine-catalog-migrate",

# scripts/trace-source-audit.sh:6-8 — the whole 8-line file's stated reason for existing
# #104 phase A: `audit` gained a second `[[bin]]` (the duration audit), so the
# ... bare `cargo run -p audit` is ambiguous
cargo run -p audit --bin audit -- source

# scripts/check-effect-interchange-qualification.sh:88-92 — a branch that cannot be taken
if rg -Fq '\"issue\":108' "$benchmark"; then
    bash scripts/check-effect-interchange-benchmark-108.sh
fi

• Problem: several distinct decay points, all verified by whole-repo search:
  • stem-publisher (568 lines) — its binary is invoked by nothing executable, and no crate
    depends on it. Its only references are workspace membership, Cargo.lock,
    docs/FLAC_DELIVERY_V1.md:43 (prose), and fixtures/flac-delivery/v1/generate.py:92 calling the
    dead name miso-engine-stem-publisher.
  • catalog-migrate (564 lines) — same: prose in docs/FLAC_CATALOG_REHASH_RUNBOOK.md:38,44 and
    a generate.py:124 call to the dead name miso-engine-catalog-migrate. That fixture generator
    cannot run today — a concrete regression from the Strip the miso-engine- prefix from every workspace crate #308 prefix strip.
  • native-pcm-runner (2,565 lines) — its binary is never invoked; the only occurrence of the
    string is scripts/test-native-pcm-runner-v1-policy.sh:43 writing it into a synthetic manifest.
  • parameter_metadata_lattice_oracle (167 lines) — invoked only from sdk/test/agent-evals.mjs:44,
    i.e. only when scripts/check-sdk-headless.sh:91 runs node --test 'test/*-evals.mjs'. That is a
    real caller, but the tool that proves the SDK's decimal lattice matches the engine's is reachable
    from one glob and named by no script or workflow.
  • scripts/protocol-benchmark-record-validator.jq (48 lines) — zero references anywhere, while
    all three of its siblings are wired (protocol-benchmark-validator.jq ←
    run-protocol-benchmark.sh, graph-benchmark-record-validator.jq ←
    promote-issue006-graph-benchmark.sh, rack-benchmark-record-validator.jq ← run-rack-benchmark.sh).
  • scripts/check-effect-interchange-benchmark-108.sh (107 lines) and its policy sibling
    (54 lines) are unreachable: the guard at check-effect-interchange-qualification.sh:88 is
    rg -Fq '\"issue\":108' — an -F fixed-string pattern containing a literal backslash — and
    tools/bench/src/effect_interchange.rs contains no "issue":108 at all (0 matches). Same family
    as Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306: a gate that passes because it looked at nothing.
  • scripts/sweep.sh was deleted in f0509c3f ("Delete the gate scripts nothing ever ran…", Delete the gate scripts nothing ever ran, and wire up the ones worth keeping #319)
    and is still named 24 times, including as an actionable instruction in
    docs/derivations/243-sdk-boot.md:25,35,144,152 (which tells the reader to run
    grep -c '^row ' scripts/sweep.sh) and in scripts/check-sdk-types.sh:6.
  • scripts/trace-source-audit.sh is 8 lines whose entire justification is that audit has a
    second [[bin]]. tools/audit/Cargo.toml declares exactly one ([[bin]] name = "audit"). The
    file's reason to exist is stale.
• Proposed change: decide each explicitly rather than leaving them.
  (1) Fix fixtures/flac-delivery/v1/generate.py:92,124 to the current package names
  (stem-publisher, catalog-migrate) — this is a bug, not a cleanup.
  (2) For stem-publisher, catalog-migrate and native-pcm-runner: either wire the documented
  runbook invocation into a scripts/ entry point that CI smoke-runs, or delete the [[bin]]
  and keep only the library (catalog-migrate and stem-publisher are genuinely used as
  libraries by flac-decoder/each other; native-pcm-runner's library is exercised by its own
  tests). 3,697 lines currently have no proven caller.
  (3) Delete scripts/protocol-benchmark-record-validator.jq, or wire it into
  run-protocol-benchmark.sh beside its sibling.
  (4) Fix the -F guard at check-effect-interchange-qualification.sh:88 (drop -F or drop the
  backslashes) and confirm the 161 lines behind it still pass — or delete both scripts.
  (5) Global find-and-replace of scripts/sweep.sh references: point them at ci.yml's step list, or
  restore an aggregate runner. The four docs/derivations/243-sdk-boot.md sites are instructions a
  reader will actually try.
  (6) Delete scripts/trace-source-audit.sh and call cargo run -p audit -- source at its one call
  site, or rewrite its comment.
• Expected effect: one broken fixture generator repaired; up to −3,900 lines of unproven tooling;
  161 lines of gate either made reachable or removed; 24 dangling documentation references fixed.
• Rulings / constraints checked: Delete the gate scripts nothing ever ran, and wire up the ones worth keeping #319 already established the precedent ("delete the gate scripts
  nothing ever ran"); this is the residue of that pass. The -F guard bug is Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306's family and should
  cite it.
• Verification gate: python3 fixtures/flac-delivery/v1/generate.py must run and reproduce
  fixtures/flac-delivery/v1 byte-for-byte (git diff --stat fixtures/ empty). For (5), a new gate
  row: rg -l 'scripts/sweep.sh' -- . ':!.git' must return nothing.

