AUDIO
Source snapshot · 12 October 2026

RAVET feature catalogue

Current capabilities and their limits. Implemented features remain within the stated scope; public APIs are provisional. Prototype integrations need further validation. Planned and deferred capabilities are not usable features.

See Getting started for commands, work status for executed validation, and maintenance for status definitions and update rules.

Topics in this guide

Feature overview

Feature Status Behavior or intent
Portable processor lifecycle Implemented Validated preparation, variable and zero-frame blocks, reset, deactivation, and atomic rejection with silence on faults.
Allocation-free no_std processing foundation Implemented Existing portable audio/event/lifecycle/schema contracts work without std or an allocator, with pure-Rust parameter math and target-gated snapshots.
Fixed-capacity embedded audio adaptation Implemented An explicit no_std adapter owns fixed planar f32 scratch, preflights complete interleaved f32/i16/i32 blocks and preserves event timing, fault silence and backing tails.
Embedded gain and native Arduino processing subset Prototype An allocation-free Rust stereo gain and caller-owned C ABI accompany a header-only C++11 stereo adapter/reference for Arduino cores without a Rust archive.
Extended processing capabilities Implemented Portable f32/f64 processor specializations support bounded multichannel/auxiliary buses, borrowed event output and latency/tail declarations; CLAP forwards validated block-start transport.
Borrowed planar audio buffers Implemented Safe in-place and separate input/output f32/f64 views validate channel lengths and expose active frames while preserving backing tails; stereo frame mapping selects storage outside the sample loop.
Sample-timed input events Implemented Bounded parameter values/gesture boundaries/modulation amounts, note and validated MIDI short-message events use stable IDs, physical values, ordered offsets, and preserved same-frame order. Zero-frame events use offset zero.
Portable transport context Implemented Process blocks carry optional positions, tempo, playback state, and a discontinuity indication.
Extended block-start transport metadata Prototype Optional portable details and checked bidirectional CLAP conversion preserve recording, active loop, pre-roll, signature, bar and tempo increment metadata.
No-input instrument contract Implemented Foundation represents mono/stereo instruments without audio inputs; a test instrument exercises note timing and output initialization.
Bounded coherent word snapshots Implemented Fixed atomic word arrays provide one-attempt coherent reads, complete publications, and conditional updates that preserve newer control restores.
Prepared acyclic processor routing Prototype Owned portable f32/f64 nodes run in compiled topological order with channel mixing, parallel dry/wet routes, prepared latency compensation, bounded scratch and conservative tail declarations.
Prepared dynamic graph handoff Implemented One prepared FIFO f32/f64 graph replaces the active graph per valid block, with bounded ownership queues and control-thread retirement.
Explicit graph event routing Implemented Filtered host/node generated events share audio/event topology, bounded stable sample-offset merging and complete host output publication.
Explicit prepared graph audio-owner sessions Implemented Optional no-op processor session hooks bracket static/dynamic graph processing with non-Send owner guards, reverse stop/rollback and stopped control retirement.
Typed graph stages and shared-control mono histories Implemented Concrete const-index tuple stages reuse canonical graph execution, guarded audio ownership and explicit bypass; generic mono kernels share one prepared control object with separate native histories.
Prepared CLAP f32 main audio graph node Implemented Main-activated native audio maps through bounded prepared f32 graph scratch, owner-confined sessions and stopped-token main deactivation/recovery.
Prepared CLAP native f64 main audio graph node Implemented A separate f64 factory validates advertised port support before activation and keeps native/graph samples wide through shared owner-confined lifecycle and stopped main retirement.
Prepared CLAP packed native audio ports in graphs Implemented Explicit f32/f64 factories preserve separate native port/channel boundaries while graph routes address directional summed channel indices, including sidechain inputs and auxiliary outputs.
Opt-in hosted CLAP block-start transport Implemented Checked portable context maps into flagged native tempo/beat/seconds fields for explicitly enabled stopped f32/f64 graph nodes, preserving independent steady clocks and rejection before native rendering.
Prepared CLAP graph global parameter input Implemented Explicit f32/f64 factories validate product-to-native parameter identities/ranges on main, then deliver exact ordered global values through bounded audio-owner process or zero-frame flush.
Prepared CLAP graph global parameter output and builder Implemented A preparation builder selects independent fixed port/transport/parameter profiles; bounded mapped native global output, including read-only values, publishes through portable graph event routes.
Prepared CLAP graph selected note and MIDI input Implemented The f32/f64 preparation builder validates an explicit native note-port index/dialect and delivers ordered mixed parameters, CLAP notes, short MIDI/MPE or framed UMP through fixed audio-owner input slots.
Prepared CLAP graph selected performance output Implemented An independent selected native output index/dialect publishes representable CLAP notes, short MIDI/MPE or framed UMP through shared bounded graph event slots and explicit routes.
Guarded main-owned editors for native graph nodes Implemented Retained native graph control creates an exclusively borrowed PluginEditor while separately owned audio may run; bounded main callback servicing preserves restart/process requests.
Buffered f32 graph-worker device output Prototype A prepared no-input graph retains its audio-owner session on an explicit worker and publishes retained whole-frame queue suffixes; a separate output processor silences/counts underflow with live atomic diagnostics.
Queued audio input for native graph workers Prototype Explicit matched input/output rings feed fixed f32 graph worker blocks, zero input shortages and preserve once-only input consumption through retained output publication.
Buffered worker input-clock conversion Prototype An explicit worker reuses prepared sinc/FIFO clock correction to publish graph-rate f32 input, retaining destination suffixes without repeated capture consumption or conversion.
Live prepared graph replacement in buffered workers Prototype Already-prepared dynamic f32 graph engines share fixed worker input/output queues and consider live offers only after old audio suffixes publish, retaining main-owned retirement.
Bounded event input for buffered graph workers Implemented Fresh graph-worker renders accept ordered staged input and acknowledge consumption; retained queue suffix pumps leave new events/context untouched without repeating native input.
Bounded generated output from graph workers Implemented Fresh buffered graph renders publish caller-owned generated-event prefixes once, independent of partial audio queue publication, with exact prepared output capacity.
Complete bounded event batches for graph worker/control handoff Implemented Fixed SPSC batches atomically publish validated events with opaque tags/context; prepared consumer storage retains immutable batches until explicit acknowledgement for input or output delivery.
Bounded CLAP audio-owner processing handoff Implemented Main-activated stopped processors enter a non-Send native audio owner, replace through bounded SPSC retirement and return stopped tokens for main-thread deactivation.
Prepared interleaved audio handoff ring Implemented Unique SPSC endpoints atomically transfer whole interleaved f32 frame prefixes with explicit backpressure and untouched consumer tails; unique-producer Drop permanently publishes retirement for stopped-finalization proof.
Native-precision CLAP main-bus effects and instruments Prototype Prepared main-bus adapters map 0..64 inputs/1..64 outputs at native f32/f64 precision, global parameters, selected-port short MIDI and validated block-start transport.
Native CLAP auxiliary bus bridge Prototype Native f32/f64 main and ordered auxiliary buses use independent compact input/output ports, complete input preflight and prepared sample/event storage.
Explicit bounded CLAP generated-event delivery Prototype Native main-bus processing maps bounded physical parameter values/global gesture boundaries/modulation amounts and selected-port MIDI/normalized notes into core host events, with separate DSP/delivery status and explicit prefix rejection.
Explicit native CLAP performance ports in exported adapters Prototype Selected native input/output ports preserve optional note IDs, unquantized f32 note velocity and all seven standard f64 expressions independently of raw MIDI/UMP routes.
Prepared interpolated peak estimates Implemented Explicit finite Kaiser-sinc 4/8/16-phase peak measurement with immutable CONTROL design, single/1..64-channel streaming owners, complete stopped tail and separate sample/source/work observations.
Prepared calibrated loudness and loudness range Implemented Explicit calibrated K-weighted M/S/I/LRA with rational 10-Hz windows, independent channel roles, full log-domain programme records, retrospective gates/ranks, programme pause/resume and exclusive stopped analysis.
Explicit scoped native floating-control ownership Implemented A separate optional numerical boundary provides thread-bound no_std scopes with exact prior control/status restoration, actual flush-profile admission and failure-owned optional Processor integration.
Explicit packed float values and prepared vector slices Implemented Explicit Scalar/NEON/SSE2 f32x4/f64x2 values and lane masks provide full arithmetic, comparison, bit selection, transforms and declared reductions; prepared no_std slice operations admit complete prefixes and channel banks before edits.
Endpoint-scoped values and modulation in exported CLAP adapters Prototype Distinct portable f64 scoped parameter events, independent native input/output selectors and explicit per-scope metadata flags preserve voice-target information without editing global state.
CLAP audio and event bridge Prototype Clack-backed preallocated scratch storage adapts mono/stereo f32 effects and global parameter values to the portable processor.
Reusable native f32/f64 planar processor adaptation Prototype SDK-independent prepared main/auxiliary scratch, checked raw bus pointers, complete typed event preflight and copied-input output rendering adapt exclusively borrowed portable processors to consumer native shims.
Consumer-selected native processor lifecycle entry Prototype A reusable opaque owner and immutable exported v1 table compose prepared f32/f64 multibus processing, complete native events/transport, lifecycle and latency/tail queries for consumer-selected processors; Gain exposes the entry alongside its existing ABI.
Canonical native table acquisition Implemented Runtime acquisition preserves exact immutable processor/parameter/cache/audio-state/state/telemetry table addresses across exports and transitive companions.
Bounded native global schemas and complete state Prototype An optional paired native facade table exposes stable-ID f32 schema metadata, UTF-8 roles/ranges, pure mapping, revalidated complete snapshots and atomic decoded-state recall; Gain's thin facades retain canonical and explicit legacy codec behavior.
Explicit native live global state publication Prototype An opt-in paired native table provides independent coherent publication objects, controller complete-state decoding, prepared audio apply and conditional reflection that preserves newer restores and ongoing smoothing.
Explicit trusted VST3 catalogue ownership Prototype Default-disabled caller-linked Rust provider ABI and thread-restricted module owner compose an external-SDK native loader and immutable whole factory/class catalogue.
Scoped trusted VST3 instances and main f32 audio Prototype An independent caller-linked ABI-v2 table retains native component/controller ownership and lends one non-escaping audio capability from main-owned Rust instances.
Owned VST3 controller parameters and timed input Prototype An exact-table-paired companion owns stopped controller metadata/control and delivers bounded immutable sample-timed parameter queues through the scoped audio owner.
Owned stopped VST3 component/controller state Prototype An exact-table-paired companion captures owned opaque component/controller snapshots and applies bounded stopped state with explicit partial-failure poisoning and retained-stream lifetime.
Prepared hosted VST3 events and block context Prototype An exact-paired stopped catalogue and main-f32 audio companion copies selected buses/MIDI assignments, owns all input event payloads and publishes complete verified event/parameter output batches with independent native failure facts.
Hosted VST3 native 32/64 aux buses and owned Graph banks Prototype Default-disabled vst3-hosted-audio companion negotiates explicit main/aux bus profiles in native f32/f64, processes complete rich lanes through the scoped capability, and owns hosted children as canonical Graph processors retained by a bounded MAIN retirement registry.
Framework events in hosted VST3 Graph nodes Prototype Opt-in per-node translation of ordinary RAVET parameter values, notes, note expression, poly pressure and block-start transport into hosted VST3 Graph-bank children, through declared parameter routes and scales, a selected note bus with an explicit note-ID policy, refuse/ignore policies and an explicit merge order with rich lanes.
Hosted VST3 editor ownership (macOS NSView) Prototype Default-disabled vst3-editor companion creates a controller IPlugView on the main thread, attaches it to a caller-owned NSView, negotiates bounded sizes, handles IPlugFrame resize requests with explicit reentry policy, and releases the view before controller, component and module retirement.
Graph-bank child editors and controller edit gestures (macOS NSView) Prototype A Graph-bank child can open its MAIN-thread NSView editor while the bank processes AUDIO on a worker, and an opt-in edit-gesture companion delivers paired controller beginEdit/performEdit/endEdit to the processor at offset 0 of the next dispatched block (the edit wins over a same-id block point) and to the host as ordered events with framework gesture/value identity, under an explicit restartComponent policy.
RAVET reference VST3 modules for hosted-VST3 tests Prototype Keyed Sidechain (stereo main plus mono/stereo auxiliary key, output main*key) and Event Probe (all nine SDK input event kinds and parameter points rendered as exact-offset impulses with FNV-1a payload hashes, echoed output events, an echoed-event count CC and a digest parameter) are built from portable Foundation processors and tested as actual loaded modules through the native provider, a direct SDK robustness harness and the Rust vst3-hosted-audio Graph bank.
Optional asynchronous AUv3 host ownership and joined main-bus audio Prototype Default-disabled ravet-host au-hosting feature over a caller-linked authored macOS provider: explicit bounded registry catalogue, AUAudioUnit asynchronous instantiation with nonblocking main poll, observed-load-mode admission, stopped mono/stereo f32 main-bus preparation and joined scoped rendering through the public cached renderBlock.
Prepared native AAX main and auxiliary audio buses Prototype Fixed planar host-f32 mapping and stopped native layout/SDK profile composition adopt an actual Rust main/detector/monitor processor through initialized registered AAX callbacks.
Prepared raw short MIDI AAX effect and auxiliary mapping Prototype Opted-in native main and multibus effects combine complete short MIDI, queued scalar/state intent, native transport and both prepared auxiliary directions under one AUDIO admission token.
Explicit AAX generated short-MIDI output Prototype Opt-in fixed-capacity native AAX owners preflight generated short messages and register SDK output nodes, with exact partial-delivery facts and guarded process admission.
Native silent note-routing reference Prototype A separate exported native32/64 note producer scales Level and preserves bounded canonical note routing with explicit exact channel/key release lowering and complete state.
Portable native main, detector and monitor routing reference Prototype Paired f32/f64 native processor/schema/cache/audio-state/codec/telemetry exports provide mono/stereo main gain/bypass and mono detector-to-mono/stereo auxiliary monitor processing.
Native32/64 raw routing and delay consumers Prototype Distinct RawBusRouting and RawDelayRouting exports share authoritative routing/FIFO kernels, observe exact canonical raw MIDI and consume complete two-global state, native transport and stopped telemetry.
Local raw main/auxiliary/timing AAX reference bundle Prototype Six owned initialized AAX factories demonstrate reusable main, both auxiliary orders and raw+dynamic-latency consumption in separately selectable native32/internal64 local bundles.
Native AAX parameter schema and control adoption Prototype External-SDK C++17 immutable native parameter metadata, staged SDK object ownership and exact-identity registered Gain control adoption.
Checked owned native AAX processing and global state Prototype An authored external-SDK AAX_CEffectParameters model owns exact native processor/schema/state companions, checked initial main-bus preparation, bounded block-start control intent and complete native chunks; the default public Gain factories consume it.
Explicit native precision behind AAX float audio Prototype An external-SDK owner explicitly selects exact native32/64 processor/cache/state companions; the prepared64 bridge captures host-f32 inputs, runs the authoritative native DSP once and validates whole output narrowing before host samples or generated MIDI publication.
Bounded native AAX short-note instrument adoption Prototype An external-SDK whole-stream short-note collector and explicit native AAX instrument owner validate timed MIDI before state/queue/DSP transfer; the public Performance instrument consumes them through actual registered SDK factories.
Prepared AAX complete short MIDI input Prototype Explicit raw instrument policy preflights every defined complete MIDI1 short message into canonical native events, with whole combined command capacity and AUDIO admission before SDK getters.
Optional native AAX stopped telemetry composition Prototype AAX native owners compose exact core/precision telemetry caches after whole CONTROL preflight and expose explicit stopped snapshots with output-range protection.
Native Performance AAX instrument reference Prototype Distinct public mono/stereo AAX factories register a sixteen-voice no-input host-f32 Performance instrument with explicit internal native32/64 selection with timed short MIDI notes, complete accepted Level intent and explicit local bundle packaging.
Local AAX-only raw MIDI sine bundle Prototype Separate mono/stereo owned AAX factories consume raw MIDI with complete Level state, initialized transport and optional stopped telemetry in native32 or internal64 behind hostf32.
Checked AAX initial and acknowledged dynamic timing Prototype An optional two-core prepared owner validates initial native/host latency and adopts a complete matching-state replacement only after eligible host acknowledgement.
Initialized native AAX transport capture Prototype An external-SDK output-last collector borrows initialized versioned transport proxies, preserves independent getter availability and raw positions, and forwards checked native transport before pending state or DSP.
Prepared native AAX host meter publication Prototype Reusable external-SDK preparation/registration and the native AAX owner/model compose explicit exact-origin telemetry bindings with complete host tap preflight and staged whole snapshot publication.
Reusable VST3 controller schema registration Prototype An optional external-SDK C++17 helper preflights complete bounded native global metadata, registers root-unit SDK parameters and delegates control mapping to native linear/log/discrete ranges.
Control-cached native global parameter mapping Prototype An immutable control-prepared schema cache provides concurrent provider-free metadata/range reads and atomic bounded normalized-to-physical tagged event conversion; a separate paired native table retains existing ABI layouts.
Explicit native audio-owner complete state Prototype An optional cache-paired companion applies fully validated physical global state and captures reordered complete snapshots on exclusively prepared native processors without control codecs or providers.
Explicit prepared native telemetry Prototype A separate consumer-selected native companion caches stable-ID readout metadata and revalidates complete physical f64 observations with exact u64 windows on exclusively prepared processors; Gain exposes its existing 12 meter fields.
Reusable native C++ client and SDK reference adoption Prototype An SDK-independent C++17 owner composes native lifecycle, optional explicit state and telemetry caches; the Gain VST3 processor consumes it with tagged events and retained controller/program/editor protocols.
Exact native client origin and balanced acquisition Prototype C++ native client admits exact originating state/telemetry core tables with whole CONTROL preflight and balanced partial acquisition.
Explicit VST3 block-start transport mapping Prototype An external-SDK C++17 helper requests/maps canonical available sample/musical positions, tempo, signature and playback/details into native transport; Gain forwards it before pending state or processing.
Explicit VST3 native performance input Prototype An external-SDK C++17 helper maps selected-bus notes, poly pressure and six standard note expressions into canonical native records after complete bounded event-list validation.
Explicit VST3 native performance output Prototype An external-SDK C++17 helper maps representable canonical native notes and expressions into selected-bus SDK output, preflighting the complete stream and reporting exact host-prefix refusal.
Prepared VST3 native audio bus mapping Prototype An external-SDK C++17 fixed profile maps logical native main/auxiliary buses into independent compact SDK directions at native f32/f64, with complete shape/range/output-overlap preflight and bounded fault silence; Gain adopts it.
Prepared VST3 cached global parameter input Prototype Optional external-SDK helpers use precision-matched native caches and validate/copy all raw global queue points before a prepared visitor; Gain uses them for mapped automation with retained program expansion and stable merging.
Complete C-layout native event conversion Prototype Version-one native records preserve every portable event kind with full identities/scoped f64 values, canonical fields and atomic bounded conversion into prepared storage; Gain shares the legacy global parameter decoder.
Exact C-layout native transport snapshots Prototype Independent native availability/flags preserve exact block-start positions, tempo and extended transport while validating semantic dependencies and canonical fields without allocation.
Explicit CLAP discovery and trusted catalogues Prototype Bounded explicit non-loading candidate scans and trusted native entry loading provide owned byte-preserving plugin metadata and live-instance library retention through Clack.
Guarded trusted CLAP editor hosting Prototype A main-thread instance-borrowing guard owns negotiated editor creation, embedded parent attachment, bounded resizing, idempotent show/hide and guaranteed paired destruction.
Coalesced CLAP host requests Implemented Core restart/process/callback requests use an atomic coalesced mailbox with explicit deferral and bounded main-thread callback service.
Bounded hosted CLAP parameters Implemented Owned stable-ID/plain-value metadata, atomic refresh, validated reads and explicit inactive parameter edits borrow the live instance.
Deferred CLAP host parameter callbacks Implemented Opt-in parameter host handlers defer coalesced rescan/flush and bounded exact-ID clear actions while preserving core lifecycle requests.
Bounded hosted CLAP audio metadata Implemented Owned inactive directional port snapshots validate IDs/layout/precision/pairs, with optional main-thread latency and audio-owner tail queries.
Deferred CLAP audio configuration callbacks Implemented Opt-in combined processing host advertises port/latency/tail and parameter callbacks, with atomic coalesced audio-change handoff and explicit deferral.
Borrowed CLAP parameter registration Implemented Portable schemas supply validated complete CLAP count/info metadata with exact physical bounds/defaults, ordered module/process policy and a sole binary bypass; gain consumes the registration.
Explicit global parameter gesture boundaries Prototype Typed stable-ID begin/end events cross parameter graph filters and complete worker queues, map to generated CLAP output and optionally map from hosted native graph output.
Explicit CLAP parameter gesture input Prototype Opt-in native begin/end translation and mapped hosted native input preserve raw boundaries alongside parameter values without automatic state edits or pairing.
Explicit global parameter modulation signals Prototype Finite signed physical modulation amounts remain separate from base values across graph filters/worker queues, opt-in CLAP input translation and generated global CLAP output.
Mapped native global modulation in hosted nodes Prototype Independent builder input/output opt-ins map finite global physical modulation through cached writable native modulatable identities, with reusable explicit CLAP metadata registration.
Mapped scoped values and modulation in hosted CLAP graphs Prototype Explicit mapped native graph directions validate cached scope metadata and preserve full f64 parameter values/modulation, selected input-port voice scope and zero-time flush separately from global state.
Explicit note identities in hosted CLAP graphs Prototype Portable identified On/Off events and opt-in selected native CLAP routes preserve concrete note IDs, timing and velocity without inferred voice policy.
Explicit zero-volume note expression Implemented Portable and native f64 linear volume accepts zero mute and preserves signed zero and positive subnormals through complete event conversion and worker handoff.
Scoped standard note expressions in hosted CLAP graphs Prototype Portable wildcard channel/key/ID targets and opt-in selected native routes preserve seven standard expression kinds with full f64 values.
Scoped note release and choke Prototype Portable wildcard targets carry key release velocity and scalar-free choke through graph queues and selected hosted/exported native CLAP routes.
Directional note completion notifications Prototype Portable completion targets, graph/queue preservation and opt-in native profiles notify controllers on originating note input endpoints independently of release/choke and performance output.
Sample-timed UMP and CLAP packet routing Prototype Framed UMP portable events preserve ordered sample offsets and map to/from selected-port CLAP MIDI2 events without resolution conversion.
Custom transfer functions and clipping waveshapers Implemented Inline caller-owned f32/f64 transfer functions run once per sample, with explicit f64 hard-clip, tanh and cubic soft-clip constructors and in-place/separate block processing.
Prepared biquad filters Implemented Validated normalized stable coefficients and six Q-based and two slope-based shelving cookbook designs drive f64 transposed direct-form II processing and control-thread response inspection.
Fixed cascades and even-order Butterworth designs Implemented Fixed 1..16 validated second-order sections provide f64 cascading, history-preserving replacement and even-order low/high pass Butterworth preparation.
Prepared simultaneous-output state-variable filter Implemented One-channel f64 trapezoidal integrators return low/band/high outputs together with prepared coefficients and retained histories.
Prepared fourth-order Linkwitz–Riley crossover Implemented Fixed-storage one-channel f64 low/high branches use two identical Butterworth sections each, with half-amplitude cutoff and all-pass recombination.
Prepared complex FFT Implemented Precomputed radix-two f64 FFT transforms exact-length caller-owned complex buffers forward or normalized inverse without callback allocation.
Prepared real half spectra and cosine windows Implemented Real forward/inverse transforms reuse full-complex FFT scratch, and explicit window families expose sampled gain/energy/noise bandwidth.
Prepared partitioned FFT convolution Implemented Uniform f64 overlap-add response partitions and a prepared input spectrum ring produce streaming long-response convolution independent of caller block sizes.
Native-precision zero-latency, uniform and nonuniform convolution banks Implemented Prepared f32 and f64 convolution engines run zero-latency direct-head, uniformly delayed and two-stage nonuniform partitioned schedules with 1..64-channel diagonal banks and a native f32 FFT; info reports exact latency, tail, stage layout and storage.
Explicit source-rate impulse-response preparation Implemented Memory or WAV/AIFF/compressed-file responses are prepared at their source rate for a target engine rate with explicit sinc conversion (gain and delay policies), channel mapping, linked threshold trimming with recorded offsets and peak/energy normalization with reported gain, then built into native f32/f64 convolution engines or banks.
Live convolution transitions with worker ownership Implemented A default-disabled ravet-graph feature hands worker-prepared native convolution engines or banks to audio through a bounded one-slot handoff, runs old and new engines through an explicit equal-gain or equal-power crossfade, returns old, refused and superseded engines for control-thread disposal and reports latency changes.
History priming and latency alignment for convolution transitions Implemented Optional continuity policies for live convolution transitions: a prepared input-history ring primes the incoming engine before its fade (single-block or bounded delayed-fade schedule) so it matches a never-switched engine, and prepared delay lines align engines of different latency during the fade, report each output-latency change and refuse differences above a configured maximum.
Stack-backed streaming reconstruction kernels Implemented One-channel f64 hold/linear/Catmull-Rom/cubic/quartic Lagrange reconstruction exposes bounded source/output prefixes and floating or exact integer-rate schedules without heap storage.
Selected-order elliptic designs Implemented Fixed one-channel f64 sections provide elliptic pass and stop ripple with LP/HP orders1..32, band total even orders2..32, genuine finite transformed zeros/parity gains and strict bounded supplied-edge specification selection.
Selected-order Chebyshev I and II designs Implemented Fixed one-channel f64 sections provide both Chebyshev ripple families with LP/HP orders1..32, band total even orders2..32, genuine finite Type II zeros/parity gains and strict bounded supplied-edge specification selection.
Selected-order Butterworth filters and verified specifications Implemented Fixed one-channel f64 sections cover low/high digital orders1..32 and bandpass/bandstop total even orders2..32, with strict bounded pass/stop specification selection.
Prepared FIR coefficient design family Implemented Owned symmetric f64 FIR coefficients cover cosine/Kaiser windowed LP/HP/BP/BS, transparent empirical Kaiser sizing, analytic degree1..4 transitions, weighted integrated least squares and exact-zero windowed halfband.
Sampled equiripple FIR and constrained halfband design Implemented Bounded weighted sampled minimax exchange generates actual symmetric LP/HP/BP/BS and reduced halfband coefficients with immutable error/ripple/extrema/convergence/resource receipts for existing direct and partitioned FIR consumers.
Prepared FIR convolution Implemented Copied finite impulse responses and a prepared f64 history ring produce streaming direct convolution with reset and explicit tail length.
Selectable streaming oversampling Implemented Stack-backed 1x/2x/4x/8x half-band cascades invoke caller-owned high-rate DSP in temporal order with persistent filter state and allocation-free reset.
Native first-order topology-preserving filter family Implemented Prepared native f64/f32 first-order trapezoidal LP/HP/allpass designs, simultaneous one-update outputs and fixed independently channelled banks expose explicit preserved/reset capacitor histories with whole-prefix validation.
Native six-stage modulated feedback phaser Implemented Prepared native f64/f32 independently channelled six-stage TPT allpass phaser with explicit log-frequency LFO/phase offsets, signed delayed feedback, exact dry/wet endpoints and full-prefix state preflight.
Native nonlinear multimode ladder Implemented Prepared native f32/f64 six-mode four-RC ladder with an explicit single feedback-summing tanh model, bounded amplitude-scaled implicit solve and independent multichannel histories.
Prepared panning curves and pair ramps Implemented Seven explicit panning laws with unity-endpoint/center normalization, native f64/f32 prepared gains, exact frame-count pair ramps and reusable mono-to-stereo/stereo-balance prefix consumers.
Paired native dry/wet queues and latency compensation Implemented Seven direct wet-coordinate mixing laws/two normalizations, native f64/f32 independently pushed delayed-dry FIFO and wet consumption with shared exact pair ramps, four causal latency profiles and atomic whole-prefix admission.
Native peak and RMS attack/release ballistics Implemented Explicit prepared f64/f32 peak and scaled-energy RMS followers and fixed independent channel banks provide sample/planar ballistics with whole-prefix preflight, observable native timing and caller-only history policies.
Configured elliptic allpass halfband and oversampling Implemented Immutable selected or edge-sized f64 and explicit rounded f32 halfband profiles feed full-rate complementary filters, independent polyphase 2x and per-stage 1/2/4/8 cascade consumers with actual numerical and native Graph evidence.
Streaming two-times oversampling Implemented One-channel fixed half-band IIR interpolation and decimation preserve stream state across blocks and reset without allocating.
Prepared arbitrary-ratio sinc resampling Implemented A prepared causal f64 windowed-sinc converter interpolates phase tables, reports exact consumed/produced prefixes and preserves pending output under backpressure.
Prepared bounded live sinc rate adjustment Implemented A conservative prepared cutoff permits symmetric live ppm rate changes without resetting histories, pending phase or replacing storage; allocation-free preflight shares preparation bounds.
Bounded FIFO-depth resampler clock correction Implemented Fixed-state exponential/proportional queue feedback clamps and slews caller-clocked ppm corrections for prepared variable resamplers.
Selectable causal fractional-delay profiles Implemented A prepared one-channel f64 owner processes exactly one temporal output per input using integer, linear, causal cubic Lagrange or first-order Thiran interpolation.
Prepared delay and feedback diffusion Implemented Double-precision circular delay storage supports fractional interpolation, whole-sample reads, separate read/write/advance operations, and a feedback diffuser with allocation-free reset.
Prepared feedforward and feedback comb filters Implemented One-channel f64 fixed-delay combs provide feedforward input echoes or recursive output feedback, with history-preserving validated coefficient edits.
Prepared damped mono Schroeder-style reverb Implemented Four parallel damped combs and two canonical allpasses provide synthetic mono f64 reverberation with prepared delay storage and live wet mixing.
Prepared damped stereo Schroeder-style reverb Implemented Two prepared mono networks use common excitation, bounded right-delay spread and wet width interpolation while preserving dry stereo channels.
Prepared stereo modulated fractional-delay chorus Implemented Independent stereo f64 feedback delays and a shared sine LFO with right phase offset provide bounded chorus modulation, exact dry/wet endpoints and atomic live control edits.
Peak detector and soft-knee compressor Implemented Validated attack/release peak detection and explicit-sidechain f64 soft-knee compression provide prepared per-sample processing and allocation-free reset.
Prepared downward-expansion noise gate Implemented A validated f64 explicit-sidechain gate provides ratio-based downward expansion, quadratic soft knee and finite attenuation floor over a rectified attack/release detector.
Prepared sample-peak limiter Implemented One f64 channel uses instantaneous peak attack, exponential release and symmetric final clipping to limit sampled amplitudes with prepared ceiling/time settings.
Phase-continuous synthesis oscillators Implemented f64 sine, polyBLEP saw/square and naive triangle preserve phase on validated frequency retuning and waveform switching with allocation-free generation/reset.
Prepared periodic wavetable oscillator Implemented Caller-defined finite periodic f64 tables provide wrapped linear lookup without per-sample trigonometry, with phase-preserving frequency changes and reset.
Sample-counted ADSR envelopes Implemented Validated linear attack/decay/sustain/release stages preserve current level on retrigger/release, exact ramp endpoints, immediate zero-duration transitions and allocation-free reset.
Linear parameter smoothing Implemented Finite sample-counted ramps support retargeting, immediate changes, reset, and sample-rate conversion independently of block boundaries.
Positive multiplicative parameter smoothing Implemented Finite positive f32 values transition geometrically over explicit sample counts with retargeting independent of block boundaries, preserved identical targets and exact final snap.
Prepared quadrature rotation Implemented Precomputed double-precision rotations advance caller-owned sine/cosine pairs and fixed banks without allocation or per-sample trigonometric calls.
Native f64 peak and RMS meters Implemented Fixed-storage scaled sum-of-squares preserves native f64 peak/RMS for extreme finite and subnormal samples, with explicit optional bounded f32 telemetry.
Reusable parameter schema and state Implemented Borrowed parameter schemas provide stable IDs, validated linear/logarithmic and discrete mappings, fixed-size complete state records, and explicit ID-based migration.
Observable hierarchical state and undoable presets Implemented An explicit control-thread store provides stable-ID trees, atomic grouped edits, bounded undo/redo, revision subscriptions with resync, and deterministic complete product-identified preset records.
Explicit preset-file libraries Implemented Consumer-selected directories provide sorted bounded preset metadata, validated atomic replacement and complete undoable selected-file recall through observable state.
Immutable complete parameter program banks Implemented Borrowed catalogues validate complete canonical parameter states with unique stable IDs/MIDI addresses and bounded heap-free lookup/copy.
Reusable UI parameter attachments Implemented Stable-ID attachments borrow validated metadata, map physical/normalized linear/logarithmic/discrete input, refresh host values without feedback, and submit explicit gestures through a product transport trait.
Portable MIDI 1.0 short messages Implemented Validated wire-preserving channel/system messages decode controllers, pitch bend and pressure; a nonallocating running-status decoder handles interleaved real-time messages and timed processor events.
Full-resolution MIDI 2.0 channel voice Implemented Typed MT=4 channel voice encoding/decoding preserves velocity, controller and per-note resolution with explicit group/channel addressing.
Fixed-storage UMP framing Implemented Exact one-to-four-word packets, incremental framing, opaque reserved payloads and explicit big-endian serialization.
UMP short messages and SysEx assembly Implemented MIDI 1.0 UMP short-message codecs, SysEx7/SysEx8 payload chunks and caller-buffer single-stream assembly with explicit abort and atomic rejection.
Bounded MIDI voice allocation and configured expression Implemented Fixed 1..128-slot voice ownership provides deterministic stealing, duplicate note-off matching, sustain/sostenuto, pressure/bend/timbre snapshots and configured lower/upper member expression with separate master pressure/timbre.
Bounded normalized performance voice ownership Implemented A separate fixed receiver preserves optional full-u32 note IDs, unquantized velocities and seven exact f64 expressions, with conjunctive targets, explicit retrigger/release/steal/choke/completion and complete timed semantic preflight.
Two-zone MPE voice receiver Implemented A fixed shared voice pool negotiates lower/upper zones with latest-overlap precedence, shared-channel/master notes, independent zone ranges and post-note-off expression rules.
Opt-in single-zone MIDI RPN negotiation Implemented Per-channel RPN decoding drives explicitly selected lower/upper zone configuration, master/member whole-semitone bend ranges and live voice snapshots.
Captured sostenuto voice ownership Implemented CC66 rising edges capture held notes with independent sustain release, channel/MPE-zone isolation and sample-timed sine integration.
Staged MIDI bank and program requests Implemented Sixteen fixed channel selectors stage CC0/32 and emit exact bank/program requests on Program Change, preserving pending/request distinction.
Master-routed MPE program requests Implemented Negotiated single-/two-zone receivers return independently staged master program requests without changing voices; ordinary polyphony retains per-channel requests.
Prepared UMP device packet handoff Implemented Unique SPSC endpoints preserve framed numeric words, explicit protocol labels and opaque timestamps with whole-batch framing preflight and bounded prefix delivery.
Explicit MIDI devices and bounded complete packets Prototype Native midir connections enumerate/select exact ports, receive short/SysEx packets through prepared SPSC storage and send validated packets to explicit destinations.
Guarded macOS CoreMIDI UMP endpoints Prototype Exact-ID protocol-selected native inputs/outputs and owned virtual destinations/sources connect bounded exact-word UMP handoff through guarded native callback lifetime.
Bounded OSC packet codecs and explicit UDP Implemented Explicit worker/control APIs encode/decode padded ASCII OSC messages and nested bundles, preserve borrowed data/timetags and exchange datagrams only with caller-selected numeric endpoints.
Standalone output audio devices Prototype Explicit CPAL enumeration/ID selection and configured f32 output streams adapt owned prepared processors through bounded planar scratch; a CLI runs silent callback validation.
Input capture and FIFO duplex effects Prototype Explicit CPAL f32 input streams publish whole-frame prefixes to a prepared ring; duplex rendering zero-fills underflow, partitions variable callbacks and feeds portable effects.
Prepared explicit clocked duplex conversion Implemented Opt-in FIFO-depth feedback drives aligned per-input-channel sinc conversion into the output-clock processor, with priming and underrun recovery.
Caller-scheduled exact-device output recovery Prototype An explicit control-thread owner preserves healthy f32 output, releases missing/failed streams and prepares/starts fresh DSP through a caller-supplied factory.
Caller-scheduled exact-pair duplex recovery Prototype An explicit control-thread owner releases both streams when either exact device disappears or either backend fails, reopening fresh FIFO/DSP through a caller factory.
Explicit paired clocked callback retirement and original-owner recovery Prototype An additive f32 paired CPAL route retains the unique prepared clocked renderer and matching capture endpoints until all four callbacks retire, then allows stopped file/DSP extraction and explicit owner-preserving recovery.
Caller-scheduled exact clocked duplex recovery Implemented Exact device-pair service releases unhealthy/missing streams and reopens fresh FIFO, conversion/controller and factory-owned processors with shared recovery ownership.
Bounded WAV reading and writing Implemented Explicit worker/control-thread RIFF PCM16/24/32 and Float32 streams use bounded scratch, validated chunks, frame seeking, untouched read tails and explicit recording finalization.
Bounded seekable AIFF PCM streams Implemented Uncompressed big-endian PCM16/24/32 readers and writers provide exact integer extended80 rates, bounded frame decoding/seeking and explicit finalized recording.
Optional FLAC, MP3 and Ogg/Vorbis clip decoding Implemented Explicit bounded encoded bytes decode into finite interleaved f32 clips using pinned opt-in Symphonia, with whole-result errors, stable configuration and gapless trim.
Lazy compressed reads and exact worker seeks Implemented Optional FLAC/MP3/Vorbis reader lazily decodes bounded interleaved reads and atomically seeks exact decoded frames by replaying a fresh decoder.
Verified indexed native-FLAC worker seeks Implemented An explicit compressed-reader mode verifies native FLAC once, retains bounded immutable compressed packets and positions exact candidate seeks by binary search and one packet decode; existing stopped read-ahead generation replacement accepts the indexed reader.
Buffered WAV read-ahead and recording Implemented Worker pumps retain decoded suffixes under ring backpressure, discard old playback generations on stopped seek and drain input capture to bounded WAV recording with explicit finalization.
Compressed prepared-ring read-ahead Implemented Explicit worker pump streams compressed decoded frames into the prepared SPSC ring, retaining backpressure suffixes and clearing old generations only after successful stopped seeks.
Automatic recorder worker ownership and explicit finish Implemented A control-owned automatic worker drives existing WAV/AIFF/FLAC bounded capture-ring recorders, retaining original errors/source ownership and validating reclaimed matching producer identity before bounded final drain/file finalization, including permanent hidden-producer retirement; callback capture remains prepared accepted-prefix push.
Automatic read-ahead ownership and buffered playback Implemented A control-owned automatic worker drives WAV/AIFF/compressed read-ahead with retained backpressure; its prepared callback endpoint provides pause/play, consumed-source position, underrun silence and drained EOF. Matching stopped seek/stop joins, positions and restarts the source; shutdown reclaims source and original error.
AIFF PCM read-ahead and recording adapters Implemented Concrete AIFF read-ahead and recorder wrappers share prepared PCM handoff mechanics with WAV, retain backpressure suffixes, preserve stopped seek generations and finalize bounded ring drains; automatic worker/playback ownership accepts AIFF sources.
Optional lossless worker FLAC encoding Implemented Validated complete signed PCM16/24 clips encode to owned FLAC with fixed blocks, explicit single-worker policy and compliant short-final-block metadata.
Incremental FLAC worker output Implemented Worker-owned seekable sinks emit retained fixed PCM16/24 blocks with prediction-size fallback, explicit budgets/fault poison and finalized count/MD5/frame metadata.
Prepared-ring FLAC capture workers Implemented Explicit worker pumps quantize prepared f32 capture with chosen reject/clip overload policy, incremental FLAC output, dequeue-fault poison and stopped tail finalization.
Prepared memory playback transport Implemented Finite interleaved clips provide sample-counted play/pause/stop/seek, exact half-open looping, complete silence at pause/EOF and source/wrap progress.
Native web editor backends Prototype Local HTML editors use Cocoa/WebKit, Windows HWND/WebView2 or Linux X11/WebKitGTK with finite backing colours, bounded JSON messages, coalesced snapshots and explicit teardown. Cocoa editor views accept initial drags from inactive windows. WebKit browser context menus are suppressed in all frames while consumer right-click actions still receive events.
Cargo macOS WebKit ownership binding Prototype An explicit native crate builds Cocoa/WebKit through Xcode, checks main-thread creation, owns view and callback context, copies bounded snapshots and destroys native callback machinery before releasing state.
Rust-owned macOS editor C ABI Prototype Native consumers create/attach/resize/show/destroy Rust-owned WebViews with counted UTF-8 callbacks, UI-thread status checks and retained exactly-once foreign-context release.
Default standalone Audio/MIDI settings popup Prototype Reusable main-thread standalone windows resize their embedded page with native content and include a native title-bar settings button and standard device/channel-pair/rate/buffer/MIDI checklist popup with persistent exact device selections by default, with explicit full opt-out.
Reusable local web controls Prototype Shared slider/number, linear/logarithmic rotary knob, polyphonic piano keyboard, toggle, choice, action-button and meter components provide explicit gestures/actions, held-key ownership, nonfeedback host refresh and retryable disposal; piano chords/glissando share lifecycle release, disabled keys remain opaque and meter text retains actual overload levels. Shared styles prevent UI label/body text selection while keeping editable fields and code output selectable. Knob and slider/fader pointer gestures leave numeric editing, suppress label activation and pointer focus outlines, and preserve direct number entry and keyboard focus styling.
Prepared paragraph source carets, hit tests and selections Implemented Immutable source identity and extended-grapheme boundaries map shaped cluster advances to bidi/wrap-aware affinity carets, finite hit tests and transactional caller-buffer selection pen boxes.
Bounded local-font paragraph wrapping and SVG outlines Implemented Explicit width, baseline spacing and physical alignment compose Unicode line opportunities with retained paragraph bidi context, source byte clusters and transactional TrueType SVG outlines.
Bounded composite focus and piano keyboard ownership Implemented Explicit local DOM composites supply one roving Tab stop with directional navigation; the shared piano preserves play-key sources and releases notes on focus, visibility, removal and teardown.
Portable layout, themed SVG and scalar animation Implemented Finite geometry and bounded row/column layout connect escaped SVG rectangles, polylines, typed paths and explicit typography/themes with clock-driven scalar tweens.
Shared default semantic UI palette Prototype Portable SVG themes, reusable local web controls, the standalone settings popup and example editors share semantic background/surface/text/accent colors.
Caller-owned contextual local font fallback Implemented Ordered borrowed local fonts select complete extended graphemes using original shaping context, retain exact source/matched-face ownership and feed atomic SVG/CPU renderers; a normal standalone consumer uses the same Rust model.
Exact-face wrapped mixed-direction font-stack paragraphs Implemented Caller-owned immutable faces and grapheme-safe script spans compose original-source bidi, contextual coverage and greedy wrapping; exact-face SVG/CPU consumption and one shared standalone Rust model preserve whole transitions and measured resize.
Explicit selected-instance CFF1 and CFF2 text outlines Implemented Default-disabled PostScript outlines reuse the caller-owned text reader and exact normalized variation instance for existing SVG and CPU renderers, with whole metadata/profile admission and output rollback.
Explicit copied system fonts and styled standalone rendering Implemented Opt-in portable copied catalogue tokens and macOS main-thread CoreText discovery/load preserve exact style identity and feed a normal paged standalone Rust text-rendering consumer.
Opt-in native CFF source loading and standalone renderer consumption Implemented Explicit macOS PostScript font loading copies the exact admitted CoreText selected source into checked OTTO and feeds the normal shared standalone selection model, SVG and CPU controls.
Optional local-font horizontal run shaping Implemented Optional HarfRust-backed owned local fonts shape independent directed runs into visual glyph IDs, UTF8 clusters, scaled positions and advance measurement.
Checked immutable font variation instances Implemented Explicit source fvar axes and user coordinates create immutable local font instances consumed by the existing shaping, glyph outlines, SVG, CPU drawing and caller-owned fallback APIs.
Typed bounded filled SVG paths Implemented Finite typed move/line/quadratic/cubic/close paths validate subpath topology and append atomically within existing SVG document bounds.
Owned bounded SVG image import Implemented Optional resource-free static SVG import owns normalized shapes/paths/transforms/styles/gradients/clipping and prepares independent sRGB-encoded premultiplied RGBA8 with explicit viewport fitting; a complete Rust image consumer retains the standard standalone settings popup.
Optional local TrueType glyph SVG outlines Implemented Local default-instance glyf extraction feeds shaped SVG filled paths at caller baselines without text/font URLs, with whole-run rollback on failure.
Optional single-line Unicode bidirectional ordering Implemented Pinned Unicode 16.0 data resolves explicit/first-strong base, line-adjusted UTF8 byte levels and logical directional ranges in visual order before shaping.
Generic native open-file chooser Prototype An explicit surface open-file API owns its completion callback, supports a native parent and extension filter, and returns cancellation without any product file policy.
CLAP editor control and gesture bridge Prototype A main-thread gain/bypass edit API queues complete edits and continuous begin/value/end gestures, retains partial host output progress, invalidates stale edits after restore, and exposes coherent requested values and coalesced meters.
Rust control-thread runtime services Implemented Bounded binary files/atomic replacement, explicit HTTPS POST, owned bounded serial workers, worker timers, wall-clock conversion and environment-derived user locations are reusable Rust APIs outside portable processing.
Rust runtime native ownership facade Prototype Opaque handles, bounded returned buffers and consumed callback contexts expose Rust runtime APIs to native SDK consumers; narrow Rust OS bindings supply module paths, macOS UUID and Windows SMBIOS inputs.
Control-thread XML and cryptographic compatibility Implemented Bounded attribute XML, SHA-256, and existing little-endian unpadded RSA integer verification are available through an explicit data crate.
Explicit local signed-entitlement verification Implemented Canonical bounded consumer claims and a domain-separated Ed25519 envelope verify against explicit trusted public keys, product IDs and half-open validity, with time-rechecked cached feature grants.
Explicit opt-in worker analytics Implemented A default-disabled numeric-event queue provides bounded JSON batches, immediate revoke/discard, explicit sender invocation and retained whole batches on delivery errors.
CLAP gain plug-in Prototype A loadable gain plug-in advertises mono/stereo ports, gain and stepped bypass metadata/text, sample-timed automation, active/inactive flush, reset, reactivation, and complete session recall.
VST3 gain reference Prototype External SDK builds separate processor/controller classes over shared Rust gain DSP, bounded sample-timed automation, bypass, complete state and normalized controller recall.
Native AUv3 processor and parameter editor Prototype A paired f32 native processor/state entry renders through AUAudioUnit with physical global parameters, timed changes/continuing ramps, host bypass, complete live state, transport and opt-in MIDI/UMP input, plus a native parameter editor and embedded extension fixture.
Apple mobile standalone effect host Prototype An explicit AVAudioEngine/AVAudioSession owner hosts a native effect with microphone permission, preferred device settings, interruption/route/reset rebuilding, retained state and selected CoreMIDI input; the public iOS/iPadOS Gain app exposes native Audio/MIDI settings and consumer-selected deployment minimums.
Android standalone audio and MIDI host Prototype An explicit AAudio f32 effect owner provides prepared planar conversion/chunking, nonblocking capture reads with shortage silence/counters, atomic error handoff, stopped retirement and a bounded immediate MIDI queue; the public foreground app exposes permission/audio-focus and Audio/MIDI settings, with consumer-selected minimum API, compile/target SDK and build-tools.
Public AUv2 native performance instrument bundle Prototype Public mono/stereo native performance AUv2 instrument adopts selected planar f32/f64 audio, timed MIDI and Level intent, coherent Level state, and checked stopped/offline/reset lifecycle over reusable AU helpers.
AudioUnit v2 gain reference Prototype An external SDK wrapper embeds the Rust-backed VST3 gain bundle in a local AUv2 component with normalized controls, stereo rendering, dry host bypass and gain preset recall.
Optional native AAX WebKit editor ownership Prototype An opt-in native Gain editor uses checked initialized automation delegates, retained callback context and actual public SDK view ownership with separate editor packaging.
AAX gain reference build Prototype Authored public AAX SDK model/algorithm over shared Rust gain DSP defaults to checked mono/stereo native lifecycle and complete global state; an explicit stock wrapper profile preserves its separate schema/control regression.
Opt-in Gain AAX meter reference Prototype The explicit gain-meters local bundle registers six native peak/RMS taps through public SDK AddMeters/descriptions and distinct mono/stereo owned factory IDs while retaining canonical Gain32/64 schema/state/transport/smoothing/bypass DSP.
LV2 gain reference Prototype Mono/stereo public Gain descriptors use the native f32 processor, cached schema controls and coherent portable LV2 state extension with actual-library lifecycle/audio/state validation.
Bounded LV2 Atom MIDI note input Prototype An external-SDK adapter preflights a complete ordered Atom sequence before mapping MIDI1 short notes with normalized velocity and channel/key release scopes into caller-owned native events.
Public LV2 MIDI performance instrument bundle Prototype A public zero-input mono/stereo f32 LV2 instrument connects bounded Atom MIDI notes, generic Level control and canonical complete state to the native performance archive; an explicit bundler packages metadata/module/notices and validates the selected binary.
Reusable LV2 native processing and complete state Prototype The public Gain and Performance LV2 factories consume prepared native schema metadata and coherent complete state with exact originating core/shared-schema admission before resource creators.
Native precision sidechain CLAP reference Prototype A stateless stereo fixed-threshold gate exports main input/output plus an input-only mono auxiliary detector in native f32/f64; its distinct validate-sidechain executable checks the actual public bundle.
MIDI sine CLAP instrument reference Prototype The portable 16-voice sine reference exports stereo audio without input, timed MIDI notes/controllers, stable level, atomic state recall, generic host controls and infinite held-note tail; validate-sine checks its public bundle with a distinct executable name.
Mono and stereo gain reference Implemented Separate native f32/f64 gain references share GAIN_ID amplitude 0..4, unity/default 1 and 5 ms f32 control smoothing across channels.
Native-precision identified performance sine reference Implemented An independent f32/f64 mono/stereo instrument applies exact native voice values with timed ADSR, volume/expression, balance, tuning and vibrato, committing private candidate rendering and original-target completions only after whole success.
Public native identified-performance reference Prototype A separate public 16-voice f32/f64 archive consumes generic native processor/schema/cache/audio-state and optional live-publication tables with distinct entry symbols, canonical global level state and bounded original-target completion.
Raw MIDI native32/64 sine reference Prototype Distinct raw-MIDI native exports share the portable sine render kernel, preserve acknowledged Level independently of program requests, and expose transient exact raw/voice/request telemetry.
Public VST3 performance instrument Prototype A separate 16-voice public VST3 reference adopts native f32/f64 no-input rendering, timed identified notes, five audible note-expression declarations, canonical transactional level recall and explicit profile-aware local bundle packaging/validation.
Portable sine instrument reference Implemented A no-input mono/stereo processor connects sample-timed notes, voice stealing/sustain, optional RPN negotiation, phase-continuous bend and linear ADSR release completion.
Native ABI for shared reference DSP Prototype A Rust static library exposes exclusively owned gain lifecycle, prepared scratch processing and pure complete/legacy state codecs to native reference format wrappers.
Gain session save and restore Prototype CLAP saves a complete 32-byte version-two gain/bypass record, migrates 20-byte version-one gain records, and restores both values coherently at process, flush, or reset boundaries.
Bypass and metering Implemented Portable gain has sample-timed dry bypass, continuing gain smoothing, block input/output sample peak and RMS, and a separate bounded coherent meter mailbox.
Embedded editor and controls Prototype The macOS CLAP gain editor embeds a compiled-in WebKit page with gain slider/numeric control, bypass, stereo peak/RMS meters, host automation updates and visible edit errors.
Optional macOS VST3 gain editor Prototype A compiled local gain/bypass page consumes Rust-owned WebView and schema-validated UI codecs; SDK controller callbacks deliver normalized gestures with host refresh, rejected-edit rollback and retryable rejected ends.
Optional AUv2 Cocoa gain editor Prototype Editor-enabled nested VST3 supplies the actual component Cocoa UI protocol through the external SDK wrapper, with gain/bypass gestures, notifying host/preset refresh and rendered-audio verification.
Sample-timed sine factory program recall Prototype The public sine reference consumes three complete factory level programs via master-channel MIDI requests, preserving voices and reflecting CLAP state with deferred value refresh.
Complete gain reference program catalogue Implemented Unity/Silence/Bypass are complete schema-bound physical states with permanent IDs/MIDI addresses, restored and persisted through existing f32/f64 controls.
Native gain complete program metadata Prototype A narrow public C header exposes immutable count and atomic complete control/address/name metadata for native gain SDK consumers.
Optional VST3 factory program mapping Prototype An explicit build maps Rust gain programs to one SDK root/list/selector, complete host value refresh and sample-timed expanded processor control events.
Optional AUv2 factory program mapping Prototype An explicit component build maps three complete gain programs to AU factory presets and block-start selector recall with coherent host bypass.
Serialized native reference gain meter snapshots Implemented Fixed-layout C records copy complete f32/f64 input/output block peak/RMS/count/diagnostics while preserving native f64 levels.
Optional native VST3 host-mediated gain meters Implemented Audio-owned meter copies travel through twelve hidden read-only host output parameters into Rust snapshots and four native WebKit meter controls.
Optional AUv2 native reference meter transfer Implemented The external SDK output transfer/timer updates twelve readable AU meter values and shared Rust/native editor peak/RMS/diagnostic controls.
Small synth, effect and expressive MIDI examples Implemented Four entry points provide live macOS subtractive synth/stereo delay/MPE UIs and a MIDI 2.0 packet inspector; explicit flags retain portable WAV and expression fixtures.
Portable subtractive teaching synth Implemented Eight voices combine selectable sine/saw/square/triangle oscillators, resonant low-pass VCF and VCA, with one shared ADSR per voice and audible MPE pressure/timbre mapping.
Native fixed-delay processing reference Implemented Delay8/16 native f32/f64 exports provide bounded mono/stereo processing, complete Level/Bypass state and exact latency/tail metadata for reusable adapter validation.
Portable stereo teaching delay Implemented A prepared stereo delay replaces gain in the live effect example, with time/feedback/mix knobs, stereo or ping-pong cross-feedback, dry bypass that retains the tail, and rhythmic demo input.
Interactive example device and MIDI ownership Prototype Native synth/effect/MPE windows use knobs, a layered piano widget, default Audio/MIDI settings, coherent meters/voices, selected channel routing and multiple MIDI inputs; MIDI 2.0 provides an interactive codec inspector.
Independent offline project starter Implemented An explicit generator creates a publish-disabled independent consumer workspace outside RAVET with local framework/reference dependencies, borrowed stereo DSP lifecycle and a timed-event fixture.
Independent embedded and Pi Linux starters Implemented Explicit embedded-rust, arduino and pi-linux generator kinds create separate consumer projects with no_std libraries, a local C++ sketch/library or headless Linux fixture.
RAVET Foundry project creation and builds Prototype A RAVET-native wizard and shared Rust CLI create independent offline, standalone and effect/instrument plug-in workspaces, reopen versioned TOML settings, preserve consumer source during conflict-checked regeneration and run explicit background builds/local bundles with native directory pickers.
Processing heap instrumentation Implemented Processing-thread allocation and deallocation probes exercise gain, the CLAP bridge, and host ABI callbacks, including resets and malformed inputs.
CLAP bundling and smoke host Prototype A Python bundler creates a local optimized or debug artifact; a native development host loads it and checks automation, ports, flush, lifecycle, and active state recall.
Disposable REAPER validation harness Prototype Public ReaScript checks host discovery, parameter state, editor window creation, automation playback and saved-session recall; Python generates synthetic stereo audio and verifies actual DAW-rendered output. The native meter prototype requires a public marker and empty project before mutations.
Runtime contract workflow configuration Prototype A three-platform GitHub workflow configures workspace formatting/tests/lints/Rustdoc and a separate macOS built-CLAP ABI smoke job with two Cargo workers.
Live searchable documentation portal Implemented Canonical guides, generated capabilities and decision records build into a searchable responsive static portal with live rebuilding and linked workspace Rustdoc.
Explicit bounded local-video worker frames Prototype A separate macOS reader opens selected local video, reports first-track oriented metadata and extracts independently timestamped complete owned RGBA frames through a private AVFoundation boundary.
Explicit bounded Metal offscreen rectangles Prototype A separate macOS renderer prepares a native Metal pipeline and draws ordered portable filled rectangles with source-over blending into independent owned RGBA readback images.
Reusable AUv2 native schema, control, text and state preflight Prototype Apple-SDK C++17 helpers own an immutable native schema cache and isolated complete-state validator, providing full UInt32 IDs/CF metadata, canonical normalized-f32 setter preflight, complete physical text conversion and exact native-stream/AU dictionary preflight before SDK mutation; the public performance component consumes both.
Bounded source text editing, undo and layout identity Implemented Owned grapheme-safe source replacement/deletion and directional selection provide exact bounded undo/redo and atomic errors, while distinct owner/revision tokens invalidate stale or foreign edits and prepared paragraph caches.
Explicit bounded Metal bitmap scenes Prototype Immutable validated owned premultiplied RGBA8 assets and borrowed ordered rectangle/image commands provide clipped nearest-sampled source-over GPU composition, independent readback adoption and explicit local-video frame upload.
Prepared AUv2 native planar audio bus mapping Prototype An Apple-SDK C++17 mapper validates explicit native main/auxiliary layouts and complete compact AU planar f32 AudioBufferLists before publishing caller-owned fixed native pointer arrays; rejected configuration/mapping retains prior state, and the performance component consumes it for prepared/caller preflight.
Optional bounded Ogg Vorbis worker encoding Implemented Explicit mono/stereo lossy Ogg Vorbis complete-clip and incremental worker encoding uses caller rate/quality/stream serial with bounded prepared batches and cumulative input/output budgets, original sink errors, explicit EOS/flush and gated Drop output.
Bounded browser text editor Implemented Consumer-labelled textarea ownership with bounded committed UTF-8 source, local identity revisions, grapheme-safe selections, shared undo/redo history, native-input reconciliation and composition guards.
Worker-created automatic MP3 capture ownership Implemented A prepared-ring controller constructs and retains the MP3 encoder on one worker, acknowledges pause/resume, validates stopped or permanently retired producers, and returns explicit finalized/aborted/original-failure evidence with recovered seekable destination, consumer and distinct accepted/dequeued/file/write counts.
Worker-created automatic Vorbis capture ownership Implemented A dedicated prepared-ring recording controller creates and retains the genuinely non-Send Vorbis codec on one worker, acknowledges pause/resume, validates stopped or permanently retired producers, and returns explicit finalized/aborted/original-failure evidence with recovered sink, consumer and counts.
Local control document ownership Implemented Connected slider/knob/numeric/toggle/choice/action controls share gesture ownership by their original document, with child-window lifecycle routing and child-focus refresh protection.
Local one-level popup menu Implemented Explicit consumer-created native action buttons compose bounded one-level menu semantics, one roving Tab stop, exact-once activation, focus/dismissal and attribute restoration.
Optional bounded CPU path and local-font rasterization Implemented Owned premultiplied RGBA8 canvases render prepared typed affine paths, explicit fill rules, antialiased device strokes and optional prepared local TrueType glyph outlines, with independent readback and explicit Metal bitmap composition.
Validated AUv2 block-start host transport Prototype An external Apple-SDK C++17 collector validates independently available host callback tuples before publishing a canonical read-only native transport snapshot; the public performance AU adopts its explicit VST3 projection before parameter transfer and DSP.
Local labelled tabbed panels Implemented Fixed consumer-created tabs and panel containers compose labelled ARIA associations, independent manual focus/selection or automatic activation, native Tab navigation and exact attribute restoration.
Prepared LV2 block-start time:Position transport Prototype An external-SDK C++17 collector validates bounded exact-encoding Position objects before publishing direct native transport; the opt-in reusable instrument profile forwards block-start context only after full MIDI/control/time preflight, and the public Performance bundle consumes it.
Optional owned PNG/JPEG worker assets Implemented Explicit static PNG/selected JPEG byte decoding and bounded private-sink PNG encoding own immutable straight RGBA8 with deliberate consuming PMA conversion for consumer presentation.
Explicit sRGB and linear-light color preparation Implemented Dependency-free checked linear scalar colors and bounded borrowed RGBA views with caller-buffer standard transfer, encoded-space alpha reassociation and linear-light source-over, consumed by a resizable standalone image workspace.
Optional bounded opaque baseline JPEG encoding Implemented Explicit quality and chroma sampling encode validated opaque image assets into a private bounded owned JPEG sink, with whole alpha preflight and no partial output or external I/O.
Optional bounded local MP3 worker encoding Implemented Complete and incremental worker-only MPEG1 Layer III encoding uses explicit mono/stereo rate/192–320kbps choices, full source preflight, prepared bounded batches, physical-write budgets including finalized Info-frame replacement, parsed gapless metadata/CRC and recovered original sink errors.
Local native modal dialog Implemented Consumer-created native dialogs compose labelled opening, browser-owned modality/focus, bounded close/form/cancel completion, guarded document/node ownership and exact disposal restoration.
Bounded AUv2 native MIDI output delivery Prototype A reusable SDK-independent canonical short-MIDI converter and fixed CoreMIDI packet owner stage complete native output before one AU host callback, with exact refusal receipts, stable borrowed bytes and stale/reentrant delivery guards; an actual synthetic AudioComponent proves consumer adoption.
Prepared AUv2 native f64 mapping and complete formats Prototype Explicit float/double prepared main/aux pointer mappings and complete stopped native/ASBD profiles validate exact sample precision, whole directional formats and output ranges before publication; an actual fixed-f64 synthetic AudioComponent proves native64 rendering and stopped complete Level recall.
Explicit native semantic companion for custom editor content Implemented Copied checked flat button/slider/static-text snapshots, native AppKit protocol getters/frames/actions and original-editor revision/callback retirement; complete opt-in content traversal with None/default WebKit restoration.
Local control disabled and label ownership Implemented Custom knobs coordinate disabled Tab/input state and retryable parameter ownership; meters preserve explicit label precedence and reject retired formatter writes.
Production distribution and compatibility Planned Establish supported platform, architecture, toolchain, and DAW matrices, release packaging, and project templates.
Standalone device playback Planned Run the portable processor through a separate audio-device adapter.
Additional formats and advanced tooling Planned Extend formats, mobile/UI, graph, DSP/codec and application facilities beyond the current scoped implementations.
VST2 support Excluded VST2 is explicitly outside the project's scope.
Proprietary consumer product publication Excluded Proprietary consumer implementations, assets, fixtures, and wrappers stay in separate private projects and are excluded from public RAVET publication.
Local resizable split-pane layout Implemented Bounded two-pane CSS grid layout with a labelled separator, measured pixel minima, axis/RTL keyboard and pointer ownership, and exact local cleanup.
Bounded explicit row/column grid geometry Implemented Independent constrained row and column tracks resolve explicit checked area spans into atomic caller-owned rectangle output.
Measured standalone content size and grid workspace consumption Prototype The existing main-thread standalone owner exposes actual logical content extent and a complete resizable HTML workspace consumes Rust grid output while preserving default Audio/MIDI settings.
Explicit standalone content constraints Implemented Portable bounded min/max content value and allocation-free free/aspect resolver, with opt-in owned macOS policy installation, immediate fitting, exact original-native-bound restoration and synchronous resize/policy reentry rejection.
Owned standalone window state and closure Implemented Copied exact-window native status distinguishes hidden/live from monotonic close admission; veto-aware close requests share operation guards, retire future window effects, and retain borrowed editors for explicit child-before-parent cleanup.
Local fixed-model virtual text list Implemented Bounded copied text model with reusable viewport rows, exact active/pressed identity pins, virtual root focus and separate single/multiple selection.
Local fixed flat-list selection Implemented Bounded labelled listbox with separate virtual active focus and single/multiple selection, retained unavailable model state, keyboard ranges and exact attribute ownership.
Local fixed hierarchical tree expansion and selection Implemented Bounded labelled TreeView with separate virtual active focus, branch expansion and single/multiple selection, retained collapsed descendants, native toggle focus admission and exact ownership cleanup.
Prepared file playback at an explicit output rate Implemented Bounded off-audio WAV/AIFF and optional FLAC/MP3/Vorbis preparation converts complete validated source frames into the existing memory transport at a selected output rate, retaining explicit fractional causal delay and finite tail; an output-only processor integrates with actual PreparedOutput/open_output and rejects configuration mismatches before rendering.
Explicit stopped native output processor recovery Prototype Failure-owned preparation and an additive f32 CPAL output owner return the exclusive original processor after explicit asynchronous callback retirement, allowing matching buffered-file stopped seek and explicit reopening.
Buffered file playback at an explicit output rate Implemented Bounded worker conversion publishes WAV/AIFF and optional compressed readers into an explicit output-rate queue, interoperating with automatic read-ahead ownership and an actual PreparedOutput processor bridge; stopped candidate replay preserves old source/phase/suffix/queue/generation on failure.
Output-clock buffered file and captured-input processing Prototype An explicit f32 processor owner combines unique buffered file PCM with existing output-clock-converted capture, forwards file transport by bounded segments and preserves committed history and original downstream faults.
Explicit integer-rate sinc scheduling for bounded-memory long file streams Prototype Caller-selected exact integer-rate input/output scheduling extends converted read-ahead beyond the floating profile's source ceiling, with checked finite output duration, original-error ownership and stopped same-version replay.
Indexed finite-history integer PCM playback Prototype An explicit known-duration integer-sinc pump rebuilds stopped WAV/AIFF output seeks from a bounded original history window, preserving old playback on candidate failure and separating source work from skipped coordinates.
Explicit static GIF worker assets Implemented One complete GIF image becomes owned straight RGBA with explicit transparent/global-palette canvas policy, local palette/transparency/interlace validation and strict bounded structural/LZW preflight.
Local fixed readonly table grid Implemented Bounded readonly native table grid with virtual cell navigation, explicit column-header associations and separate single/multiple row selection, retained unavailable models and exact attribute cleanup.
Bounded native LV2 short MIDI output Prototype An external-SDK fixed-storage stager and opt-in native LV2 processor profile admit full configured Atom Chunk capacity before state/DSP, stage canonical short MIDI and publish one complete timed Sequence.
Packaged LV2 NoteRouting native reference Prototype The explicit local note-routing LV2 profile consumes canonical Rust NoteRouting native tables, with mono/stereo silent audio, complete Level recall, timed note output and block-start transport.