---

TOOL-15: 70 of 70 .raw.jsonl/.accepted.jsonl pairs under artifacts/ are byte-identical — ~4.5 MB of pure duplication

• Category: architecture
• Class: N/A
• Severity: low
• Location: artifacts/ (42 directories, 285 files, 9.85 MB; 141 .jsonl);
  scripts/run-console-benchmark.sh:266-268 (where the pair is produced);
  scripts/test-rack-benchmark.sh:249-278 (where the distinction is exercised)
• Current code:

# scripts/run-console-benchmark.sh:266-268
artifact_dir="$root/artifacts/$phase_directory"
raw="$artifact_dir/console-benchmark.raw.jsonl"
accepted="$artifact_dir/console-benchmark.accepted.jsonl"

• Problem: measured directly — find artifacts -name '*.raw.jsonl' yields 70 files each with an
  .accepted.jsonl sibling, and cmp reports all 70 pairs byte-identical. Those 140 files are
  9,180 KB of the 9,848 KB in artifacts/, so roughly 4.5 MB (46% of the directory) is a second copy
  of the first. The design intent is sound — raw is what the runner emitted, accepted is what
  survived validation, and scripts/test-rack-benchmark.sh:249-278 proves the runner protects raw
  bytes and rewrites accepted — but in 70 out of 70 sealed runs nothing was ever rejected, so the two
  files never differ. Fixture/artifact sizes are otherwise healthy: the largest tracked file in the
  repository is crates/graph-compiler/src/lib.rs at 440 KB, the largest non-source file is
  fixtures/builtins/v1/reference/filter-response.csv at 400 KB, there are no binaries, and nothing
  needs LFS (see "Things I checked that are fine").
• Proposed change: keep the two-file contract in the runner (it is what makes the rejection path
  provable) but stop sealing both when they are identical: when cmp -s "$raw" "$accepted" succeeds,
  write accepted as a one-line pointer file ({"identical_to":"console-benchmark.raw.jsonl"}) or omit
  it and record the equality in the run's disposition.json. Teach scripts/test-rack-benchmark.sh
  and scripts/test-console-benchmark.sh the pointer shape so the rejection path stays covered. Apply
  retroactively to the 42 sealed directories in one commit that states the invariant it verified
  (all 70 pairs equal at the time of the change).
• Expected effect: ~4.5 MB out of the working tree and out of every future clone's pack. Modest —
  the .git pack is 50.4 MiB, so this is roughly a 9% reduction in repository size, and no evidence is
  lost because the equality is what is being recorded.
• Rulings / constraints checked: sealed evidence must remain verifiable — this is why the change
  must record, in the commit, that all 70 pairs were byte-equal before the collapse, and why the
  pointer file (not deletion) is the safer form. Do not touch artifacts/*/​*.md or the disposition
  files.
• Verification gate: before the change, for f in $(find artifacts -name '*.raw.jsonl'); do cmp "$f" "${f%.raw.jsonl}.accepted.jsonl" || echo DIFFER "$f"; done must print nothing. After, every
  *-benchmark-record-validator.jq must still validate the raw stream, and
  bash scripts/test-rack-benchmark.sh + bash scripts/test-console-benchmark.sh must stay green.

---

TOOL-16: the SDK's canonical Session writer hand-transcribes the Rust field walk while a working Rust→TS codegen pipeline sits beside it

• Category: dry
• Class: N/A
• Severity: medium
• Location: sdk/src/internal/session-json.ts:13-27 (ROOT_KEYS), :35-46 (INTEGER_KEYS),
  :47-62+ (FLOAT_KEYS); the Rust authority — crates/session/src/canonical.rs:11,16
  (canonical_session_json, write_canonical) and crates/session/src/visit.rs:145-152 (the typed
  field walk); the pipeline that already exists — sdk/codegen/generate.mjs:172,
  sdk/src/generated/abi.ts:1-3, tools/parameter-metadata/src/abi_layout.rs:1-19,
  scripts/check-sdk-generated.sh
• Current code:

// sdk/src/internal/session-json.ts:29-46
/**
 * Every numeric leaf key in the schema, by JSON schema type.
 *
 * A number in the model does not say whether the schema calls it a `u32` or an `f32`, and the two
 * spell differently: `0` versus `0.0`. Every leaf is therefore transcribed from the Rust field
 * walk, and an unlisted numeric leaf fails loudly.
 */
const INTEGER_KEYS: ReadonlySet<string> = new Set([
  "schema_version", "sample_rate_hz", "quantum_frames", "channels", "bit_depth",
  "left_source_channel", "right_source_channel", "delay_samples", "smoothing_samples",
  "parameter_id",
]);
const FLOAT_KEYS: ReadonlySet<string> = new Set([ "trim_db", "hpf_hz", "lpf_hz", … ]);

// sdk/src/generated/abi.ts:1-3 — the pattern this file should follow
// @generated by sdk/codegen/generate.mjs from sdk/assets/miso-engine-v1-abi-layout.json; DO NOT EDIT.
// That JSON is the engine's own `parameter-metadata` output; run
// `npm run assets` then `npm run codegen` in sdk/ to refresh both.

• Problem: the comment is honest about what it is — "transcribed from the Rust field walk" — and
  transcription is exactly what this repository has already replaced everywhere else it mattered.
  tools/parameter-metadata/src/abi_layout.rs:1-19 records the precedent in the strongest possible
  terms: "issue TypeScript SDK: @misofm/engine — typed control surface, dual runtime, agent-first #207's N-13(d) counted five independent hand-written copies of the boot configuration
  table; the fifth wrote a 192-byte struct's offsets into a 64-byte buffer and was silently producing
  garbage." The fix there was to emit the table from Rust through offset_of! into
  sdk/assets/miso-engine-v1-abi-layout.json, generate sdk/src/generated/abi.ts from it
  (sdk/codegen/generate.mjs), and gate byte-for-byte with scripts/check-sdk-generated.sh and
  scripts/check-abi-layout-v1.py. sdk/src/generated/catalog.ts (3,435 lines) uses the same
  pipeline. session-json.ts's three key tables — the root key order and the integer/float leaf
  classification, which is what decides 0 versus 0.0 in canonical output — are the sixth copy, and
  the only defence is that an unlisted key fails loudly. A key listed in the wrong set does not:
  it silently emits 0 where the engine emits 0.0, producing a document the engine's canonical
  writer would spell differently. crates/session/src/visit.rs already exposes the typed walk this
  would be generated from, and crates/session/src/canonical.rs:292 already has a
  canonical_writer_corpus_is_rust_generated_and_current test — so both halves exist.
• Proposed change: extend the existing pipeline rather than inventing one.
  (1) Add a --emit-session-schema mode to tools/parameter-metadata (or a new subject) that walks
  crates/session's typed model via crates/session/src/visit.rs and emits
  sdk/assets/miso-engine-v1-session-schema.json = { rootKeys: [...], integerKeys: [...], floatKeys: [...] }.
  (2) Generate sdk/src/generated/session-schema.ts from it in sdk/codegen/generate.mjs, with the
  same @generated … DO NOT EDIT banner.
  (3) sdk/src/internal/session-json.ts imports those three sets instead of declaring them; its
  serializer logic (which is genuinely SDK-side and must stay) is unchanged.
  (4) scripts/check-sdk-generated.sh picks the new file up automatically.
• Expected effect: one owner for the leaf-type classification; a wrong-set key becomes impossible
  rather than merely loud-on-omission; ~50 hand-maintained lines become generated. sdk/src/core/decimal.ts
  and sdk/src/core/lattice.ts should not be changed — they are deliberate independent
  reimplementations (JS toFixed rounds half-away-from-zero, Rust format!("{:.*}") rounds
  half-to-even, sdk/src/core/decimal.ts:1-22) and they already have an oracle in
  tools/parameter-metadata/src/bin/lattice_oracle.rs.
• Rulings / constraints checked: the SDK must run in a browser with no Rust engine loaded, so the
  writer has to exist in TypeScript — this proposes generating only the tables, not the logic. The
  canonical bytes must not move: crates/session/tests/canonical_schema.rs:30
  (checked_in_fixtures_are_exact_canonical_bytes) and tools/session-validator's
  canonical_output_reproduces_the_checked_in_canonical_fixtures (tests/validate.rs:394) are the
  fixed points.
• Verification gate: bash scripts/check-sdk-generated.sh (regenerates and diffs),
  bash scripts/check-sdk-types.sh, bash scripts/check-sdk-headless.sh (runs
  sdk/test/writer-evals.mjs, which compares the SDK's canonical output against the checked-in
  fixtures/session-canonical corpus), and cargo test -p session --test canonical_schema.