Implemented capabilities

Portable processor lifecycle

Validated preparation, variable and zero-frame blocks, reset, deactivation, and atomic rejection with silence on faults.

Limits: One main bus and up to eight auxiliary buses, up to 64 channels per direction, f32/f64 processor specialization; each implementation declares its subset. Public APIs are provisional. Real-time obligations are implementor responsibilities.

Source: crates/ravet/src/lib.rs, crates/ravet-foundation/src/processor.rs.

Tests: crates/ravet-foundation/tests/contracts.rs, examples/gain/tests/processing.rs.

Documentation: docs/architecture.md, docs/decisions/0001-portable-processing.md.

Allocation-free no_std processing foundation

Existing portable audio/event/lifecycle/schema contracts work without std or an allocator, with pure-Rust parameter math and target-gated snapshots.

Limits: Default std feature retains desktop mappings; Cargo feature unification applies. Pinned libm 0.2.16; snapshots require native 64-bit atomics. Existing signal/graph/device/editor/runtime crates remain outside this allocator-free subset. Cross checks are library evidence, not board/deadline support.

Source: crates/ravet-foundation/Cargo.toml, crates/ravet-foundation/src/lib.rs, crates/ravet-foundation/src/parameter.rs.

Tests: crates/ravet-foundation/tests/contracts.rs, crates/ravet-foundation/tests/parameters.rs, scripts/check-embedded.py.

Documentation: docs/embedded-projects.md, docs/decisions/0152-embedded-processing.md.

Fixed-capacity embedded audio adaptation

An explicit no_std adapter owns fixed planar f32 scratch, preflights complete interleaved f32/i16/i32 blocks and preserves event timing, fault silence and backing tails.

Limits: Const channels/frames, exact configured layout, no auxiliary buses/generated events. f32 internal precision; packed 24-bit conversion is consumer-owned. Processor allocation/ownership obligations and hardware drivers/DMA/cache/scheduling remain explicit; no board or deadline guarantee.

Source: crates/ravet-embedded/src/lib.rs, crates/ravet-embedded/Cargo.toml.

Tests: crates/ravet-embedded/tests/blocks.rs.

Documentation: docs/embedded-projects.md, docs/architecture.md.

Extended processing capabilities

Portable f32/f64 processor specializations support bounded multichannel/auxiliary buses, borrowed event output and latency/tail declarations; CLAP forwards validated block-start transport.

Limits: 64 channels per direction, eight auxiliary buses, caller-owned fixed output capacity. Processors declare their subset; gain supports f32/f64 without auxiliary/generated events, while generic CLAP bridges map native main/aux buses and bounded events. Other-format generic bus/output/latency mappings and mid-block transport remain separate.

Source: crates/ravet-foundation/src/audio.rs, crates/ravet-foundation/src/processor.rs, crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/transport.rs, examples/gain-clap/src/lib.rs.

Tests: crates/ravet-foundation/tests/extended_processing.rs, examples/gain-clap/tests/bridge.rs.

Documentation: docs/extended-processing.md, docs/decisions/0017-extended-processing.md.

Borrowed planar audio buffers

Safe in-place and separate input/output f32/f64 views validate channel lengths and expose active frames while preserving backing tails; stereo frame mapping selects storage outside the sample loop.

Limits: Borrowed planar views support f32/f64 and multichannel storage. No interleaved view or implicit conversion. Stereo mapper still requires two outputs and at most two inputs.

Source: crates/ravet-foundation/src/audio.rs.

Tests: crates/ravet-foundation/tests/contracts.rs, crates/ravet-foundation/tests/stereo_mapping.rs, examples/gain/tests/processing.rs.

Documentation: docs/decisions/0001-portable-processing.md, docs/decisions/0011-stereo-frame-mapping.md.

Sample-timed input events

Bounded parameter values/gesture boundaries/modulation amounts, note and validated MIDI short-message events use stable IDs, physical values, ordered offsets, and preserved same-frame order. Zero-frame events use offset zero.

Limits: Bounded output events, UMP codecs/transport and MIDI voice policy are separate capabilities. Gain ignores performance events and unknown parameter IDs; each format bridge declares its mappings.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-foundation/src/processor.rs.

Tests: crates/ravet-foundation/tests/contracts.rs, examples/gain/tests/processing.rs.

Documentation: docs/decisions/0001-portable-processing.md.

Portable transport context

Process blocks carry optional positions, tempo, playback state, and a discontinuity indication.

Limits: Gain is transport-independent. CLAP forwards validated block-start playing/position/tempo fields and detects seeks across accepted callbacks. Additional details carry validated block-start recording/active-loop/pre-roll, signature, bar and BPM-per-sample increment; no extrapolation or mid-block updates.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-foundation/src/processor.rs.

Tests: crates/ravet-foundation/tests/contracts.rs.

Documentation: docs/architecture.md, docs/decisions/0002-clap-backend.md.

No-input instrument contract

Foundation represents mono/stereo instruments without audio inputs; a test instrument exercises note timing and output initialization.

Limits: Contract fixture only; a separate portable sine processor now consumes the contract. No CLAP instrument export.

Source: crates/ravet-foundation/src/processor.rs.

Tests: crates/ravet-foundation/tests/contracts.rs.

Documentation: docs/architecture.md.

Bounded coherent word snapshots

Fixed atomic word arrays provide one-attempt coherent reads, complete publications, and conditional updates that preserve newer control restores.

Limits: Targets with 64-bit atomics only; allocation-free operations do not establish deadlines. Callers encode and validate words and retain the previous snapshot on contention. Coalesces publications, with no event queue or retry policy. Generation must not wrap across an operation.

Source: crates/ravet-foundation/src/snapshot.rs.

Tests: crates/ravet-foundation/tests/snapshot.rs.

Documentation: docs/snapshots.md, docs/decisions/0008-word-snapshots.md.

Prepared dynamic graph handoff

One prepared FIFO f32/f64 graph replaces the active graph per valid block, with bounded ownership queues and control-thread retirement.

Limits: 1..4 slots per pending/retired queue; exact initial config and path latency required. Retirement backpressure keeps current rendering. No old-history migration, tail drain, crossfade, feedback routing or aggregate graph/node memory guarantee. Endpoint teardown and retired destruction belong outside callbacks; no native deadline claim.

Source: crates/ravet-graph/src/dynamic.rs, crates/ravet-graph/Cargo.toml.

Tests: crates/ravet-graph/tests/dynamic.rs.

Documentation: docs/audio-graphs.md, docs/decisions/0056-prepared-graph-handoff.md.

Explicit graph event routing

Filtered host/node generated events share audio/event topology, bounded stable sample-offset merging and complete host output publication.

Limits: 4096 event edges, 1024 input/output events per node/host, shared 64 MiB audio/event scratch cap. Duplicate edges duplicate events. Offsets are not audio-latency delayed. Overflow disables graph and clears host outputs; earlier nodes may have advanced. No feedback, automatic state/timing alignment or native deadline claim.

Source: crates/ravet-graph/src/events.rs, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-graph/tests/events.rs.

Documentation: docs/audio-graphs.md, docs/decisions/0057-explicit-graph-events.md.

Explicit prepared graph audio-owner sessions

Optional no-op processor session hooks bracket static/dynamic graph processing with non-Send owner guards, reverse stop/rollback and stopped control retirement.

Limits: Explicit opt-in only; existing adapters/unguarded portable behavior unchanged. Start failure must leave its node stopped, prior starts roll back; dynamic rejected candidates retire while old rendering continues. End/retain guards before control transfer/deactivation; no native port/event mapping/device scheduling/migration/crossfade/tail draining/platform/deadline guarantee.

Source: crates/ravet-foundation/src/processor.rs, crates/ravet-graph/src/lib.rs, crates/ravet-graph/src/dynamic.rs.

Tests: crates/ravet-graph/tests/audio_sessions.rs, crates/ravet-graph/tests/dynamic.rs, crates/ravet-graph/src/lib.rs, crates/ravet-graph/src/dynamic.rs.

Documentation: docs/audio-graphs.md, docs/architecture.md, docs/decisions/0107-graph-audio-owner-sessions.md.

Typed graph stages and shared-control mono histories

Concrete const-index tuple stages reuse canonical graph execution, guarded audio ownership and explicit bypass; generic mono kernels share one prepared control object with separate native histories.

Limits: Native f32/f64, effect-only1..64 equal main channels, tuple1..8, <=65536 frames at construction (prepare may still refuse by the Graph scratch cap), chain<=1024 broadcast input events/no generated or auxiliary events; mono rejects all events/auxiliary buses. Checked4MiB record/kernel-Vec payload excludes caller-owned and Graph memory. Bypass freezes/skips events but retains declared latency/tail without audible delay compensation. Stopped mutation requires reprepare; child faults retain original GraphStatus with BackendFailure facade/no rollback. Manual Processor start must be paired with stop_audio on its starting thread before transfer, deactivation, extraction or drop (caller obligation, no automatic cleanup): prepare and the stopped getter refuse while a manual owner is live, deactivate/into_stages/Drop panic; the non-Send session is preferred. Shared control object immutability while prepared, kernel nonfinite policy and callback/panic obligations remain with the implementor; Graph denies unsafe except its audited private typed storage module; other workspace crates retain their existing policy. Isolated qualification passes74 runtime tests+21 doctests/strict lint/docs/fmt; Miri unavailable, no physical/deadline claim.

Source: crates/ravet-graph/src/typed.rs, crates/ravet-graph/src/mono.rs.

Tests: crates/ravet-graph/tests/typed.rs, crates/ravet-graph/tests/mono.rs, crates/ravet-graph/tests/typed_consumers.rs.

Documentation: docs/audio-graphs.md, docs/decisions/0260-typed-chain-shared-mono-ownership.md.

Prepared CLAP f32 main audio graph node

Main-activated native audio maps through bounded prepared f32 graph scratch, owner-confined sessions and stopped-token main deactivation/recovery.

Limits: Zero/one main port per direction matching 1..64 channels, frames1..65536, node-owned scratch<=32MiB outside graph cap; no events/auxiliary/editor/active parameter mapping; f64 uses its separate factory. Explicit declared timing, one-shot node after deactivation, consumer core request scheduling and orderly control lifetime. Backend faults may advance histories; no implicit sleep/tail drain/restart/other-format/device scheduling/general third-party/platform/deadline guarantee.

Source: crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/lib.rs, crates/ravet-host/Cargo.toml, crates/ravet-foundation/src/processor.rs.

Tests: crates/ravet-host/tests/graph_node.rs, crates/ravet-host/examples/hosted-graph.rs, crates/ravet-host/src/graph_node.rs.

Documentation: docs/plugin-hosting.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0108-hosted-main-audio-graph-node.md.

Prepared CLAP native f64 main audio graph node

A separate f64 factory validates advertised port support before activation and keeps native/graph samples wide through shared owner-confined lifecycle and stopped main retirement.

Limits: Zero/one main port per direction, 1..64 channels, frames1..65536, native scratch<=64MiB outside graph cap; no precision conversion/events/auxiliary/editor/active parameter mapping. Consumer declared timing and orderly one-shot lifecycle. Existing Gain CLAP is f32 only; loaded dual-format public validation fixture evidence is macOS arm64, without general compatibility/device/platform/deadline guarantees.

Source: crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/lib.rs.

Tests: crates/ravet-host/tests/graph_node.rs, crates/ravet-host/examples/hosted-graph.rs, crates/ravet-host/examples/graph-fixture.rs.

Documentation: docs/plugin-hosting.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0109-hosted-native-f64-graph-node.md.

Prepared CLAP packed native audio ports in graphs

Explicit f32/f64 factories preserve separate native port/channel boundaries while graph routes address directional summed channel indices, including sidechain inputs and auxiliary outputs.

Limits: Fixed inactive metadata/layout; up to nine ports and 64 total channels per direction, 65536 frames, native scratch<=32MiB f32/64MiB f64 outside graph cap. Foundation auxiliary buses stay empty; no inferred portable pairing/layout negotiation/events/editor/active parameter/device scheduling. Original main-only factories unchanged. Loaded sidechain evidence macOS arm64 only; no broad compatibility/platform/deadline guarantee.

Source: crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/lib.rs, crates/ravet-host/src/audio_configuration.rs.

Tests: crates/ravet-host/tests/graph_node.rs, crates/ravet-host/examples/hosted-graph.rs, examples/sidechain-clap/src/lib.rs.

Documentation: docs/plugin-hosting.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0110-hosted-packed-audio-ports.md.

Opt-in hosted CLAP block-start transport

Checked portable context maps into flagged native tempo/beat/seconds fields for explicitly enabled stopped f32/f64 graph nodes, preserving independent steady clocks and rejection before native rendering.

Limits: Disabled by default; any known context requires known playing. Signed 31-fractional-bit native positions bound/quantize timelines, sample conversion uses f64 seconds with no full-i64 exactness guarantee. No discontinuity flag/history reset, loops/recording/signatures/ramps/mid-block events/device transport. Loaded synthetic fixture evidence macOS arm64 only; no broad host/platform/deadline claim.

Source: crates/ravet-host/src/transport.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-foundation/src/processor.rs.

Tests: crates/ravet-host/tests/transport.rs, crates/ravet-host/tests/graph_node.rs, crates/ravet-host/examples/hosted-graph.rs, crates/ravet-host/examples/graph-fixture.rs.

Documentation: docs/plugin-hosting.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0111-hosted-block-start-transport.md.

Prepared CLAP graph global parameter input

Explicit f32/f64 factories validate product-to-native parameter identities/ranges on main, then deliver exact ordered global values through bounded audio-owner process or zero-frame flush.

Limits: 1..4096 writable identity mappings/input slots; metadata snapshot<=4096 native parameters, no cookies/pointer retention. Strict unknown/other-kind/range/step rejection before native calls. Physical f32 event values widen to f64; no full-resolution f64 parameter values/normalization/per-note/gestures/native output/recording/GUI/rescan service. Fresh stopped preparation required after metadata changes. Loaded synthetic reference evidence macOS arm64 only; no broad host/device/platform/deadline claim.

Source: crates/ravet-host/src/graph_parameters.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/lib.rs, crates/ravet-host/src/parameters.rs.

Tests: crates/ravet-host/tests/graph_parameters.rs, crates/ravet-host/examples/hosted-graph.rs, crates/ravet-host/examples/parameter-fixture.rs, crates/ravet-host/examples/support/parameter_fixture.rs.

Documentation: docs/plugin-hosting.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0112-hosted-graph-parameter-input.md.

Prepared CLAP graph global parameter output and builder

A preparation builder selects independent fixed port/transport/parameter profiles; bounded mapped native global output, including read-only values, publishes through portable graph event routes.

Limits: 1..4096 mappings/output slots and native metadata snapshot<=4096; original factories preserve contracts. Native f64 values narrow to finite/range/step-valid portable f32. Unmapped/unsupported/per-note output filters; typed mapped range/offset/order/capacity faults clear block with nonrollback BackendFailure. Output-only zero-frame profiles dispatch audio flush, not acknowledgement. No cookies/pointer retention/rescan/GUI recording/MIDI/modulation/gesture scheduling or crash isolation. Loaded synthetic macOS arm64 evidence only; no broad host/device/platform/deadline claim.

Source: crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/lib.rs.

Tests: crates/ravet-host/tests/graph_parameters.rs, crates/ravet-host/tests/graph_node.rs, crates/ravet-host/examples/hosted-graph.rs, crates/ravet-host/examples/support/parameter_fixture.rs.

Documentation: docs/plugin-hosting.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0113-hosted-graph-parameter-output.md.

Prepared CLAP graph selected note and MIDI input

The f32/f64 preparation builder validates an explicit native note-port index/dialect and delivers ordered mixed parameters, CLAP notes, short MIDI/MPE or framed UMP through fixed audio-owner input slots.

Limits: One selected native input index, <=256 advertised inputs, 1..4096 shared slots. CLAP wildcard note IDs; MIDI/MPE velocity rounds to 7 bits, zero note-on follows MIDI note-off semantics; MIDI2 framed words preserve group without translation. Strict dialect/unknown-kind/zero-frame performance rejection before native mutation. No inferred MPE negotiation, note expressions, SysEx assembly, performance output/rescan/editor/device scheduling. Loaded fixture and public sine macOS arm64 evidence only; no broad host/device/platform/deadline claim.

Source: crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_parameters.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/lib.rs.

Tests: crates/ravet-host/tests/graph_notes.rs, crates/ravet-host/tests/linked_sine.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/examples/hosted-graph.rs, crates/ravet-host/examples/hosted-sine.rs, crates/ravet-host/examples/support/sine_graph_probe.rs, crates/ravet-host/examples/support/parameter_fixture.rs.

Documentation: docs/plugin-hosting.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0114-hosted-graph-note-input.md.

Prepared CLAP graph selected performance output

An independent selected native output index/dialect publishes representable CLAP notes, short MIDI/MPE or framed UMP through shared bounded graph event slots and explicit routes.

Limits: One selected output index, <=256 advertised outputs, 1..4096 slots shared with optional global parameters. Concrete CLAP channel/key and wildcard note IDs only; f64 velocity narrows to f32. Unsupported ports/dialects/targets filter; selected invalid data/offset/order/capacity and zero-frame performance poison whole block with nonrollback BackendFailure. MIDI/UMP unused padding ignored, framed groups/words retained; no translation, note IDs/choke/end/expression/SysEx/rescan/editor/device scheduler or crash isolation. Loaded public fixture macOS arm64 evidence only; no broad host/device/platform/deadline claim.

Source: crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/lib.rs.

Tests: crates/ravet-host/tests/graph_notes.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/examples/hosted-graph.rs, crates/ravet-host/examples/support/parameter_fixture.rs.

Documentation: docs/plugin-hosting.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0115-hosted-graph-note-output.md.

Guarded main-owned editors for native graph nodes

Retained native graph control creates an exclusively borrowed PluginEditor while separately owned audio may run; bounded main callback servicing preserves restart/process requests.

Limits: Explicit OS main thread/compatible live parent/event loop. Editor borrowing prevents reclaim/drop until GUI destruction; no raw instance pointer duplication. No automatic GUI request/parameter-flush/restart/rebuild/device scheduling. Native Cocoa probe validates synthetic gain graph/editor cycles only; no general DAW/platform/focus/accessibility/deadline support claim.

Source: crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/editor.rs.

Tests: crates/ravet-host/tests/graph_node.rs, tools/editor-smoke/examples/graph-hosted.rs, tools/editor-smoke/src/probe.mm.

Documentation: docs/plugin-hosting.md, docs/native-editor.md, docs/audio-graphs.md, docs/architecture.md, docs/decisions/0116-hosted-graph-editor-ownership.md.

Bounded event input for buffered graph workers

Fresh graph-worker renders accept ordered staged input and acknowledge consumption; retained queue suffix pumps leave new events/context untouched without repeating native input.

Limits: No-input f32 fixed blocks, 0..1024 input slots, empty-output convenience methods; separate pump_io carries configured output. Explicit compatible node profiles. Graph errors can follow native history/input mutation and are not safe automatic retries. No timestamp/device-clock translation, late retiming, cross-thread event queue, output-event/live-edit/GUI/recovery scheduler. Loaded public sine offline notes only; no audible device/physical MIDI/platform/host/deadline claim.

Source: crates/ravet-device/src/graph_output.rs, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-device/tests/graph_output.rs, tools/device-probe/src/bin/graph-output.rs.

Documentation: docs/audio-devices.md, docs/plugin-hosting.md, docs/decisions/0118-graph-worker-event-input.md.

Bounded generated output from graph workers

Fresh buffered graph renders publish caller-owned generated-event prefixes once, independent of partial audio queue publication, with exact prepared output capacity.

Limits: No-input f32 fixed blocks, 0..1024 output slots and explicit graph/node routes/profiles. Pending publication leaves storage untouched and returns zero output count; caller uses only valid returned prefix. Wrong fresh capacity rejects before nodes. Graph faults suppress faulty queue publication/prefix but cannot roll back native histories. No telemetry queue/replay/control delivery, block/device-clock correlation, GUI/recovery scheduler or deadline promise. Loaded public fixture synthetic macOS arm64 evidence only.

Source: crates/ravet-device/src/graph_output.rs, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-device/tests/graph_output.rs, tools/device-probe/src/bin/graph-telemetry.rs.

Documentation: docs/audio-devices.md, docs/plugin-hosting.md, docs/decisions/0119-graph-worker-event-output.md.

Complete bounded event batches for graph worker/control handoff

Fixed SPSC batches atomically publish validated events with opaque tags/context; prepared consumer storage retains immutable batches until explicit acknowledgement for input or output delivery.

Limits: 1..65536 fixed frames, 0..4096 events, 1..64 queued batches plus one retained consumer batch; queue values<=32MiB plus retained events, outside graph/native caps; graph render batches remain limited to 1024 events per direction. Invalid/full publishes no prefix, observed disconnect rejects. No tag uniqueness, timestamp/clock conversion, retiming/replay, wait/wake, GUI/recovery or native transport policy. Producer teardown preserves batches for drain; stop/join owners before endpoint drop. Loaded synthetic fixture macOS arm64 evidence only, no device/host/deadline claim.

Source: crates/ravet-device/src/graph_events.rs, crates/ravet-device/src/lib.rs, crates/ravet-device/Cargo.toml.

Tests: crates/ravet-device/tests/graph_events.rs, tools/device-probe/src/bin/graph-telemetry.rs.

Documentation: docs/audio-devices.md, docs/plugin-hosting.md, docs/decisions/0120-graph-worker-event-queues.md.

Bounded CLAP audio-owner processing handoff

Main-activated stopped processors enter a non-Send native audio owner, replace through bounded SPSC retirement and return stopped tokens for main-thread deactivation.

Limits: CLAP/Clack host handlers, queues1..4, consumer tags/config/ports/event/latency compatibility and request/fault/sleep policy. Native start failures retain old processing; no tail drain/crossfade/migration/graph-device routing/other-format/crash isolation/general third-party compatibility/deadline guarantee. Keep matching main instances alive; finish and token/endpoint destruction outside callbacks.

Source: crates/ravet-host/src/audio_lifecycle.rs, crates/ravet-host/src/lib.rs, crates/ravet-host/Cargo.toml.

Tests: crates/ravet-host/tests/audio_lifecycle.rs, crates/ravet-host/examples/audio-handoff.rs, crates/ravet-host/src/audio_lifecycle.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0106-native-audio-owner-handoff.md.

Prepared interleaved audio handoff ring

Unique SPSC endpoints atomically transfer whole interleaved f32 frame prefixes with explicit backpressure and untouched consumer tails; unique-producer Drop permanently publishes retirement for stopped-finalization proof.

Limits: 1..64 channels, power-of-two 1..65536 frame capacity; prepare/drop allocate, push/pop do not. Caller chooses drop/retry/silence and worker/device lifecycle; live/leaked producers cannot prove retirement. No automatic seek, transport, recording scheduler or deadline guarantee.

Source: crates/ravet-audio-file/src/ring.rs.

Tests: crates/ravet-audio-file/tests/streams.rs, crates/ravet-audio-file/tests/recording.rs, crates/ravet-device/tests/recording_worker.rs.

Documentation: docs/audio-files.md, docs/decisions/0026-audio-streams.md.

Prepared interpolated peak estimates

Explicit finite Kaiser-sinc 4/8/16-phase peak measurement with immutable CONTROL design, single/1..64-channel streaming owners, complete stopped tail and separate sample/source/work observations.

Limits: Integer rates 8000..768000 Hz (validated metadata only: coefficients depend on factor, half-width and beta, 216 rate/profile admissions are 36 coefficient profiles, and the library cannot verify the actual source clock), half-width 32..512, beta 0..16, callbacks 1..65536, defensive 8 MiB aggregate prepared budget that admitted profiles (about 665,000 bytes at the maximum) cannot reach. Native f32 source widens into f64 measurement; finite grid/window estimate without standards or continuous-maximum certification. Live readings can be below the sample peak until finish. Whole-call preflight reserves full tail counter headroom. Nonfinite measured silence with per-channel flag, source audio untouched, genuine amplitude overflow visible and distinct, no hidden subnormal flush. Explicit 2L tail after stopped ownership; no Drop I/O, hardware/deadline or loudness/LRA claim. Near-Nyquist fixture (36 profile combinations; its half-sample centre lies on every grid) has exactly 12 tolerance failures, all half-width 32: about +0.2952 dB over-reading at beta 0 and -0.769 to -1.189525 dB under-reading at beta 6/12/16; the +0.2/-0.4 dB interval is not widened. Selected external FFmpeg grid differs at high source rates; its upstream source attribution is not newly verified.

Source: crates/ravet-signal/src/true_peak.rs.

Tests: crates/ravet-signal/tests/true_peak.rs, crates/ravet-signal/tests/true_peak_graph.rs, crates/ravet-signal/tests/true-peak-decimal.csv, crates/ravet-signal/tests/true_peak_decimal_oracle.py, crates/ravet-signal/tests/true_peak_ffmpeg_oracle.py, crates/ravet-signal/tests/true_peak_example_admission.py, crates/ravet-signal/examples/true-peak-file.rs.

Documentation: docs/signal-processing.md, docs/decisions/0263-prepared-interpolated-peak-estimates.md.

Prepared calibrated loudness and loudness range

Explicit calibrated K-weighted M/S/I/LRA with rational 10-Hz windows, independent channel roles, full log-domain programme records, retrospective gates/ranks, programme pause/resume and exclusive stopped analysis.

Limits: Every integer rate 8000..768000 Hz, roles 1..64, callbacks 1..65536 and independent I/LRA record capacities 1..1000000 (at most 24000000 array bytes plus owner today); a defensive 32 MiB aggregate guard is checked before reservation and on actual capacity, and is not reachable by current caps before allocation. Native f32 widens into f64 measurement; rate-dependent response retained, stated only as selected-transfer facts at named frequencies (not a wideband, profile-accuracy or conformity bound); the 48 kHz stages have an independent numeric anchor, other rates share the oracle's calibration facts. Odd-rate floor grid, artificial tail and nearest zero-based percentile policy are own choices, without standards certification. Whole-call preflight and full optional-tail headroom; finite filter overflow invalidates readings and reports with original committed coordinate while raw record slices stay readable as diagnostic history only, nonfinite source measured silence, audio untouched, Excluded channels run no filter and keep no K history. CONTROL-only scan/sort/analysis, explicit ceil(3Fs/2) LRA tail (first policy wins; no tail when nothing admitted) with exact capacity refusal, no implicit Drop work, concurrent UI, advanced spatial metadata, physical/timestamp/acoustic or deadline claim. Selected FFmpeg rank/histogram differences and the 0.233355 LU LRA mismatch retained.

Source: crates/ravet-signal/src/loudness.rs, crates/ravet-signal/src/filter.rs.

Tests: crates/ravet-signal/tests/loudness.rs, crates/ravet-signal/tests/loudness_calibration.rs, crates/ravet-signal/tests/loudness_graph.rs, crates/ravet-signal/tests/data/loudness-coefficient-oracle.csv, crates/ravet-signal/tests/loudness_decimal_oracle.py, crates/ravet-signal/tests/loudness_ffmpeg_oracle.py, crates/ravet-signal/examples/loudness-file.rs.

Documentation: docs/signal-processing.md, docs/decisions/0264-prepared-calibrated-loudness-range.md, crates/ravet-signal/third-party/loudness-calibration-brecht-de-man.txt.