---

Summary table

id	category	class	severity	location	one-line
TOOL-1	dry	N/A	high	tools/bench/src/session.rs:446-585	140-line hand-written SHA-256 beside bench_support::digest::sha256_hex; the policy gate's regex cannot see it
TOOL-2	dry	N/A	medium	tools/audit/src/vectorization.rs:293-295	a tenth JSON escaper, and one of the invalid kind (control chars raw); six json_string* copies the gate's anchor misses
TOOL-3	dead-code	N/A	medium	tools/audit/src/main.rs:31-50	six audit subjects (4,720 lines, 31% of the crate) invoked by no script, workflow or doc
TOOL-4	crate-boundary	N/A	medium	tools/audit/src/fixture_builtins.rs:2675-2870	two JSON readers in one 6,025-line file for the same records; neither is the workspace's
TOOL-5	dry	N/A	medium	scripts/check-effect-runtime-fixtures.sh:5-24	MANIFEST.tsv has 4 Rust owners + 3 shell verifiers; the LC_ALL=C fix exists in only one copy
TOOL-6	dry	N/A	medium	tools/audit/src/source_duration.rs:231-248	nine hand-rolled RIFF/WAVE writers; crates/source owns the reader and nothing owns the writer
TOOL-7	dry	N/A	medium	tools/native-pcm-runner/src/lib.rs:393-431	re-implements stem-hasher's wave→canonical-PCM→SHA-256 and the launch bit-depth set without depending on it
TOOL-8	dry	N/A	medium	tools/bench/src/floor.rs:47-131 ↔ scripts/console-benchmark-record-lib.jq:53-72	the two floor tables are compared only in an operator-only run, never in CI, and never by key set
TOOL-9	dry	N/A	medium	tools/bench/src/console.rs:1678-1712	7 Metadata structs, 4 Percentiles, 4× three formatters, 18 mega format! record templates
TOOL-10	dry	N/A	low	tools/wasm-gates/src/lib.rs:251-262 ↔ tools/wasm-console/src/main.rs:299-325	two wasmtime embeddings, two digest-word protocols, two runtime pins; the 5-crate split itself is justified
TOOL-11	dry	N/A	high	scripts/check-workspace-policy.sh:20-50	scan_forbidden fixes #306's bug and 20 sibling gates re-implement the broken form; 5 copies of one awk
TOOL-12	dry	N/A	medium	scripts/test-rack-policy.sh:20	35 mutation harnesses / 5,610 lines with 12 verbatim expect_failure copies and no shared harness
TOOL-13	architecture	N/A	high	.github/workflows/ci.yml:68-70,376-388,440	zero Rust caching, 12 cold jobs, 27 wasm32 builds/PR, shipped worklet built 3×, cargo-fuzz built 3×
TOOL-14	dead-code	N/A	medium	fixtures/flac-delivery/v1/generate.py:92,124	3 uninvoked binaries, 2 dead crate names breaking a generator, an orphan validator, a deleted sweep.sh cited 24×
TOOL-15	architecture	N/A	low	artifacts/ (scripts/run-console-benchmark.sh:266-268)	70/70 raw/accepted jsonl pairs byte-identical: ~4.5 MB of the 9.85 MB is a second copy
TOOL-16	dry	N/A	medium	sdk/src/internal/session-json.ts:13-62	the canonical-JSON leaf-type tables are hand-transcribed from Rust beside a working Rust→TS codegen pipeline