Explicit scoped native floating-control ownership

A separate optional numerical boundary provides thread-bound no_std scopes with exact prior control/status restoration, actual flush-profile admission and failure-owned optional Processor integration.

Limits: Ordinary OS AArch64 FPCR/FPSR and x86_64 SSE2 MXCSR only; actual DAZ/FTZ/AH/trap admission. Preserve isolates scope-created status as well as retaining controls. Compiler/library expression semantics, x87/half/SVE, physical x86 support, automatic SIMD, host/device and deadline claims are excluded from this receipt. Manual AUDIO hook pairing remains the consumer obligation; child faults do not imply history rollback.

Source: crates/ravet-native-dsp/src/lib.rs, crates/ravet-native-dsp/src/native.rs, crates/ravet-native-dsp/src/processor.rs.

Tests: crates/ravet-native-dsp/src/tests.rs, crates/ravet-native-dsp/src/processor/tests.rs, crates/ravet-native-dsp/tests/guard.rs, crates/ravet-native-dsp/tests/processor.rs, crates/ravet-native-dsp/tests/graph.rs.

Documentation: docs/native-dsp.md, docs/decisions/0266-scoped-native-floating-control.md.

Explicit packed float values and prepared vector slices

Explicit Scalar/NEON/SSE2 f32x4/f64x2 values and lane masks provide full arithmetic, comparison, bit selection, transforms and declared reductions; prepared no_std slice operations admit complete prefixes and channel banks before edits.

Limits: Widths4/2 and maxima1..1048576, channel-bank gain1..64, immutable selected backend; native admission is compile-time aarch64+neon or x86_64+sse2 only; actual native CPU/math policy applies without an automatic denormal guard. Scalar sqrt uses direct exact libm0.2.16. Clip endpoint ordering observes active input flushing. Slice arithmetic is bit-qualified only under the no-flush Preserve profile. Right-preference ties/NaNs and unfused/width-dependent reduction order are explicit. Native execution qualified on AArch64, x86_64 separately through Rosetta; no physical x86, AVX/half/SVE/integer-vector, SIMD ABI/register residency, whole FFT/FIR vectorization, universal speedup/deadline or host/device claim.

Source: crates/ravet-native-dsp/src/packed.rs, crates/ravet-native-dsp/src/packed_native.rs, crates/ravet-native-dsp/src/vector_ops.rs, crates/ravet-native-dsp/examples/vector-ops.rs.

Tests: crates/ravet-native-dsp/tests/packed.rs, crates/ravet-native-dsp/tests/vector_ops.rs, crates/ravet-native-dsp/tests/vector_special.rs, crates/ravet-native-dsp/tests/vector_graph.rs, crates/ravet-native-dsp/tests/review_bits.rs, crates/ravet-native-dsp/tests/review_exact.rs, crates/ravet-native-dsp/tests/review_refusal.rs, crates/ravet-native-dsp/tests/review_vector_graph.rs, crates/ravet-native-dsp/tests/data/sqrt-decimal-oracle.csv, crates/ravet-native-dsp/tests/sqrt_decimal_oracle.py.

Documentation: docs/native-dsp.md, docs/decisions/0267-explicit-packed-register-and-slice-family.md.

Canonical native table acquisition

Runtime acquisition preserves exact immutable processor/parameter/cache/audio-state/state/telemetry table addresses across exports and transitive companions.

Limits: Same concrete family/precision and loaded originating library only; CONTROL acquisition/lifetime and exact type/pointer obligations remain. NativeProcessor::entry is no longer const-callable. Metadata validation can allocate under its existing contract; no table interning registry or relaxed structural equivalence. Offline cross-codegen/default-consumer tests do not establish host or deadline support.

Source: crates/ravet-native/src/entry.rs, crates/ravet-native/src/parameters.rs, crates/ravet-native/src/parameter_cache.rs, crates/ravet-native/src/audio_state.rs, crates/ravet-native/src/state_publication.rs, crates/ravet-native/src/telemetry.rs.

Tests: tools/native-validation/table_identity.cpp, tools/native-validation/table-identity.cmake, crates/ravet-native/tests/entry.rs, crates/ravet-native/tests/parameters.rs, crates/ravet-native/tests/parameter_cache.rs, crates/ravet-native/tests/audio_state.rs, crates/ravet-native/tests/state_publication.rs, crates/ravet-native/tests/telemetry.rs.

Documentation: docs/native-table-identity.md, docs/decisions/0249-native-canonical-tables.md.

Coalesced CLAP host requests

Core restart/process/callback requests use an atomic coalesced mailbox with explicit deferral and bounded main-thread callback service.

Limits: Consumers own restart/process transitions, wakeups and native scheduling. Mailbox must match instance. No automatic audio/device lifecycle or extension-specific host request handling; repeated kinds coalesce.

Source: crates/ravet-host/src/requests.rs, crates/ravet-host/examples/inspect.rs.

Tests: crates/ravet-host/tests/requests.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0053-coalesced-host-requests.md.

Bounded hosted CLAP parameters

Owned stable-ID/plain-value metadata, atomic refresh, validated reads and explicit inactive parameter edits borrow the live instance.

Limits: Control-thread 1..4096 maximum, no cookie caching/normalization. Consumers own rescan, output queues and acknowledgement checks. No active automation scheduler, automatic refresh or persistence fallback; separate opt-in ParameterHost handles extension requests.

Source: crates/ravet-host/src/parameters.rs, crates/ravet-host/examples/inspect.rs.

Tests: crates/ravet-host/tests/parameters.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0054-hosted-parameters.md.

Deferred CLAP host parameter callbacks

Opt-in parameter host handlers defer coalesced rescan/flush and bounded exact-ID clear actions while preserving core lifecycle requests.

Limits: 64 distinct main-thread clear IDs between drains; overflow retains prefix and requires consumer reconciliation/rejection. Main mailbox owner-thread only. No automatic reference storage, refresh/recovery, active automation or native lifecycle scheduler.

Source: crates/ravet-host/src/parameter_requests.rs, crates/ravet-host/src/requests.rs.

Tests: crates/ravet-host/tests/parameter_requests.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0062-host-parameter-requests.md.

Bounded hosted CLAP audio metadata

Owned inactive directional port snapshots validate IDs/layout/precision/pairs, with optional main-thread latency and audio-owner tail queries.

Limits: 0..9 ports per direction/1..64 channels, 256-byte names/types. Inactive inspection and atomic refresh; missing audio extension means no ports, missing timing stays None. No configuration negotiation, automatic compensation or native graph integration; separate ProcessingHost receives change notifications.

Source: crates/ravet-host/src/audio_configuration.rs, crates/ravet-host/examples/inspect.rs.

Tests: crates/ravet-host/tests/audio_configuration.rs, crates/ravet-host/tests/linked_sine.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0063-hosted-audio-configuration.md.

Deferred CLAP audio configuration callbacks

Opt-in combined processing host advertises port/latency/tail and parameter callbacks, with atomic coalesced audio-change handoff and explicit deferral.

Limits: Consumer owns deactivation, correct-thread timing query, metadata refresh and prepared route rebuilding. No ordered history, automatic restarts/wakes, compensation or native graph scheduling.

Source: crates/ravet-host/src/audio_requests.rs, crates/ravet-host/examples/inspect.rs.

Tests: crates/ravet-host/tests/audio_requests.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0064-host-audio-change-requests.md.

Borrowed CLAP parameter registration

Portable schemas supply validated complete CLAP count/info metadata with exact physical bounds/defaults, ordered module/process policy and a sole binary bypass; gain consumes the registration.

Limits: 0..1024 parameters; names 255/module paths 1023 UTF-8 bytes without NUL, valid CLAP IDs; discrete ranges require contiguous unit integers. Explicit global/scoped flags remain consumer policy; no cookies, value storage, formatting/flush/rescan or automatic plug-in generation/lifecycle.

Source: crates/ravet-clap/src/parameters.rs, crates/ravet-clap/src/lib.rs, examples/gain-clap/src/lib.rs.

Tests: crates/ravet-clap/tests/parameters.rs, examples/gain-clap/tests/parameter_registration.rs.

Documentation: docs/parameters.md, docs/decisions/0073-clap-parameter-registration.md.

Explicit zero-volume note expression

Portable and native f64 linear volume accepts zero mute and preserves signed zero and positive subnormals through complete event conversion and worker handoff.

Limits: Finite0..4; no change to native v1 tags/layout. CLAP remains strictly positive0<x<=4: selected zero input rejects, zero generated output rejects whole delivery before any host write, with rendered DSP/audio retained. No epsilon substitution, voice application/allocator or VST3/DAW support follows from this scalar contract. Provisional APIs; older consumers may reject zero.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-native/src/event.rs, crates/ravet-clap/src/notes.rs, crates/ravet-host/src/graph_note_expression.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-foundation/tests/note_expression.rs, crates/ravet-native/tests/events.rs, crates/ravet-clap/src/notes.rs, crates/ravet-clap/tests/notes.rs, crates/ravet-clap/tests/output.rs, crates/ravet-host/src/graph_note_expression.rs, crates/ravet-device/tests/graph_events.rs.

Documentation: docs/extended-processing.md, docs/native-processing.md, docs/decisions/0159-zero-volume-note-expression.md.

Custom transfer functions and clipping waveshapers

Inline caller-owned f32/f64 transfer functions run once per sample, with explicit f64 hard-clip, tanh and cubic soft-clip constructors and in-place/separate block processing.

Limits: No implicit drive/gain, smoothing, DC removal, oversampling or alias-free/deadline claim. Wrapper has no history/latency/tail or heap actions; custom function resources/state/real-time behavior belong to callers. Exact block lengths preflight before output/calls; empty no-op. Built-ins propagate NaN and bound infinities; custom nonfinite policy is unchanged. Cubic endpoints are +/-2/3, not unity-normalized.

Source: crates/ravet-signal/src/waveshaper.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/waveshaper.rs.

Documentation: docs/signal-processing.md, docs/decisions/0149-sample-wise-waveshapers.md.

Prepared biquad filters

Validated normalized stable coefficients and six Q-based and two slope-based shelving cookbook designs drive f64 transposed direct-form II processing and control-thread response inspection.

Limits: One channel per instance; no higher-order designer, coefficient smoothing, audio sanitization, denormal policy or deadline guarantee. Finite rate/frequency/Q/gain bounds and unrepresentable stability margins reject. Shelves use gain -120..120 dB and slope (0,1], distinct from Q; numerical extreme accuracy/headroom remains caller responsibility.

Source: crates/ravet-signal/src/filter.rs.

Tests: crates/ravet-signal/src/filter.rs, crates/ravet-signal/tests/prepared.rs, crates/ravet-signal/tests/shelves.rs.

Documentation: docs/signal-processing.md, docs/decisions/0019-signal-kernels.md, docs/decisions/0087-shelving-filters.md.

Fixed cascades and even-order Butterworth designs

Fixed 1..16 validated second-order sections provide f64 cascading, history-preserving replacement and even-order low/high pass Butterworth preparation.

Limits: One channel, orders 2..32, finite rate/strict interior cutoff; unrepresentable stages reject. No odd orders, band designs, automatic order/family selection or smoothing. Arbitrary stage gains/headroom/product overflow and nonfinite/denormal policies belong to callers; offline numerical/heap evidence, no deadline claim.

Source: crates/ravet-signal/src/cascade.rs, crates/ravet-signal/src/lib.rs, crates/ravet-signal/src/filter.rs.

Tests: crates/ravet-signal/tests/cascade.rs.

Documentation: docs/signal-processing.md, docs/decisions/0088-fixed-filter-cascades.md.

Prepared simultaneous-output state-variable filter

One-channel f64 trapezoidal integrators return low/band/high outputs together with prepared coefficients and retained histories.

Limits: Rate positive/finite, cutoff/rate 1e-6..=0.499999, Q 0.1..=100; raw band gain Q. No smoothing/nonlinear saturation/denormal policy/arbitrary-modulation stability/deadline guarantee. Nonfinite audio propagates and extreme finite amplitudes can overflow.

Source: crates/ravet-signal/src/state_variable.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/state_variable.rs.

Documentation: docs/signal-processing.md, docs/decisions/0095-linear-state-variable-filter.md.

Prepared fourth-order Linkwitz–Riley crossover

Fixed-storage one-channel f64 low/high branches use two identical Butterworth sections each, with half-amplitude cutoff and all-pass recombination.

Limits: Finite positive rate, cutoff strictly between DC/Nyquist; unrepresentable stable designs reject. Equal-length caller buffers preflight atomically; empty no-op, reset clears histories and unsmoothed replacement retains them. Unity summed magnitude is not input waveform identity. LR4 electrical profile only, no loudspeaker alignment, other orders, automatic routing/modulation, nonfinite/denormal/headroom or native deadline claim.

Source: crates/ravet-signal/src/crossover.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/crossover.rs.

Documentation: docs/signal-processing.md, docs/decisions/0139-linkwitz-riley-crossover.md.

Prepared complex FFT

Precomputed radix-two f64 FFT transforms exact-length caller-owned complex buffers forward or normalized inverse without callback allocation.

Limits: Power-of-two sizes 1..1,048,576; no real-only packing, windowing, SIMD, nonfinite-input sanitization or deadline guarantee.

Source: crates/ravet-signal/src/fft.rs.

Tests: crates/ravet-signal/src/fft.rs, crates/ravet-signal/tests/prepared.rs.

Documentation: docs/signal-processing.md, docs/decisions/0019-signal-kernels.md.

Prepared real half spectra and cosine windows

Real forward/inverse transforms reuse full-complex FFT scratch, and explicit window families expose sampled gain/energy/noise bandwidth.

Limits: Sizes 1..1048576; FFT powers of two and N/2+1 bins. Inverse imaginary DC/Nyquist must be zero; other nonfinite values propagate. Rectangular/Hann/Hamming/Blackman/Blackman-Harris, symmetric/periodic; no sampled peak/automatic gain correction, optimized real-only/SIMD/overlap-add/native deadline claim.

Source: crates/ravet-signal/src/real_fft.rs, crates/ravet-signal/src/window.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/spectral.rs.

Documentation: docs/signal-processing.md, docs/decisions/0097-real-spectra-and-windows.md.

Prepared partitioned FFT convolution

Uniform f64 overlap-add response partitions and a prepared input spectrum ring produce streaming long-response convolution independent of caller block sizes.

Limits: One channel, 1..262144 finite taps, power-of-two partition 16..4096; exact one-partition latency and explicit zero flush. Bursty transforms, no deadline, SIMD, nonuniform partitioning, live crossfade or zero-latency head claim.

Source: crates/ravet-signal/src/partitioned.rs.

Tests: crates/ravet-signal/tests/partitioned.rs.

Documentation: docs/signal-processing.md, docs/decisions/0031-partitioned-convolution.md.

Native-precision zero-latency, uniform and nonuniform convolution banks

Prepared f32 and f64 convolution engines run zero-latency direct-head, uniformly delayed and two-stage nonuniform partitioned schedules with 1..64-channel diagonal banks and a native f32 FFT; info reports exact latency, tail, stage layout and storage.

Limits: 1..262144 finite taps per channel; head/partition power of two 16..4096, late partition power of two head..16384; maximum block 1..65536; aggregate numeric budget 1 byte..256 MiB per engine or bank checked before fallible allocation and against actual capacities (allocator overhead excluded), so max-length f64 two-stage banks hold at most 14 channels. Fixed two-stage schedule, not optimal partitioning. Diagonal channels only: no true-stereo matrix, crossfeed or linked normalization. Engines perform no loading, rate conversion, trim, normalization or live replacement themselves (see impulse-response-preparation and live-convolution-transitions). Nonfinite and denormal values propagate. Direct head O(head) per sample, bursty FFT boundaries; selected-profile rounding observations only, no deadline, SIMD, DAW, device or platform claim.

Source: crates/ravet-signal/src/convolution_family.rs, crates/ravet-signal/src/fft32.rs, crates/ravet-signal/src/fft.rs.

Tests: crates/ravet-signal/tests/convolution_family.rs, crates/ravet-signal/tests/convolution_family_review.rs, crates/ravet-signal/tests/convolution_graph.rs, crates/ravet-signal/tests/support/convolution_processor.rs, crates/ravet-signal/tests/fft_native32.rs, crates/ravet-signal/src/fft.rs.

Documentation: docs/signal-processing.md, docs/decisions/0270-native-convolution-schedules.md.

Explicit source-rate impulse-response preparation

Memory or WAV/AIFF/compressed-file responses are prepared at their source rate for a target engine rate with explicit sinc conversion (gain and delay policies), channel mapping, linked threshold trimming with recorded offsets and peak/energy normalization with reported gain, then built into native f32/f64 convolution engines or banks.

Limits: Memory path always built in ravet-signal; the file path requires ravet-audio-file's default-disabled resampled-playback feature. Planar f64 1..64 channels, 1..4194304 source frames, rates 1..768000 Hz; existing 1025-phase Blackman integer-rate sinc only (even taps 16..256, ratio 1/16..16), whole-frame delay removal with reported fractional remainder; prepared length 1..262144; result/staging/table budget 1 byte..256 MiB checked before allocation (file path adds source storage). Select/identity mapping only, no mixing or true-stereo matrix; linked trim/normalization only; energy sums are power-of-two scaled (overflowing gain refused NonFinite, underflowing UnrepresentableGain). Existing sinc table allocation is infallible (budgeted). Whole-call refusal, no partial result; file reads have no rollback. CONTROL/worker allocation. Analytic references at selected rate pairs only; no spectral guarantee, deadline, DAW or platform claim.

Source: crates/ravet-signal/src/impulse_response.rs, crates/ravet-audio-file/src/impulse_file.rs.

Tests: crates/ravet-signal/tests/impulse_response.rs, crates/ravet-audio-file/tests/impulse_file.rs.

Documentation: docs/signal-processing.md, docs/audio-files.md, docs/decisions/0272-impulse-response-preparation-and-live-convolution-transitions.md.

Live convolution transitions with worker ownership

A default-disabled ravet-graph feature hands worker-prepared native convolution engines or banks to audio through a bounded one-slot handoff, runs old and new engines through an explicit equal-gain or equal-power crossfade, returns old, refused and superseded engines for control-thread disposal and reports latency changes.

Limits: Feature convolution-transitions (optional ravet-signal). Convolver32/64 and ConvolutionBank32/64 only; fade 0..1048576 frames starting at block boundaries; two engines at most, the new one from empty history by default, so responses longer than the fade dip in level by up to the missing tail energy (optional priming in convolution-transition-continuity); mid-fade Refuse (stays refused under backpressure)/QueueOne/LatestWins (newest wins after the fade); latency RequireEqual or Report, unaligned by default (consumer applies host latency; mixed during fade; optional alignment in convolution-transition-continuity). Four returned slots plus one deferred slot, then a held completed outgoing; starts wait under backpressure; status authoritative, 16 best-effort reports with loss counts. Not a Processor; endpoints constructed/dropped off audio (the dropping thread frees its engines; the last endpoint frees queued engines). Offline exact-blend, allocation and concurrency evidence only; no deadline, DAW, device or platform claim.

Source: crates/ravet-graph/src/convolution_transition.rs, crates/ravet-graph/Cargo.toml.

Tests: crates/ravet-graph/tests/convolution_transition.rs.

Documentation: docs/audio-graphs.md, docs/decisions/0272-impulse-response-preparation-and-live-convolution-transitions.md.

History priming and latency alignment for convolution transitions

Optional continuity policies for live convolution transitions: a prepared input-history ring primes the incoming engine before its fade (single-block or bounded delayed-fade schedule) so it matches a never-switched engine, and prepared delay lines align engines of different latency during the fade, report each output-latency change and refuse differences above a configured maximum.

Limits: Feature convolution-transitions via convolution_transition_with_continuity; TransitionContinuity::NONE (default) is the same code path; its ADR 0272 behaviour is guarded by the 15 unchanged transition tests and by digests recorded from the ADR 0272 build in 108 scenarios. Priming history 1..1048576 frames per channel, frames_per_block >= history or > maximum_frames; delayed fades start within ceil((lag - B)/(B - block)) blocks; history shorter than the incoming tail only reduces the dip; a history shorter than requested primes only the recorded frames. Alignment maximum difference 0..1048576 frames, Release semantics only: the lower-latency path is delayed during the fade, the output latency changes at the start (increase, repeating the difference) or at fade completion (decrease, skipping it); without priming a delayed new path reads zeros for the first difference frames of the fade; a cut changes latency with no delay; no Hold mode, fractional latency or host negotiation. Refusal happens at the audio start boundary (returned as Refused with an AlignmentRefused event), not at offer. Continuity storage at most 256 MiB of samples, overflow-checked before fallible allocation; per-block copies are proportional to the block, and delay lines are forgotten in constant time at starts and reset (a delayed path reads zeros for its delay after reset). Offline exact-reference, impulse-onset, allocation and seeded concurrency evidence only; no deadline, DAW, device or platform claim.

Source: crates/ravet-graph/src/convolution_transition.rs, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-graph/tests/convolution_transition_continuity.rs.

Documentation: docs/audio-graphs.md, docs/decisions/0275-convolution-transition-priming-and-latency-alignment.md.

Stack-backed streaming reconstruction kernels

One-channel f64 hold/linear/Catmull-Rom/cubic/quartic Lagrange reconstruction exposes bounded source/output prefixes and floating or exact integer-rate schedules without heap storage.

Limits: Five stack history samples; one independent f64 owner per channel, immutable kind/rates, ratio1/16..16; finite-positive float convenience has no long-duration exact-count guarantee, positive-u32 integer rates use bounded signed phase. Common ceil source bracket means Hold can consume an unnecessary future sample; finite prefix exposes only bracket-available output. Nominal delays0/0/1/1/2 source samples; fractional lookahead/adapter delivery latency separate. Exact integer available count1+floor((N-1)O/I) forN>0, empty none; no automatic EOS/zero tail/trim/equal-rate copy. Exact consumed/produced prefixes and untouched output suffix; invalid additive gain preserves state/output, zero gain advances with bitwise unchanged output. No heap/locks/I/O anywhere in kernel lifecycle; arbitrary caller capacity still bounds work. No antialias filtering, overshoot/alias/nonfinite/headroom/denormal caller policy; explicit sinc alternative. Independent numeric/partition/long phase/heap and actual stereo Foundation/Graph/FIR consumer fixtures only; no third-party PCM equality, live drift, SIMD/native/device/deadline support claim.

Source: crates/ravet-signal/src/interpolation.rs.

Tests: crates/ravet-signal/tests/interpolation.rs, crates/ravet-signal/src/interpolation.rs.

Documentation: docs/signal-processing.md, docs/decisions/0235-low-cost-streaming-interpolation.md.

Selected-order elliptic designs

Fixed one-channel f64 sections provide elliptic pass and stop ripple with LP/HP orders1..32, band total even orders2..32, genuine finite transformed zeros/parity gains and strict bounded supplied-edge specification selection.

Limits: At most16 fixed f64 sections; band total order twice prototype degree. Finite positive rate/ordered inside-Nyquist pass edges,0<Rp<As<=300dB/Rp<=120; edges distinct from -3dB. Explicit complementary moduli, max32-step AGM/max128-step degree/inverse solves, relative residual<=1e-12, strict finite/gain/pole/Jury rejection without clamps; not all extreme parameter combinations representable. Exact closed N1 avoids nome/inverse underflow. Odd/even reference1/10^(-Rp/20), far-stop0/10^(-As/20), finite actual stop notches. CONTROL design no heap/dependencies; callback sample/block/reset no heap/lock/I/O; replacement resets all history/independent channel owner. Spec complete-integral minimum start/admissible warped-edge midpoint/strict actual supplied-edge verification/retry<=32, actual order/edge/stop ratio exposed; no continuous postround certificate/global-f64-edge minimum. Nonfinite/headroom/denormal/transitions consumer policy; no smoothing/finite IIR drain/native deadline/physical-host-platform/DSP closure. Independent quadrature/NIST values/series/log-nome/theta/rational, closed N1/N2 polynomial and real-band time, parity/notch/spec/partition/heap/steady tone/finite impulse plus actual prepared stereo Foundation/Graph evidence.

Source: crates/ravet-signal/src/elliptic.rs.

Tests: crates/ravet-signal/src/elliptic.rs, crates/ravet-signal/tests/elliptic.rs.

Documentation: docs/signal-processing.md, docs/decisions/0243-selected-order-elliptic-designs.md.

Selected-order Chebyshev I and II designs

Fixed one-channel f64 sections provide both Chebyshev ripple families with LP/HP orders1..32, band total even orders2..32, genuine finite Type II zeros/parity gains and strict bounded supplied-edge specification selection.

Limits: At most16 fixed sections, total band order twice prototype degree; finite positive rate/inside-Nyquist ordered edges. TypeI ripple(0,120]dB/even-degree pass floor and unity peaks, TypeII attenuation(0,300]dB/finite transformed unit-circle notches/even nonzero far-stop limit. Family edges pass/stop distinct from -3dB. CONTROL design no heap/dependency; strict finite/gain/intermediate/Jury rejects without clamps. Spec0<Rp<As<=300/Rp<=120, analytic minimum start/admissible warped-edge midpoint/actual strict supplied-edge verification/bounded retry<=32, actual kind/order/edge exposed; no continuous-certified extrema/global-f64-edge-minimum claim. Sample/block/reset no allocation/lock/I/O, set_design resets all histories, independent channel owner; unchanged old filters/cascades. Nonfinite/headroom/denormal/transition consumer policy, no smoothing/crossfade/finite IIR drain/native deadline/broad physical/host/platform/DSP closure. Independent scalar/T2 polynomial/N1 and real-band time/notch/parity/spec/partition/heap, rendered tone/finite impulse and actual stereo Foundation/Graph fixtures.

Source: crates/ravet-signal/src/chebyshev.rs.

Tests: crates/ravet-signal/tests/chebyshev.rs.

Documentation: docs/signal-processing.md, docs/decisions/0242-selected-order-chebyshev-designs.md.

Selected-order Butterworth filters and verified specifications

Fixed one-channel f64 sections cover low/high digital orders1..32 and bandpass/bandstop total even orders2..32, with strict bounded pass/stop specification selection.

Limits: At most16 fixed sections; separately prewarped edges, odd first-order and transformed real/conjugate band roots, endpoint/warped-center normalization. Finite positive rate and frequencies strictly inside Nyquist; total band order is twice prototype degree. CONTROL design/no dependencies; strict finite/Jury/gain/intermediate representability rejects without clamps. Specification0<Rp<As<=300dB, analytic minimum starting order and verified admissible warped-cutoff geometric midpoint, bounded retries through32; actual rounded SOS obey requested pass/stop bounds, actual selected order/cutoff exposed, no search of all representable cutoffs. One-channel sample/block/reset allocation/lock/I/O free; set_design resets all histories, existing const-generic cascade behavior unchanged. Nonfinite audio/headroom/denormal/transition consumer policy; no smoothing/crossfade/finite IIR tail/native deadline or broad physical/host/platform claim. Independent scalar/polynomial/time/tones/spec/partition/heap and actual stereo Foundation/Graph fixtures.

Source: crates/ravet-signal/src/butterworth.rs.

Tests: crates/ravet-signal/tests/butterworth.rs.

Documentation: docs/signal-processing.md, docs/decisions/0238-selected-order-butterworth-designs.md.

Prepared FIR coefficient design family

Owned symmetric f64 FIR coefficients cover cosine/Kaiser windowed LP/HP/BP/BS, transparent empirical Kaiser sizing, analytic degree1..4 transitions, weighted integrated least squares and exact-zero windowed halfband.

Limits: CONTROL fallible coefficient allocation/Drop,2..65536 taps<=512KiB, finite positive rate/ordered inside-Nyquist edges; HP/BS odd3..65535, LP/BP TypeI/II half-sample delay explicit. Cosine/Kaiser beta0..32, actual DC/Nyquist/arithmetic-center normalization rejects unrepresentability. Kaiser attenuation8..120dB empirical sizing only, actual65dB first-lobe shortfall retained, privately linked actual coefficients/beta/estimated order, no verified continuous specification. Transition degree1..4 from rectangle convolutions, finite truncation/normalization separate. LS odd3..511 taps/V<=256/1..32 sorted linear desired bands, endpoint[-16,16]/weight(0,1e6], matrix<=512KiB, unregularized Cholesky with documented64epsV diagonal pivot and1024epsV residual checks; no gain renormalization, unconstrained gaps may overshoot. Halfband length4m+3<=65535/central0.5/exact alternating zeros, windowed not equiripple. Reuse unchanged direct/partitioned convolution; delay(N-1)/2, tailN-1 separate from block latency; no host mapping, minimum phase, certified bounds/minimax/crossfade/native deadline/broad physical/host/platform claim. Independent band/Bessel/transition/LS math, ownership/max/preflight and actual stereo Foundation/Graph/direct/partitioned delay/tail/heap fixtures.

Source: crates/ravet-signal/src/fir_design.rs.

Tests: crates/ravet-signal/tests/fir_design.rs.

Documentation: docs/signal-processing.md, docs/decisions/0239-fir-coefficient-design-family.md.

Sampled equiripple FIR and constrained halfband design

Bounded weighted sampled minimax exchange generates actual symmetric LP/HP/BP/BS and reduced halfband coefficients with immutable error/ripple/extrema/convergence/resource receipts for existing direct and partitioned FIR consumers.

Limits: TypeI odd3..511/TypeII even2..512, generic1..32 separated positive-width bands0..Nyquist/finite signed linear targets[-16,16]/weights(0,1e6]; exact available positive Nyquist and finite normalized0...5 endpoints preserving original widths/gaps/DC/Nyquist identities before allocation; nonzero Nyquist rejects forTypeII, forcedzero endpoint observed/excluded support. Density8..64/maxiterations1..128/relativegap1e-12..1e-3 defaults16/64/1e-8, max32768observedgrid/4MiB aggregate declared numeric capacity excluding allocator overhead, declared budget checked before reserve and actual capacities afterward; fallible CONTROL allocation/reused scratch/no new deps. Real log-barycentric sampled maximin exchange/final cosine coefficient recovery, actual fullgrid/alternating rounded checks; stall/exhaustion explicit NonConvergence and no partial result. Error/ripple/extrema/iterations/grid/capacity/normalized allowance/weightscale immutable, original units restored with normalized observations preserving underflow/global-scaling meaning. Numeric allowance128eps(V+1)max(1,maxdesired,sumcoeff), above1e-6*targetscale rejects. Reducedhalfband N4m+3/3..511/fullwidth0..0.5, exactcenter.5/evenoffset0/symmetry/complement/quartercycle, free-basis alternating low and explicitly evaluated actual reflectedstop support/full rounded low+stop grid maximum, retainDCripple/no normalization/projection. Existing FIR processors supply latency(N-1)/2/fullfinite tail/reset/heap-free callbacks, actual canonical stereo Graph/direct/partitioned evidence. Independent low-variable LP vertices and85-digit Decimal nonnegative dual/fullactualgrid profiles incl nonconstant511/512. Finite sampled numerical evidence distinct from continuous/global-f64 certificate or automatic tap/spec sizing; no Hilbert/differentiator/physical-host-platform/native deadline/SIMD claim.

Source: crates/ravet-signal/src/fir_equiripple.rs, crates/ravet-signal/src/fir_design.rs.

Tests: crates/ravet-signal/tests/fir_equiripple.rs, crates/ravet-signal/tests/equiripple_decimal_oracle.py, crates/ravet-signal/examples/equiripple_evidence.rs.

Documentation: docs/signal-processing.md, docs/decisions/0245-sampled-equiripple-fir-designs.md.

Prepared FIR convolution

Copied finite impulse responses and a prepared f64 history ring produce streaming direct convolution with reset and explicit tail length.

Limits: 1..65,536 taps, one channel, O(taps) work per sample. No partitioned FFT engine, response crossfade, sample sanitization or deadline guarantee; long responses need another engine.

Source: crates/ravet-signal/src/convolution.rs.

Tests: crates/ravet-signal/src/convolution.rs, crates/ravet-signal/tests/prepared.rs.

Documentation: docs/signal-processing.md, docs/decisions/0019-signal-kernels.md.

Selectable streaming oversampling

Stack-backed 1x/2x/4x/8x half-band cascades invoke caller-owned high-rate DSP in temporal order with persistent filter state and allocation-free reset.

Limits: One f32 channel and fixed coefficient profile; no arbitrary ratios, factor-change crossfade, dry alignment, constant integer latency compensation or deadline guarantee. Consumers prepare their closure DSP at the multiplied sample rate.

Source: crates/ravet-signal/src/oversampling.rs.

Tests: crates/ravet-signal/src/oversampling.rs, crates/ravet-signal/tests/prepared.rs.

Documentation: docs/signal-processing.md, docs/decisions/0019-signal-kernels.md.

Native first-order topology-preserving filter family

Prepared native f64/f32 first-order trapezoidal LP/HP/allpass designs, simultaneous one-update outputs and fixed independently channelled banks expose explicit preserved/reset capacitor histories with whole-prefix validation.

Limits: Finite rate 1..768000 Hz/cutoff positive below actual Nyquist; original Hz/normalized ratio/prewarp/gain/complement/rounded pole checks and explicit f32 conversion reject unavailable endpoints without nudge/repair. Requested metadata and actual coefficient ideal LTI spectrum distinct, no recursive floating error guarantee. One signed capacitor update returns all LP/HP/allpass; prepared design set preserves state, replace resets, finite signed reset-to validates, caller-only subnormal snap never implicit at block boundaries. Native fixed 1..64-channel banks/max block 1..65536, whole channel/prefix/bound preflight before mutation, suffix untouched/empty no-op/unavailable channel preserves state. No dependencies/framework allocation/locks/I/O; CONTROL tan versus prepared callback selection explicit. Infinite ideal recursive tail/actual subnormal rounding; no smoothing/crossfade/inaudibility/arbitrary modulation stability/finite EOF flush/constant integer latency/dry alignment/sanitization/headroom repair/global denormal mode/SIMD/deadline. Independent analog-bilinear/polynomial/initial/time-varying circuit/all-channel/partition/error/heap and actual native stereo Foundation/Graph→existing FIR evidence (f32 FIR precision bridge caller-explicit); no physical/DAW/platform/acoustic support inference. Existing biquad/state-variable defaults unchanged.

Source: crates/ravet-signal/src/first_order_tpt.rs.

Tests: crates/ravet-signal/tests/first_order_tpt.rs.

Documentation: docs/signal-processing.md, docs/decisions/0252-first-order-topology-preserving-filters.md.

Native six-stage modulated feedback phaser

Prepared native f64/f32 independently channelled six-stage TPT allpass phaser with explicit log-frequency LFO/phase offsets, signed delayed feedback, exact dry/wet endpoints and full-prefix state preflight.

Limits: Sample rate8000..768000, channels1..64/block1..65536; LFO0 or .001..100Hz, depth0..1 four-octave maximum half-span, feedback[-.99,.99]/mix0..1, complete original floating/native sweep normalized1e-6..0.49 admits without clamp/repair. Native recurrence/audio but explicit f64 phase/transcendentals per frame/channel; no hidden smoothing/oversampling/drive/normalization/limiter. Static ideal allpass/small-gain and selected matrix-tail/rounding observations are distinct from arbitrary modulation stability, executed perfect allpass, finite EOF/constant latency/ideal long-time oscillator. Recursive tails, abrupt retune/aliasing, native nonfinite/overflow poison and headroom/denormal policy caller-owned; no SIMD/native deadline/physical/DAW support inference. Native32 nine-profile/six-frequency/131072-frame rounding comparison is a finite qualification, not universal analytic error bound; actual Graph FIR consumer uses explicit f32/f64 bridge.

Source: crates/ravet-signal/src/phaser.rs, crates/ravet-signal/src/first_order_tpt.rs.

Tests: crates/ravet-signal/tests/phaser.rs, crates/ravet-signal/tests/first_order_tpt.rs.

Documentation: docs/signal-processing.md, docs/decisions/0257-six-stage-native-modulated-feedback-phaser.md.

Native nonlinear multimode ladder

Prepared native f32/f64 six-mode four-RC ladder with an explicit single feedback-summing tanh model, bounded amplitude-scaled implicit solve and independent multichannel histories.

Limits: Rate 8000..768000 Hz, original/divided cutoff 1e-5..0.45, resonance 0..1, drive 1..32, channels 1..64, frames <=65536. Single-saturator model, BP total order, no hidden normalization/oversampling/control smoothing. Rounded native residual selection and platform tanh; retained trapezoidal integrator memory. Native32 low-cutoff stationary rounding floors/persistent subnormal tails are explicitly observed; caller denormal policy. k=4 is marginal; no universal retune/headroom/accuracy/alias-free or physical/deadline claim. Zero-resonance alias reference does not qualify nonlinear feedback aliasing; f32 consumer explicitly bridges existing f64 FIR.

Source: crates/ravet-signal/src/ladder.rs.

Tests: crates/ravet-signal/tests/ladder.rs, crates/ravet-signal/tests/ladder_review.rs, crates/ravet-signal/tests/ladder_planar_graph.rs, crates/ravet-signal/tests/ladder-decimal.csv, crates/ravet-signal/tests/ladder-history-decimal.csv, crates/ravet-signal/tests/ladder-equation-drift.csv, crates/ravet-signal/tests/ladder_decimal_oracle.py, crates/ravet-signal/tests/ladder_history_decimal_oracle.py, crates/ravet-signal/tests/ladder_equation_drift_oracle.py, crates/ravet-signal/examples/ladder-oracle-inputs.rs, crates/ravet-signal/examples/ladder-history-oracle-inputs.rs.

Documentation: docs/signal-processing.md, docs/decisions/0258-native-nonlinear-multimode-ladder.md.

Prepared panning curves and pair ramps

Seven explicit panning laws with unity-endpoint/center normalization, native f64/f32 prepared gains, exact frame-count pair ramps and reusable mono-to-stereo/stereo-balance prefix consumers.

Limits: Pan -1..1; ramp 0..u32::MAX frames and prepared block maximum 1..65536; both native variants explicitly interpolate gain endpoints in f64. Unity-center normalization can boost endpoints up to 2; gain ramps need not preserve a static law or power, and nonfinite/overflow audio is multiplied without sanitization. No crossfeed, universal correlation/loudness compensation, latency-compensated dry/wet FIFO, SIMD or native deadline claim; f32 Graph fixture uses an explicit f64 FIR bridge.

Source: crates/ravet-signal/src/panning.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/panning.rs.

Documentation: docs/signal-processing.md, docs/decisions/0255-prepared-panning-curves-and-pair-ramps.md.

Paired native dry/wet queues and latency compensation

Seven direct wet-coordinate mixing laws/two normalizations, native f64/f32 independently pushed delayed-dry FIFO and wet consumption with shared exact pair ramps, four causal latency profiles and atomic whole-prefix admission.

Limits: Channels1..64, block/FIFO1..65536, maximum latency0..4194300 subject to checked aggregate32MiB declared and actual-capacity budget; CONTROL reservation/disposal and capacity-dependent reset. Native32 nonzero fractional FIR/Thiran delay quantized to0/1 rejects, Thiran actual a=1 rejects; Integer floors. Requested/native actual latency distinct; changed latency requires empty dry queue, identical request no-op, accepted retap preserves history without crossfade/modulation guarantee. Caller owns corresponding wet sequence, actual wet latency, clocks, tails/EOF and headroom; no queue silence/drop repair or automatic finalization. Native sample products/addition, explicit f64 pair interpolation, no hidden FMA/normalization repair/limiter/sanitization/SIMD/deadline. Fractional FIR not ideal delay, cubic overshoot and Thiran frequency-dependent group delay/infinite tail; nonfinite/overflow can poison history until reset. Actual native3-channel Foundation/Graph real wet FIR composition includes explicit f32/f64 FIR bridge, not physical/device/DAW support. Both precisions reject actual fractional Thiran a rounded1; Integer fraction/a getters are unused observations, not executed delay. Native delay reconstruction and caller denormal policy are explicit. Fractional2.5-group-delay Graph/FIR null fixture qualifies shared phase with unequal magnitude, not broadband exact alignment.

Source: crates/ravet-signal/src/dry_wet.rs, crates/ravet-signal/src/panning.rs.

Tests: crates/ravet-signal/tests/dry_wet.rs, crates/ravet-signal/tests/panning.rs, crates/ravet-signal/tests/dry_wet_review.rs, crates/ravet-signal/tests/dry_wet_maximum_fraction.rs.

Documentation: docs/signal-processing.md, docs/decisions/0256-paired-dry-wet-queues-and-causal-latency.md.

Native peak and RMS attack/release ballistics

Explicit prepared f64/f32 peak and scaled-energy RMS followers and fixed independent channel banks provide sample/planar ballistics with whole-prefix preflight, observable native timing and caller-only history policies.

Limits: Rate 1..768000 Hz/times 0..60 seconds, zero instantaneous; stable alpha preparation and explicit f32 quantization reject nonzero alpha/complement endpoints or unresolved RMS release factor, actual native coefficients and rounding distinguished from ideal amplitude/energy settling. RMS uses max/min normalized squared ratio, no forced full-magnitude square or precomputed square-root-weight mass bias; exact zero/equal branches, finite ratio/release underflow and native timing rounding remain. Fixed independent 1..64-channel banks/max block 1..65536; all channel counts/prefixes/bounds preflight before history/output, suffixes untouched, empty no-op, invalid channel/reset preserves states. Reset/config replacement clears history unsmoothed; snap clears only subnormal amplitude states caller-explicitly, never at block boundaries. NaN sticky NaN, otherwise infinity sticky positive infinity until reset; no sanitization. No dependencies/allocation/framework locks/I/O; native sqrt/caller work unqualified for deadline/SIMD. Infinite ideal tail/no window RMS/true-peak/loudness/channel linking/lookahead/hysteresis/headroom repair/global denormal mode. Independent closed-form/convolution/wide-energy/native-release/rounding/partition/poison/all-channel/heap and actual native stereo Foundation/Graph gain evidence only; no physical/DAW/platform/acoustic support inference. Legacy dynamics defaults unchanged.

Source: crates/ravet-signal/src/ballistics.rs.

Tests: crates/ravet-signal/tests/ballistics.rs.

Documentation: docs/signal-processing.md, docs/decisions/0251-native-peak-rms-ballistics.md.

Configured elliptic allpass halfband and oversampling

Immutable selected or edge-sized f64 and explicit rounded f32 halfband profiles feed full-rate complementary filters, independent polyphase 2x and per-stage 1/2/4/8 cascade consumers with actual numerical and native Graph evidence.

Limits: Odd 1..63/high-rate full normalized width (0,.5), fixed 31 coefficients/4097 closed sampled stopband observations, no dependencies or allocation; bounded AGM/Jacobi and 128-step residual-qualified degree inversion, unavailable edges/moduli/derived nominal >300 dB/duplicate or unstable coefficients reject without repair/projection. Requested attenuation finite above 10log10(2) and at most 300 dB, analytic odd minimum/retry through 63, strict actual rounded stop-edge admission; nominal prototype/actual edges/sampled maximum remain separate, no continuous whole-stopband certificate. Explicit f32 quantization validates and re-measures actual coefficients and has its own sizing; nominal f64 metadata does not imply f32 attenuation. Full-rate LP/HP power complement with frequency-dependent allpass phase, order 1 exact two-sample average/difference and both unequal branch classes; independent up/down 2x, even decimation/previous odd state/interpolation gain 2 relative to zero stuffing. Native f32/f64 configurable 1/2/4/8 with three pairs/eight stack samples, exact child count/time order; reset/replace clears all history, length preflight preserves state/output and never invokes child. Caller block size/child bounds; no smoothing/finite IIR EOF tail/dry alignment/integer host latency/sanitization/headroom/denormal/SIMD/native deadline. Independent series/theta poles/rational/time/cascade/phase-peak/actual imaging and alias, native f32/f64 Foundation/Graph and heap fixtures only; no physical/DAW/platform support inference. Existing fixed defaults unchanged.

Source: crates/ravet-signal/src/halfband_iir.rs.

Tests: crates/ravet-signal/tests/halfband_iir.rs.

Documentation: docs/signal-processing.md, docs/decisions/0248-configured-iir-halfband-design.md.

Streaming two-times oversampling

One-channel fixed half-band IIR interpolation and decimation preserve stream state across blocks and reset without allocating.

Limits: One fixed 2x f32 profile. Wet-path phase delay is uncompensated. No generic coefficient design, block API, native denormal control, or real-time deadline guarantee.

Source: crates/ravet-signal/src/oversampling.rs.

Tests: crates/ravet-signal/src/oversampling.rs.

Documentation: docs/architecture.md, docs/decisions/0004-prepared-dsp-primitives.md.

Prepared arbitrary-ratio sinc resampling

A prepared causal f64 windowed-sinc converter interpolates phase tables, reports exact consumed/produced prefixes and preserves pending output under backpressure.

Limits: One channel, rate ratio 1/16..16, even 16..256 taps, fixed quality/cutoff. Filter delay (taps-1)/2 input samples; explicit trailing-zero flush. Optional bounded live ppm profile is separate; no automatic adaptive clocking, broad spectral/deadline claim or implicit device conversion.

Source: crates/ravet-signal/src/resampling.rs.

Tests: crates/ravet-signal/tests/resampling.rs.

Documentation: docs/signal-processing.md, docs/decisions/0025-synthesis-dynamics-resampling.md.

Prepared bounded live sinc rate adjustment

A conservative prepared cutoff permits symmetric live ppm rate changes without resetting histories, pending phase or replacing storage; allocation-free preflight shares preparation bounds.

Limits: One-channel f64, maximum finite (0,10000] ppm; entire adjusted step range 1/16..16, even 16..256 taps. New spacing follows the already scheduled next output; reset retains adjustment. No automatic clock/FIFO controller, smoothing, physical drift/device conversion, broad spectral or native deadline guarantee.

Source: crates/ravet-signal/src/resampling.rs.

Tests: crates/ravet-signal/tests/variable_resampling.rs, crates/ravet-signal/tests/resampling.rs.

Documentation: docs/signal-processing.md, docs/decisions/0102-bounded-live-resampling.md.

Bounded FIFO-depth resampler clock correction

Fixed-state exponential/proportional queue feedback clamps and slews caller-clocked ppm corrections for prepared variable resamplers.

Limits: Capacity2..131072/target strictly inside, maxppm (0,10000], gain0.001..1000ppm/frame, smoothing0..60s, slew0.001..1000000ppm/s; observations <=capacity with finite elapsed (0,10]s. Proportional steady occupancy offset, no integral estimator/clock reads/device integration/universal stability/physical drift/deadline guarantee.

Source: crates/ravet-signal/src/fifo_clock.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/fifo_clock.rs.

Documentation: docs/signal-processing.md, docs/decisions/0103-fifo-clock-controller.md.

Selectable causal fractional-delay profiles

A prepared one-channel f64 owner processes exactly one temporal output per input using integer, linear, causal cubic Lagrange or first-order Thiran interpolation.