---

Things I checked that are fine

• clippy.toml (83 lines, 6.9 KB) is correct and well-argued. It sets one key,
  disallowed-methods, with 36 entries: 34 platform transcendentals (f32/f64 × exp, exp2, ln,
  log2, log10, powf, powi, sin, cos, tan, atan, atan2, sinh, cosh, tanh,
  exp_m1, ln_1p) under D6, plus math::fast_db::fast_level_db and math::fast_db::fast_gain_from_db
  under Legacy engine learnings: what v1 and engine-v2-old do better, synthesized before deprecation #144 item 5. No stale entries: all 34 std paths resolve, and both fast_db paths exist
  (crates/math/src/lib.rs:44, crates/math/src/fast_db.rs:214,225). sqrt is deliberately absent
  with a stated reason (IEEE 754 specifies it exactly). 44 of the 83 lines are comments, and they are
  load-bearing: they record that check-math-policy.sh and check-fast-db-seal.sh were retired into
  this file, and argue correctly that disallowed-methods beats a grep gate because it resolves a path
  in the AST rather than a directory string — the exact blindness Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306 documents. They also record why
  check-unfused-seal.sh was evaluated for the same migration and kept as a script (four of its six
  rules are presence, cfg-absence and tree-wide-count rules that #[expect] cannot express). This is
  the right shape; a shared lint crate with #![deny] attributes would be strictly worse, because
  #[expect] gives the bidirectional ratchet (rustc errors when an expectation stops being needed)
  that a deny + allow pair does not.
• .cargo/config.toml (8 lines) — one scoped [target.'cfg(target_arch = "x86_64")'] rustflags
  entry pinning +avx2,+fma, with check-workspace-policy.sh enforcing that exact shape and forbidding
  -C target-cpu and a global [build] rustflags. Correct and minimal.
• fuzz/ (9 targets, 279 lines) — thin fuzz_target! shells over public APIs
  (protocol_command/protocol_response are 4 lines each). No logic duplicated from crates/. The
  fuzz/Cargo.toml is a separate workspace with its own lock, which is standard cargo-fuzz. The only
  issue is CI-side (three from-source cargo install cargo-fuzz, TOOL-13).
• fixtures/ (2.9 MB, 192 files) and repository size generally — nothing needs LFS and nothing is a
  committed build product. The largest tracked file is crates/graph-compiler/src/lib.rs (440 KB); the
  largest non-source files are fixtures/builtins/v1/reference/filter-response.csv (400 KB),
  fixtures/builtins/v1/cases.toml (384 KB) and three console session JSONs (296–352 KB), all
  text, all with generators and manifests. .gitignore already covers the CARGO_TARGET_DIR=. spill
  that once put 235 build files on main (104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104 phase D). Only artifacts/ has real waste (TOOL-15).
• tools/session-validator (897 lines) — a model tool. It depends on exactly builtins-compiler
  and session, runs the four real pipeline stages in the real order, reports the engine's own typed
  diagnostics, and re-implements nothing (tools/session-validator/src/lib.rs:1-42 explains why it does
  not even duplicate the JSON grammar). Its serde_json is [dev-dependencies] only.
• The five-crate wasm split is justified and should not be collapsed: the two guests must be
  cdylib-only because a cdylib lib target is built with panic = "abort" and cannot link into an
  unwinding test harness (tools/wasm-gate-guest/Cargo.toml:8-13), and wasm-gate-corpus /
  console-workload must be rlibs so the native leg links the identical code rather than a
  transcription. Only the host halves duplicate (TOOL-10).
• sdk/src/core/decimal.ts (195 lines) and sdk/src/core/lattice.ts (293) reimplement Rust's
  half-to-even fixed-precision rendering in BigInt, deliberately, because Number.prototype.toFixed
  rounds half-away-from-zero and would put the whole rank numbering one off from the first exact tie
  (sdk/src/core/decimal.ts:1-22). They are proven against the engine by
  tools/parameter-metadata/src/bin/lattice_oracle.rs. Correct duplication; leave it.
• sdk/src/generated/{abi,catalog,provenance}.ts (4,203 lines) are genuinely generated from the
  engine's own parameter-metadata output through sdk/codegen/generate.mjs, banner-marked, and gated
  byte-for-byte by scripts/check-sdk-generated.sh and scripts/check-abi-layout-v1.py. This is the
  pattern TOOL-16 asks session-json.ts to join.
• bench_support::{alloc,stats,timing,digest,metadata} themselves are the right abstractions and
  are correctly enforced for what they cover — timing::timed samples the digest sink's update counter
  on both sides of the clock and panics if the timed body hashed anything, which makes "no evidence
  collection inside the timer" a property of the run rather than of a review
  (tools/bench-support/src/digest.rs:8-14). The gap is that the layer above them was never shared
  (TOOL-9) and that the gate's regexes are anchored too tightly (TOOL-1, TOOL-2).
• The path router (scripts/ci-path-router.py, 135 lines, + check-ci-path-routing.py 467 and
  test-ci-path-routing.py 454) is fail-safe by construction — empty diff, unrecognized path,
  malformed rename, failed git diff, or workflow_dispatch all yield full — and the
  qualification aggregator jobs assert the heavy jobs' results match the route, so a route cannot
  silently weaken a check. It does not cause the CI duplication in TOOL-13; it just never removes it on
  the full route.
• Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306 and Sidecar architectural disjointness is asserted in AGENTS.md but enforced by nothing #307 are not restated here. TOOL-11 is the DRY half of Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306's fix and should land with
  it; TOOL-14's -F guard bug at scripts/check-effect-interchange-qualification.sh:88 is a new
  instance of Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306's family and is reported there rather than in Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306.