Limits: Immutable policy/maximum; maximum0..4194300 samples plus4 causal-support f64 slots <=32MiB, checked fallible CONTROL allocation and CONTROL Drop. Initially delay0; finite0..maximum immediate history-preserving edits, invalid/mismatched lengths preserve full state/output. One output/advance per input; no arbitrary recursive tap rereads. Integer truncates, Linear droops, causal one-sided four-node cubic can overshoot; no extra minimum/nominal delay. Fixed Thiran magnitude unity and DC group delay d, frequency-dependent delay and arbitrarily long alternating tail; nonzero f whose coefficient rounds to1 rejects, integer bypass updates both histories. Static allpass claims separate from modulation/feedback. Process/reset/edits no heap/locks/I/O, reset O(capacity); nonfinite/headroom/denormal/reset consumer policy. No automatic multichannel/rate conversion/feedback/latency/tail/flush/deadline support; unchanged existing DelayLine/chorus/comb/reverb defaults. Independent numeric/tail/partition/modulation/heap and actual stereo Foundation/Graph fixtures only, no broader physical/host claim.

Source: crates/ravet-signal/src/fractional_delay.rs.

Tests: crates/ravet-signal/tests/fractional_delay.rs.

Documentation: docs/signal-processing.md, docs/decisions/0237-selectable-causal-fractional-delay.md.

Prepared delay and feedback diffusion

Double-precision circular delay storage supports fractional interpolation, whole-sample reads, separate read/write/advance operations, and a feedback diffuser with allocation-free reset.

Limits: Preparation allocates. Finite delays clamp to storage length; nonfinite reads return zero. The diffuser is not a unity-magnitude allpass; callers must supply stable finite coefficients.

Source: crates/ravet-signal/src/delay.rs.

Tests: crates/ravet-signal/src/delay.rs.

Documentation: docs/architecture.md, docs/decisions/0004-prepared-dsp-primitives.md.

Prepared feedforward and feedback comb filters

One-channel f64 fixed-delay combs provide feedforward input echoes or recursive output feedback, with history-preserving validated coefficient edits.

Limits: Delay 1..1048576 whole samples, one allocation <=8 MiB excluding overhead. Feedforward coefficient finite; feedback finite with magnitude strictly below one. Both include unity direct input; zero coefficient returns input exactly while advancing history. Type/delay changes require preparation; no damping, fractional delay, normalization, smoothing, headroom/nonfinite/denormal or native deadline guarantee. Portable offline evidence only.

Source: crates/ravet-signal/src/comb.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/comb.rs.

Documentation: docs/signal-processing.md, docs/decisions/0150-prepared-comb-filters.md.

Prepared damped mono Schroeder-style reverb

Four parallel damped combs and two canonical allpasses provide synthetic mono f64 reverberation with prepared delay storage and live wet mixing.

Limits: Rate 8000..192000, room scale 0.5..2, nominal comb DC decay 0.1..20s, damping pole >=20Hz/below Nyquist, wet 0..1; six delays <=60787 f64 samples. No physical-room/exact overall T60/stereo/freeze/modulation/headroom/denormal/native-deadline claim; nonfinite/overflow can propagate.

Source: crates/ravet-signal/src/reverb.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/reverb.rs.

Documentation: docs/signal-processing.md, docs/decisions/0096-prepared-mono-reverb.md.

Prepared damped stereo Schroeder-style reverb

Two prepared mono networks use common excitation, bounded right-delay spread and wet width interpolation while preserving dry stereo channels.

Limits: Existing mono configuration bounds; spread 0..10ms, wet/width finite 0..1, twelve delay buffers<=133094 f64 samples. No smoothing, freeze/modulation, guaranteed decorrelation/physical-room fidelity, headroom/sanitization/denormal/native deadline claim. Nonfinite/extreme amplitudes may poison/overflow histories; opposite-polarity input cancels wet excitation. Portable offline evidence only.

Source: crates/ravet-signal/src/reverb.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/stereo_reverb.rs, crates/ravet-signal/tests/reverb.rs.

Documentation: docs/signal-processing.md, docs/decisions/0128-prepared-stereo-reverb.md.

Prepared stereo modulated fractional-delay chorus

Independent stereo f64 feedback delays and a shared sine LFO with right phase offset provide bounded chorus modulation, exact dry/wet endpoints and atomic live control edits.

Limits: Finite 8000..192000 Hz preparation; two ceil(rate0.2)+1 buffers at most 76802 f64 values. Rate 0..100 Hz, center 1..100 ms, fractional depth/mix/phase 0..1 and feedback -0.99..0.99. Delay center(1+depth*sin) clips to at least one sample; linear interpolation is not bandlimited. Edits retain phase/history without smoothing; zero rate freezes phase, dry advances wet history, reset retains controls. Exact in-place channel lengths preflight atomically, empty no-op. No crossfeed, automatic latency/tail, headroom/nonfinite/denormal or native deadline claim; offline DSP evidence only.

Source: crates/ravet-signal/src/chorus.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/chorus.rs.

Documentation: docs/signal-processing.md, docs/decisions/0141-prepared-stereo-chorus.md.

Peak detector and soft-knee compressor

Validated attack/release peak detection and explicit-sidechain f64 soft-knee compression provide prepared per-sample processing and allocation-free reset.

Limits: Single channel; no lookahead, linked channels, brickwall limiting or automatic makeup. Audio is not sanitized; log/pow used per sample. 0..60 second detector time constants, threshold -120..24 dB, ratio 1..100, knee 0..48 dB, makeup -60..60 dB.

Source: crates/ravet-signal/src/dynamics.rs.

Tests: crates/ravet-signal/tests/synthesis_dynamics.rs.

Documentation: docs/signal-processing.md, docs/decisions/0025-synthesis-dynamics-resampling.md.

Prepared downward-expansion noise gate

A validated f64 explicit-sidechain gate provides ratio-based downward expansion, quadratic soft knee and finite attenuation floor over a rectified attack/release detector.

Limits: Threshold -120..24 dB, ratio 1..100, knee 0..48 dB, floor -120..0 dB, times 0..60 seconds. One channel, ratio one unity; no hard mute, hold/hysteresis, linked channels, lookahead or separate gain smoothing. Nonfinite samples unsanitized; per-sample log/pow, offline heap/numerical evidence only.

Source: crates/ravet-signal/src/dynamics.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/noise_gate.rs.

Documentation: docs/signal-processing.md, docs/decisions/0086-downward-noise-gate.md.

Prepared sample-peak limiter

One f64 channel uses instantaneous peak attack, exponential release and symmetric final clipping to limit sampled amplitudes with prepared ceiling/time settings.

Limits: Ceiling -120..24 dBFS, release 0..60 seconds, finite positive rate; zero release memoryless. No lookahead, true/intersample-peak, linked channels, oversampling or separate gain smoothing. Nonfinite input unvalidated/history can poison; clipping can distort. Offline numerical/heap evidence, no native deadline claim.

Source: crates/ravet-signal/src/dynamics.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/limiter.rs.

Documentation: docs/signal-processing.md, docs/decisions/0089-sample-peak-limiter.md.

Phase-continuous synthesis oscillators

f64 sine, polyBLEP saw/square and naive triangle preserve phase on validated frequency retuning and waveform switching with allocation-free generation/reset.

Limits: Single channel, zero to below Nyquist; triangle may alias, sine uses sample trig. No alias-free synthesis, wavetable, voice policy or deadline claim.

Source: crates/ravet-signal/src/oscillator.rs.

Tests: crates/ravet-signal/tests/synthesis_dynamics.rs.

Documentation: docs/signal-processing.md, docs/decisions/0025-synthesis-dynamics-resampling.md.

Prepared periodic wavetable oscillator

Caller-defined finite periodic f64 tables provide wrapped linear lookup without per-sample trigonometry, with phase-preserving frequency changes and reset.

Limits: 2..65536 table samples/512KiB owned storage; finite positive rate and finite 0<=frequency<Nyquist. Prepare/clone/drop allocate; processing/reset/retune do not. No smoothing, bandlimited/alias-free synthesis, headroom/denormal/output sanitation or native deadline claim; extreme finite amplitudes can overflow interpolation. Offline portable evidence only.

Source: crates/ravet-signal/src/oscillator.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/wavetable.rs, crates/ravet-signal/tests/synthesis_dynamics.rs.

Documentation: docs/signal-processing.md, docs/decisions/0129-prepared-wavetable-oscillator.md.

Sample-counted ADSR envelopes

Validated linear attack/decay/sustain/release stages preserve current level on retrigger/release, exact ramp endpoints, immediate zero-duration transitions and allocation-free reset.

Limits: One envelope per voice; rounded durations up to u32::MAX samples, sustain 0..1. No exponential curves, live configuration replacement, sustain-pedal policy or automatic note routing.

Source: crates/ravet-signal/src/envelope.rs.

Tests: crates/ravet-signal/src/envelope.rs, crates/ravet-signal/tests/prepared.rs.

Documentation: docs/signal-processing.md, docs/decisions/0019-signal-kernels.md.

Linear parameter smoothing

Finite sample-counted ramps support retargeting, immediate changes, reset, and sample-rate conversion independently of block boundaries.

Limits: Linear smoothing only; delay/diffusion and oversampling are separate primitives. Prepared biquad filters are separate; synthesis oscillators are separate prepared primitives.

Source: crates/ravet-signal/src/smoothing.rs.

Tests: crates/ravet-signal/src/smoothing.rs, examples/gain/tests/processing.rs.

Documentation: docs/decisions/0001-portable-processing.md.

Positive multiplicative parameter smoothing

Finite positive f32 values transition geometrically over explicit sample counts with retargeting independent of block boundaries, preserved identical targets and exact final snap.

Limits: Strictly positive endpoints; zero/negative reject separately from nonfinite, without state mutation. u32 sample duration; ratio design uses f64 log/exp on retarget, sample multiply/endpoint clipping. f32 values/very long rounded-unity ramps may repeat; no signed/zero crossings, duration smoothing, automatic units or native deadline claim. Portable offline tests only.

Source: crates/ravet-signal/src/smoothing.rs, crates/ravet-signal/src/lib.rs.

Tests: crates/ravet-signal/tests/multiplicative_smoothing.rs, crates/ravet-signal/src/smoothing.rs.

Documentation: docs/signal-processing.md, docs/decisions/0131-multiplicative-smoothing.md.

Prepared quadrature rotation

Precomputed double-precision rotations advance caller-owned sine/cosine pairs and fixed banks without allocation or per-sample trigonometric calls.

Limits: Finite signed increments within one cycle; consumers own phase, reset, frequency changes, and periodic reanchoring. Repeated floating-point rotations accumulate error; no bit-exact or deadline guarantee.

Source: crates/ravet-signal/src/rotation.rs.

Tests: crates/ravet-signal/src/rotation.rs.

Documentation: docs/architecture.md, docs/decisions/0009-quadrature-rotation.md.

Native f64 peak and RMS meters

Fixed-storage scaled sum-of-squares preserves native f64 peak/RMS for extreme finite and subnormal samples, with explicit optional bounded f32 telemetry.

Limits: Nonfinite samples count as silence/diagnostic; u64-full windows ignore further samples. No audio sanitization, native UI/mailbox/deadline or device evidence.

Source: crates/ravet-signal/src/meter64.rs, examples/gain/src/precision64.rs.

Tests: crates/ravet-signal/src/meter64.rs, examples/gain/tests/precision64.rs.

Documentation: docs/parameters.md, docs/decisions/0065-native-f64-gain.md.

Reusable parameter schema and state

Borrowed parameter schemas provide stable IDs, validated linear/logarithmic and discrete mappings, fixed-size complete state records, and explicit ID-based migration.

Limits: Bounded caller-selected portable schema size and product-owned version/semantic migration policy. Product-specific CLAP gain/bypass integration exists; host transport remains product-owned, with reusable UI attachments available separately; no preset discovery.

Source: crates/ravet-foundation/src/parameter.rs, examples/gain/src/state.rs.

Tests: crates/ravet-foundation/tests/parameters.rs, examples/gain/tests/parameters.rs.

Documentation: docs/parameters.md, docs/decisions/0010-parameter-state-and-meters.md.

Observable hierarchical state and undoable presets

An explicit control-thread store provides stable-ID trees, atomic grouped edits, bounded undo/redo, revision subscriptions with resync, and deterministic complete product-identified preset records.

Limits: Allocates/clones on control threads; up to 4096 nodes, depth 64, 16 MiB state/transaction payload, 128 history snapshots/journal batches. Poll cursors belong to one store. No preset file discovery, migration, host programs or audio-thread delivery.

Source: crates/ravet-state/Cargo.toml, crates/ravet-state/src/lib.rs.

Tests: crates/ravet-state/tests/state.rs.

Documentation: docs/observable-state.md, docs/decisions/0024-observable-state.md.

Explicit preset-file libraries

Consumer-selected directories provide sorted bounded preset metadata, validated atomic replacement and complete undoable selected-file recall through observable state.

Limits: 4096 directory entries, 128-byte portable ASCII stems, product-tagged tree codec/library/destination bounds. Blocking/allocating runtime dependency outside portable umbrella; no watcher, categories/Unicode titles, host program/discovery extension, rename/delete or power-loss/platform/DAW claim.

Source: crates/ravet-preset/Cargo.toml, crates/ravet-preset/src/lib.rs.

Tests: crates/ravet-preset/tests/library.rs.

Documentation: docs/preset-files.md, docs/decisions/0035-explicit-preset-files.md.

Immutable complete parameter program banks

Borrowed catalogues validate complete canonical parameter states with unique stable IDs/MIDI addresses and bounded heap-free lookup/copy.

Limits: 1..128 programs, 1..1024 parameters, <=65536 values; names <=255 UTF8 bytes/no NUL, bank 0..16383/number 0..127. Consumer owns publication, current identity, persistence, host registration/notifications and DSP/voice switching.

Source: crates/ravet-foundation/src/program.rs, crates/ravet-foundation/src/lib.rs.

Tests: crates/ravet-foundation/tests/programs.rs, crates/ravet-instrument/tests/programs.rs.

Documentation: docs/parameters.md, docs/decisions/0080-complete-program-banks.md.

Reusable UI parameter attachments

Stable-ID attachments borrow validated metadata, map physical/normalized linear/logarithmic/discrete input, refresh host values without feedback, and submit explicit gestures through a product transport trait.

Limits: UI-thread mechanism only; no widgets, automatic subscriptions, scheduling or transport ownership. Owners explicitly end active gestures. Failed transport calls preserve gesture ownership; displayed values change only on refresh. Gain CLAP integrates the layer as a prototype.

Source: crates/ravet-surface/src/attachment.rs, crates/ravet-surface/src/lib.rs, examples/gain-clap/src/gui.rs, examples/gain-clap/src/lib.rs.

Tests: crates/ravet-surface/tests/attachments.rs, examples/gain-clap/src/control_tests.rs, tools/editor-smoke/src/main.rs.

Documentation: docs/parameter-attachments.md, docs/decisions/0016-attachments-and-resizing.md.

Portable MIDI 1.0 short messages

Validated wire-preserving channel/system messages decode controllers, pitch bend and pressure; a nonallocating running-status decoder handles interleaved real-time messages and timed processor events.

Limits: Short-message decoder only. SysEx start reports unsupported and payload is skipped until recovery; UMP and voice policy are separate APIs. No files, device clocks or backend delivery in this decoder. Gain ignores MIDI; generic CLAP mapping is separate.

Source: crates/ravet-foundation/src/midi.rs, crates/ravet-foundation/src/event.rs.

Tests: crates/ravet-foundation/tests/midi.rs.

Documentation: docs/midi.md.

Full-resolution MIDI 2.0 channel voice

Typed MT=4 channel voice encoding/decoding preserves velocity, controller and per-note resolution with explicit group/channel addressing.

Limits: Codec only. Reserved bits are ignored on reception and canonicalized on encoding; unknown attributes retained. No protocol/profile negotiation, MIDI 1.0 conversion, native UMP delivery or synthesis integration.

Source: crates/ravet-foundation/src/midi2.rs.

Tests: crates/ravet-foundation/tests/midi2.rs.

Documentation: docs/midi.md, docs/decisions/0050-midi2-channel-voice.md.

Fixed-storage UMP framing

Exact one-to-four-word packets, incremental framing, opaque reserved payloads and explicit big-endian serialization.

Limits: Framing only; no semantic validation, SysEx assembly, protocol negotiation, processor event mapping or native UMP delivery. Byte order is explicitly chosen by the consumer.

Source: crates/ravet-foundation/src/ump.rs.

Tests: crates/ravet-foundation/tests/ump.rs.

Documentation: docs/midi.md, docs/decisions/0049-ump-framing.md.

UMP short messages and SysEx assembly

MIDI 1.0 UMP short-message codecs, SysEx7/SysEx8 payload chunks and caller-buffer single-stream assembly with explicit abort and atomic rejection.

Limits: Payload codecs only. Consumers route concurrent streams, enforce whole-stream SysEx7 interspersing rules and interpret manufacturer/profile data. No protocol conversion, negotiated stream limits, timestamps or native UMP delivery.

Source: crates/ravet-foundation/src/ump.rs, crates/ravet-foundation/src/ump_sysex.rs.

Tests: crates/ravet-foundation/tests/ump.rs, crates/ravet-foundation/tests/ump_sysex.rs.

Documentation: docs/midi.md, docs/decisions/0051-ump-short-sysex.md.

Bounded MIDI voice allocation and configured expression

Fixed 1..128-slot voice ownership provides deterministic stealing, duplicate note-off matching, sustain/sostenuto, pressure/bend/timbre snapshots and configured lower/upper member expression with separate master pressure/timbre.

Limits: Receiver policy only; no DSP/instrument export, implicit negotiation (explicit single-zone receiver is separate), overlapping zones or MIDI-CI; master/member pressure and timbre stay separate for consumer combination. Released tails freeze expression; configured channel reuse releases prior notes. Caller owns release completion.

Source: crates/ravet-instrument/Cargo.toml, crates/ravet-instrument/src/lib.rs.

Tests: crates/ravet-instrument/tests/voices.rs, crates/ravet-instrument/src/lib.rs.

Documentation: docs/midi.md, docs/decisions/0027-midi-voice-ownership.md.

Bounded normalized performance voice ownership

A separate fixed receiver preserves optional full-u32 note IDs, unquantized velocities and seven exact f64 expressions, with conjunctive targets, explicit retrigger/release/steal/choke/completion and complete timed semantic preflight.

Limits: One already routed endpoint, 1..128 slots, at most 1024 events/65536 frames per preflight. Same-ID address changes reject until completion/reset. Expressions update release tails; defaults are receiver policy. No MIDI/UMP/pedals, smoothing, DSP, implicit output reservation/publication or format export. Consumers budget later DSP completions and retain exclusive ownership. Local heap checks do not prove deadlines or DAW/platform support.

Source: crates/ravet-instrument/src/performance.rs, crates/ravet-instrument/src/lib.rs.

Tests: crates/ravet-instrument/tests/performance.rs.

Documentation: docs/midi.md, docs/decisions/0163-native-performance-voice-ownership.md.

Two-zone MPE voice receiver

A fixed shared voice pool negotiates lower/upper zones with latest-overlap precedence, shared-channel/master notes, independent zone ranges and post-note-off expression rules.

Limits: 1..128 shared slots; every accepted configuration clears all zones' notes/controllers/tails. Integer ranges 0..96; both-disabled polyphonic fallback, unassigned channels ignored when active. Pressure/timbre combination belongs to DSP. Sound catalogue/commit/mode/other-pedal/MIDI-CI and native conformance remain separate; existing sine uses legacy single-zone policy.

Source: crates/ravet-instrument/src/receiver.rs, crates/ravet-instrument/src/lib.rs.

Tests: crates/ravet-instrument/tests/receiver.rs.

Documentation: docs/midi.md, docs/decisions/0059-two-zone-mpe-receiver.md.

Opt-in single-zone MIDI RPN negotiation

Per-channel RPN decoding drives explicitly selected lower/upper zone configuration, master/member whole-semitone bend ranges and live voice snapshots.

Limits: One chosen zone, 1..128 voices, 0..15 members; accepted zone changes kill all slots/controllers and reset bend ranges. No fractional range negotiation, polyphonic RPN0, NRPN data/increments, overlapping zones, MIDI-CI or synth/format export; master/member pressure/timbre are separate snapshots.

Source: crates/ravet-instrument/src/negotiation.rs.

Tests: crates/ravet-instrument/tests/negotiation.rs.

Documentation: docs/midi.md, docs/decisions/0037-single-zone-negotiation.md.

Captured sostenuto voice ownership

CC66 rising edges capture held notes with independent sustain release, channel/MPE-zone isolation and sample-timed sine integration.

Limits: 1..128 fixed slots, binary >=64 threshold, held notes only; repeated on does not recapture. Master-only in MPE, including compatibility notes. No other/half pedals, piano model, native controller/DAW conformance or MIDI2 pedal policy.

Source: crates/ravet-instrument/src/lib.rs, crates/ravet-instrument/src/receiver.rs, crates/ravet-instrument/src/synthesis.rs.

Tests: crates/ravet-instrument/tests/pedals.rs, crates/ravet-instrument/tests/synthesis.rs, examples/sine-clap/tests/support/mod.rs.

Documentation: docs/midi.md, docs/decisions/0079-sostenuto-ownership.md.

Staged MIDI bank and program requests

Sixteen fixed channel selectors stage CC0/32 and emit exact bank/program requests on Program Change, preserving pending/request distinction.

Limits: MIDI1 only; zero-based bank/program, repeated PC emits again. CC120/121/123 preserve bank/request; explicit/System Reset clears. No availability/commit, MPE routing, files, host mapping, voice/DSP policy or implicit scheduling.

Source: crates/ravet-instrument/src/program.rs, crates/ravet-instrument/src/lib.rs.

Tests: crates/ravet-instrument/tests/programs.rs.

Documentation: docs/midi.md, docs/decisions/0080-complete-program-banks.md.

Master-routed MPE program requests

Negotiated single-/two-zone receivers return independently staged master program requests without changing voices; ordinary polyphony retains per-channel requests.

Limits: MIDI1 requests only, no sound commit/current identity. Active member/unassigned channels ignored; any accepted RPN6/reset clears every bank/request, RPN0/CC121 preserve. Sine consumes chosen-master requests; native controller/DAW/host menu/MIDI2 conformance remains separate.

Source: crates/ravet-instrument/src/negotiation.rs, crates/ravet-instrument/src/receiver.rs, crates/ravet-instrument/src/synthesis.rs.

Tests: crates/ravet-instrument/tests/programs.rs, crates/ravet-instrument/tests/synthesis.rs, examples/sine-clap/tests/support/mod.rs.

Documentation: docs/midi.md, docs/decisions/0082-mpe-program-requests.md.

Prepared UMP device packet handoff

Unique SPSC endpoints preserve framed numeric words, explicit protocol labels and opaque timestamps with whole-batch framing preflight and bounded prefix delivery.

Limits: 1..4096 packets, 4096 words per batch; malformed whole batches publish nothing, full/abandoned suffix discarded. Protocol/clock semantics belong to native producers. Construction/drop outside callbacks; no native device connection or deadline claim.

Source: crates/ravet-midi-device/src/ump.rs, crates/ravet-midi-device/Cargo.toml.

Tests: crates/ravet-midi-device/tests/ump.rs.

Documentation: docs/midi.md, docs/decisions/0060-prepared-ump-handoff.md.

Bounded OSC packet codecs and explicit UDP

Explicit worker/control APIs encode/decode padded ASCII OSC messages and nested bundles, preserve borrowed data/timetags and exchange datagrams only with caller-selected numeric endpoints.

Limits: 65504 bytes, eight levels, 256 packets/arguments, supported tags i/f/s/b/h/d/t/T/F/N/I. Allocating/blocking; no scheduling, nested timetag semantics, pattern dispatch, audio bridge, authentication or implicit network activity. macOS localhost fixtures only.

Source: crates/ravet-osc/Cargo.toml, crates/ravet-osc/src/lib.rs.