[tamashi095]

Wave 0 split into issues (2026-09-04)

Each is self-contained (finding verbatim, constraints, done-when). Verifier for all: Fable 5.1. Pick only issues whose "Land after" is closed.

issue	rows	implementer	land after
#366	LANE-3	Codex	none
#367	LANE-4 (pulled forward from Wave 2 so #368 recounts once)	Codex	#366
#368	LANE-13	Codex	#367
#369	IO-4	Codex	none
#370	IO-5, rescoped 2026-09-04 to doc corrections; queue kept, drain deferred to a separate feature brief (after #369); IO-6 becomes eligible in Wave 2	Qwen 27B	none
#292	IO-9	Codex	none
#371	RT-16 + IO-14	Qwen 27B	none
#306	TOOL-11 step 1	Qwen 27B	#371
#372	LANE-9	Qwen 27B	none

• Make AArch64 lane max/min unfoldable and run lane tests on an aarch64 CI leg #366
• Add exp2_int_in_range so fast_db and lane_math skip the dead clamp #367
• Re-derive the effect floor inventories against current lane lowerings #368
• Replace MockProvider with a session-backed control provider in capi #369
• Wire a render-side drain for the accepted-automation queue or retire it #370
• console track ids are read through the source-id buffer — silent RESULT_INTERNAL when a track id outsizes every source id #292
• Make check-realtime-policy.sh scan every marked file and mark rack, builtins and host-web #371
• Gate scripts read rg exit 2 as "no violation", and none assert non-vacuity #306
• Update the native vectorization allowlist to the unfused truth and forbid calls inside kernels #372

Wave 1 is split after every box above is checked.