Tests: crates/ravet-osc/tests/packets.rs.

Documentation: docs/osc.md, docs/decisions/0030-osc-codecs-transport.md.

Prepared explicit clocked duplex conversion

Opt-in FIFO-depth feedback drives aligned per-input-channel sinc conversion into the output-clock processor, with priming and underrun recovery.

Limits: Explicit f32 1..64-channel devices/rates8000..192000 and corrected sinc ratio1/16..16; scratch1..65536/taps16..256 even, power-of-two ring2..65536 matching clock capacity. Sequential streams, independent telemetry, no sample alignment/fallback/hotplug/automatic recovery/events/recording/universal stability/long-session hardware drift/deadline guarantee.

Source: crates/ravet-device/src/clocked.rs, crates/ravet-device/src/input.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/tests/clocked.rs, crates/ravet-device/tests/input.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0104-clocked-duplex.md.

Caller-scheduled exact clocked duplex recovery

Exact device-pair service releases unhealthy/missing streams and reopens fresh FIFO, conversion/controller and factory-owned processors with shared recovery ownership.

Limits: Fixed f32 clocked configuration bounds; IDs1..4096 bytes/no NUL, explicit control-thread cadence/backoff. No fallback/settings mutation/timer/hotplug subscription/state migration/recording/native plug-in lifecycle or physical fault/long-session drift/deadline guarantee. Ordinary FIFO shortages/drops and processor faults alone do not reopen.

Source: crates/ravet-device/src/recovery.rs, crates/ravet-device/src/clocked.rs, crates/ravet-signal/src/resampling.rs, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/tests/clocked.rs, crates/ravet-device/src/recovery.rs, crates/ravet-signal/tests/variable_resampling.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/signal-processing.md, docs/decisions/0105-clocked-duplex-recovery.md.

Bounded WAV reading and writing

Explicit worker/control-thread RIFF PCM16/24/32 and Float32 streams use bounded scratch, validated chunks, frame seeking, untouched read tails and explicit recording finalization.

Limits: Seekable I/O only; 1..64 channels, 1..768000 Hz, up to 65536 scratch frames, 4096 chunks, RIFF size cap. Partial write poisons output. No compressed codecs, AIFF, extensible/RF64/W64, transport scheduling or device recording claim.

Source: crates/ravet-audio-file/Cargo.toml, crates/ravet-audio-file/src/lib.rs, crates/ravet-audio-file/src/wave.rs.

Tests: crates/ravet-audio-file/tests/streams.rs.

Documentation: docs/audio-files.md, docs/decisions/0026-audio-streams.md.

Bounded seekable AIFF PCM streams

Uncompressed big-endian PCM16/24/32 readers and writers provide exact integer extended80 rates, bounded frame decoding/seeking and explicit finalized recording.

Limits: 1..64 channels, integer 1..768000 Hz, 65536 scratch frames and 32-bit FORM size. No AIFF-C, fractional rates, nonzero SSND blockSize, metadata/loops or WAV-worker integration. Control/worker I/O only; partial writes poison. Core Audio synthetic-file interoperability verified on local macOS.

Source: crates/ravet-audio-file/src/aiff.rs, crates/ravet-audio-file/examples/aiff.rs.

Tests: crates/ravet-audio-file/tests/aiff.rs.

Documentation: docs/audio-files.md, docs/decisions/0043-bounded-aiff-streams.md.

Optional FLAC, MP3 and Ogg/Vorbis clip decoding

Explicit bounded encoded bytes decode into finite interleaved f32 clips using pinned opt-in Symphonia, with whole-result errors, stable configuration and gapless trim.

Limits: Off-by-default compressed feature; 64 MiB input/output, 65536 decoded packet frames, 1048576 packets, 1..64 channels/1..768000 Hz. Worker only; backend internal allocations/time not globally bounded. Complete-clip API; separate APIs add replay seeks/FLAC writing. No all-corruption detection or general gapless conformance. Synthetic declared lengths pass; Vorbis FFmpeg duration difference recorded. MPL-2.0 dependency retains separate obligations.

Source: crates/ravet-audio-file/src/compressed.rs, crates/ravet-audio-file/Cargo.toml, crates/ravet-audio-file/examples/decode.rs, scripts/generate-audio-fixtures.py.

Tests: crates/ravet-audio-file/tests/compressed.rs, crates/ravet-audio-file/tests/fixtures/README.md.

Documentation: docs/audio-files.md, docs/decisions/0045-optional-compressed-decoding.md.

Lazy compressed reads and exact worker seeks

Optional FLAC/MP3/Vorbis reader lazily decodes bounded interleaved reads and atomically seeks exact decoded frames by replaying a fresh decoder.

Limits: Owned encoded bytes <=64 MiB; same sample/rate/channel/packet/metadata limits as clip decoding. Seek O(target), worker-only, faults poison/clear output and may advance cursor; EOF validates duration/integrity. No indexed/file-backed/native-clock/callback streaming.

Source: crates/ravet-audio-file/src/compressed_stream.rs, crates/ravet-audio-file/src/compressed.rs.

Tests: crates/ravet-audio-file/tests/compressed_stream.rs.

Documentation: docs/audio-files.md, docs/decisions/0068-compressed-worker-streams.md.

Verified indexed native-FLAC worker seeks

An explicit compressed-reader mode verifies native FLAC once, retains bounded immutable compressed packets and positions exact candidate seeks by binary search and one packet decode; existing stopped read-ahead generation replacement accepts the indexed reader.

Limits: Native fLaC with a nonzero declared duration only; encoded input and cumulative retained packet payload independently capped at 64 MiB, index at 65,536 entries, caller frames and total interleaved samples at 16,777,216, packet capacity at 65,536 frames. Construction decodes the complete stream and checks available MD5; suffix decoders do not repeat whole-stream verification. Worker-only backend allocations, additional temporary/index memory and no total-memory/deadline guarantee. MP3/Vorbis/Ogg-FLAC/unknown-duration indexed seeks, file-backed indexing, live seek/loops, clock/resampling and physical recording remain outside this mode.

Source: crates/ravet-audio-file/src/compressed_indexed.rs, crates/ravet-audio-file/src/compressed_stream.rs, crates/ravet-audio-file/src/compressed_buffered.rs.

Tests: crates/ravet-audio-file/tests/compressed_indexed.rs, crates/ravet-audio-file/src/compressed_indexed.rs, crates/ravet-audio-file/tests/compressed_stream.rs, crates/ravet-audio-file/tests/compressed_buffered.rs.

Documentation: docs/audio-files.md, docs/decisions/0168-indexed-flac-worker-seeks.md.

Buffered WAV read-ahead and recording

Worker pumps retain decoded suffixes under ring backpressure, discard old playback generations on stopped seek and drain input capture to bounded WAV recording with explicit finalization.

Limits: WAV only, prepared worker scratch; stopped seek borrows matching endpoints. Recording errors poison after dequeue, finish requires stopped producer. No implicit thread/device/path/capture permission, live seek, automatic transport or physical recording/deadline claim.

Source: crates/ravet-audio-file/src/buffered.rs, crates/ravet-audio-file/src/ring.rs, crates/ravet-audio-file/src/wave.rs.

Tests: crates/ravet-audio-file/tests/buffered.rs, crates/ravet-device/tests/input.rs.

Documentation: docs/audio-files.md, docs/decisions/0033-buffered-wave-workers.md.

Compressed prepared-ring read-ahead

Explicit worker pump streams compressed decoded frames into the prepared SPSC ring, retaining backpressure suffixes and clearing old generations only after successful stopped seeks.

Limits: Matching channels, 1..65536 scratch frames; rate/clock/thread/device scheduling explicit. Decoder faults poison; earlier queued/consumed audio cannot roll back. Decode/replay/destruction outside callbacks; consumer pop alone is prepared.

Source: crates/ravet-audio-file/src/compressed_buffered.rs, crates/ravet-audio-file/src/compressed_stream.rs, crates/ravet-audio-file/src/ring.rs.

Tests: crates/ravet-audio-file/tests/compressed_buffered.rs.

Documentation: docs/audio-files.md, docs/decisions/0069-compressed-read-ahead.md.

Automatic recorder worker ownership and explicit finish

A control-owned automatic worker drives existing WAV/AIFF/FLAC bounded capture-ring recorders, retaining original errors/source ownership and validating reclaimed matching producer identity before bounded final drain/file finalization, including permanent hidden-producer retirement; callback capture remains prepared accepted-prefix push.

Limits: Explicit start/stop and source format/scratch/output/count budgets; 2 ms empty-ring polling timeout, worker-specific allocations/I/O and cooperative control-only join/drop without cancellation/deadline guarantee. Producer must be stopped/reclaimed or permanently retired before finish; live/leaked producer retirement checks reject before stopping; concurrent late publication can reject or lose audio. Pump faults retain poisoned recorder/original error; consuming finalization errors and worker panic lose their sink/source and cannot claim a complete file. No physical capture/device/path/clock/drift/resampling or callback blocking/automatic drop-policy claim.

Source: crates/ravet-audio-file/src/recording.rs, crates/ravet-audio-file/src/background.rs, crates/ravet-audio-file/src/ring.rs, crates/ravet-audio-file/src/buffered.rs, crates/ravet-audio-file/src/aiff_buffered.rs, crates/ravet-audio-file/src/flac_recorder.rs.

Tests: crates/ravet-audio-file/tests/recording.rs, crates/ravet-device/tests/recording_worker.rs, crates/ravet-audio-file/tests/automatic.rs, crates/ravet-audio-file/tests/buffered.rs, crates/ravet-audio-file/tests/aiff_buffered.rs, crates/ravet-audio-file/tests/flac_recorder.rs.

Documentation: docs/audio-files.md, docs/decisions/0177-automatic-recording-workers.md.

Automatic read-ahead ownership and buffered playback

A control-owned automatic worker drives WAV/AIFF/compressed read-ahead with retained backpressure; its prepared callback endpoint provides pause/play, consumed-source position, underrun silence and drained EOF. Matching stopped seek/stop joins, positions and restarts the source; shutdown reclaims source and original error.

Limits: Explicit start and source-rate/channel playback; 1..65,536 render frames and existing ring/scratch/source bounds. Worker uses a 2 ms polling park timeout, source-specific allocations/I/O and cooperative join without cancellation/deadline guarantees. Control-only seek/stop/drop/join; no callback mailbox/live seek/streamed loop/crossfade/resampling or physical device/clock/recording guarantee. Pump/thread failures are distinct from EOF; restart failure cannot roll back completed seek generations; worker panic loses its unwound source. Custom ReadAheadPump implementations own bounded pumping, matching ownership and failed-seek contracts.

Source: crates/ravet-audio-file/src/automatic.rs, crates/ravet-audio-file/src/background.rs, crates/ravet-audio-file/src/buffered.rs, crates/ravet-audio-file/src/compressed_buffered.rs, crates/ravet-audio-file/src/aiff_buffered.rs.

Tests: crates/ravet-audio-file/tests/automatic.rs, crates/ravet-audio-file/tests/aiff_buffered.rs.

Documentation: docs/audio-files.md, docs/decisions/0171-automatic-read-ahead-playback.md.

AIFF PCM read-ahead and recording adapters

Concrete AIFF read-ahead and recorder wrappers share prepared PCM handoff mechanics with WAV, retain backpressure suffixes, preserve stopped seek generations and finalize bounded ring drains; automatic worker/playback ownership accepts AIFF sources.

Limits: AIFF uncompressed PCM16/24/32 and existing stream/FORM bounds; matching channels and 1..65,536 scratch frames within reader capacity. Worker/control-only file I/O/seek/finish/drop; stopped producer required before one-ring-capacity final drain. Dequeued recording validation/write failures poison future pump/finish and may leave partial files. No AIFF-C/metadata/markers/new widths/resampling/device/path/physical recording/deadline guarantee.

Source: crates/ravet-audio-file/src/aiff_buffered.rs, crates/ravet-audio-file/src/pcm_buffered.rs, crates/ravet-audio-file/src/buffered.rs.

Tests: crates/ravet-audio-file/tests/aiff_buffered.rs, crates/ravet-audio-file/tests/buffered.rs, crates/ravet-audio-file/tests/automatic.rs, crates/ravet-audio-file/tests/aiff.rs.

Documentation: docs/audio-files.md, docs/decisions/0173-aiff-pcm-worker-adapters.md.

Optional lossless worker FLAC encoding

Validated complete signed PCM16/24 clips encode to owned FLAC with fixed blocks, explicit single-worker policy and compliant short-final-block metadata.

Limits: Default-disabled flacenc 0.5.1 Apache-2.0; 1..8 channels/1..96000 Hz/4,194,304 i32 samples, returned bytes <=64 MiB. Worker allocations, fixed-block prediction fallback; no float quantization/clipping, implicit threads/files/network or other encoder formats. Incremental output is a separate API.

Source: crates/ravet-audio-file/Cargo.toml, crates/ravet-audio-file/src/flac_encode.rs, crates/ravet-audio-file/src/flac_writer.rs, crates/ravet-audio-file/examples/encode-flac.rs.

Tests: crates/ravet-audio-file/tests/flac_encode.rs, crates/ravet-audio-file/examples/encode-flac.rs.

Documentation: docs/audio-files.md, docs/decisions/0070-worker-flac-encoding.md, docs/decisions/0074-incremental-flac-writer.md.

Incremental FLAC worker output

Worker-owned seekable sinks emit retained fixed PCM16/24 blocks with prediction-size fallback, explicit budgets/fault poison and finalized count/MD5/frame metadata.

Limits: Optional flac-encode, empty caller sink, 1..8 channels/1..96000 Hz; 65536 frames/call, total below 2^36 fitting usize, one pending 4096-frame block, 256 KiB serialization cap/frame. Backend memory/time separate. Partial output on failures; drop does not finalize. No float quantization/ring/device/path/thread/clock policy.

Source: crates/ravet-audio-file/src/flac_writer.rs, crates/ravet-audio-file/src/flac_encode.rs.

Tests: crates/ravet-audio-file/tests/flac_writer.rs, crates/ravet-audio-file/examples/encode-flac.rs.

Documentation: docs/audio-files.md, docs/decisions/0074-incremental-flac-writer.md.

Prepared-ring FLAC capture workers

Explicit worker pumps quantize prepared f32 capture with chosen reject/clip overload policy, incremental FLAC output, dequeue-fault poison and stopped tail finalization.

Limits: Optional flac-encode; matching 1..8-channel ring, 1..65536 scratch frames and explicit writer budgets. Nonfinite input rejects, nearest/ties-away PCM16/24 without dither. Dequeued failures cannot roll back. Producer stop/join required before finish; no implicit worker/device/path/clock or physical recording/deadline claim.

Source: crates/ravet-audio-file/src/flac_recorder.rs, crates/ravet-audio-file/src/flac_writer.rs, crates/ravet-audio-file/examples/capture-flac.rs.

Tests: crates/ravet-audio-file/tests/flac_recorder.rs, crates/ravet-audio-file/examples/capture-flac.rs.

Documentation: docs/audio-files.md, docs/decisions/0075-flac-capture-workers.md.

Prepared memory playback transport

Finite interleaved clips provide sample-counted play/pause/stop/seek, exact half-open looping, complete silence at pause/EOF and source/wrap progress.

Limits: f32, 1..64 channels, at most 64 MiB clip and 65536 render frames. Decode/copy/drop outside audio; exclusive commands on owning thread. No resampling, crossfade, streaming seek, command mailbox, GUI or device-clock alignment.

Source: crates/ravet-audio-file/src/playback.rs, crates/ravet-audio-file/examples/transport.rs.

Tests: crates/ravet-audio-file/tests/playback.rs.

Documentation: docs/audio-files.md, docs/decisions/0038-memory-playback-transport.md.

Prepared paragraph source carets, hit tests and selections

Immutable source identity and extended-grapheme boundaries map shaped cluster advances to bidi/wrap-aware affinity carets, finite hit tests and transactional caller-buffer selection pen boxes.

Limits: Optional text feature; UI/worker preparation allocates, prepared lookup/hit/selection do not. 4096 input bytes/8194 affinity positions/4096 cells; Unicode17 graphemes separate from Unicode15 breaks/Unicode16 bidi. Monotone grapheme-aligned backend clusters only; equal-grapheme ligature interpolation, no GDEF or ink measurement. No interactive text editor/IME/clipboard/undo/native caret, screenreader, deadline or complete Unicode support.

Source: crates/ravet-surface/src/caret.rs, crates/ravet-surface/src/paragraph.rs, crates/ravet-surface/Cargo.toml, crates/ravet-surface/examples/paragraph-carets.rs.

Tests: crates/ravet-surface/tests/caret.rs, crates/ravet-surface/tests/paragraph.rs, crates/ravet-surface/tests/fixtures/caret/generate.py.

Documentation: docs/surface-drawing.md, docs/decisions/0175-grapheme-caret-selection.md, crates/ravet-surface/tests/fixtures/caret/README.md, LICENSING.md.

Bounded local-font paragraph wrapping and SVG outlines

Explicit width, baseline spacing and physical alignment compose Unicode line opportunities with retained paragraph bidi context, source byte clusters and transactional TrueType SVG outlines.

Limits: Optional text feature, one explicit local font, UI/worker allocation; 4096 input bytes/256 lines/512 visual runs/16384 glyphs. Unicode15 line opportunities and separate Unicode16 bidi; greedy first-overflow wrapping retains unbreakable overflow and whitespace. No implicit fallback, dictionary breaks/hyphenation/justification, rich text/interactive editor/native/GPU, assistive-technology or deadline claim.

Source: crates/ravet-surface/src/paragraph.rs, crates/ravet-surface/src/drawing.rs, crates/ravet-surface/Cargo.toml, crates/ravet-surface/examples/paragraph-outlines.rs.

Tests: crates/ravet-surface/tests/paragraph.rs, crates/ravet-surface/tests/text.rs, crates/ravet-surface/tests/paths.rs, crates/ravet-surface/tests/bidi.rs.

Documentation: docs/surface-drawing.md, docs/decisions/0172-bounded-paragraph-layout.md, LICENSING.md.

Bounded composite focus and piano keyboard ownership

Explicit local DOM composites supply one roving Tab stop with directional navigation; the shared piano preserves play-key sources and releases notes on focus, visibility, removal and teardown.

Limits: UI-thread local DOM only: 1..256 fixed distinct members, explicit orientation/RTL/wrapping, consumer roles/labels/activation, live owner-window lifetime and stylesheet-change refresh. Expanded Chromium and hidden macOS WebKit contracts passed; no visual focus, screen-reader, other-platform runtime or deadline certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs, crates/ravet-surface/native/CMakeLists.txt.

Tests: crates/ravet-surface/native/tests/focus.html, crates/ravet-surface/native/tests/focus.js, crates/ravet-surface/native/tests/focus.mm.

Documentation: docs/web-controls.md, docs/decisions/0169-bounded-web-focus.md.

Portable layout, themed SVG and scalar animation

Finite geometry and bounded row/column layout connect escaped SVG rectangles, polylines, typed paths and explicit typography/themes with clock-driven scalar tweens.

Limits: 256 layout children, 4096 drawing commands/1 MiB SVG, 4096 text bytes. No wrapping/pixel rounding, GPU/video; default font-family text delegates loading/measurement to SVG, separate optional text adds local shaping/outlines. No native widget interaction/accessibility audit or animation scheduler. UI drawing allocates; layout/tween heap-free fixtures and local browser SVG rendering pass.

Source: crates/ravet-surface/src/layout.rs, crates/ravet-surface/src/drawing.rs, crates/ravet-surface/src/animation.rs, crates/ravet-surface/examples/drawing.rs.

Tests: crates/ravet-surface/tests/visual.rs.

Documentation: docs/surface-drawing.md, docs/decisions/0044-portable-visual-mechanisms.md.

Caller-owned contextual local font fallback

Ordered borrowed local fonts select complete extended graphemes using original shaping context, retain exact source/matched-face ownership and feed atomic SVG/CPU renderers; a normal standalone consumer uses the same Rust model.

Limits: Optional text/raster; 1..16 caller-supplied faces (existing 16 MiB each), 4096 UTF8 bytes, explicit four-ASCII-letter script/horizontal direction, 8192 probes/256 merged runs/16384 glyphs. Unicode 17 graphemes; nearest five context codepoints. Unresolved primary replacement ranges explicit; unexpected final covered glyph zero rejects whole result. Caller-selected-instance TrueType glyf outlines, no implicit system discovery/style/coordinate selection/mixed-bidi/paragraph/color-font fallback or global memory/time bound. Actual macOS owned-window and Chromium evidence; browser CSS NFC policy differs in WebKit. DOM/trusted events are not system AX/screen-reader/physical device/deadline proof.

Source: crates/ravet-surface/src/fallback.rs, crates/ravet-surface/src/text.rs, crates/ravet-surface/src/drawing.rs, crates/ravet-surface/src/raster_text.rs, examples/tutorials/src/bin/font_fallback.rs, examples/tutorials/src/font_fallback/model.rs, examples/tutorials/src/font_fallback/index.html.

Tests: crates/ravet-surface/tests/fallback.rs, crates/ravet-surface/examples/fallback-oracle.rs, crates/ravet-surface/tests/fixtures/fallback/harfbuzz-oracle.c, examples/tutorials/src/font_fallback/oracle.js, scripts/check-font-fallback.py.

Documentation: docs/font-fallback.md, docs/decisions/0241-contextual-local-font-fallback.md.

Exact-face wrapped mixed-direction font-stack paragraphs

Caller-owned immutable faces and grapheme-safe script spans compose original-source bidi, contextual coverage and greedy wrapping; exact-face SVG/CPU consumption and one shared standalone Rust model preserve whole transitions and measured resize.

Limits: Optional text/raster, allocating UI/worker work; 1..16 selected faces (existing 16 MiB each), 4096 UTF8 bytes/128 script spans/256 lines/512 runs/16384 glyphs. Shared 8192 probes/16384 total shapes/1024 candidates include discarded lines; backend memory/time unbounded. Unicode 16 scalar bidi/15 line opportunities/17 graphemes distinct; explicit final-retained-scalar atomic-grapheme L2 refinement, not scalar-exact UAX9; work width-dependent/nonmonotonic; nearest-five contextual backend, explicit base/script/physical alignment. Missing source ranges, covered-final glyph0 whole rejection, oversized unbroken overflow. No automatic script/system fallback, caret/edit/IME integration, vertical/rich text, all-Unicode/presentation/AX/VoiceOver/deadline claim. Actual scoped native 41 + authored Chromium/WK 65 and trusted browser width activation; standalone default settings retained. Revision-independent explicit refresh has separate u32 delivery counter and one terminal MAX acknowledgment after full validation; stale/replayed/unsolicited terminal messages cannot publish, exhaustion refuses model edits, retained prior image/reopen guidance.

Source: crates/ravet-surface/src/fallback_paragraph.rs, crates/ravet-surface/src/fallback.rs, crates/ravet-surface/src/drawing.rs, crates/ravet-surface/src/raster_text.rs, examples/tutorials/src/bin/paragraph_workspace.rs, examples/tutorials/src/paragraph_workspace/model.rs, examples/tutorials/src/paragraph_workspace/index.html.

Tests: crates/ravet-surface/tests/fallback_paragraph.rs, crates/ravet-surface/tests/fallback.rs, crates/ravet-surface/examples/paragraph-fallback-oracle.rs, crates/ravet-surface/tests/fixtures/fallback-paragraph/check-oracle.py, crates/ravet-surface/tests/fixtures/fallback-paragraph/harfbuzz-paragraph.c, examples/tutorials/src/paragraph_workspace/model_tests.rs, examples/tutorials/src/paragraph_workspace/live.rs, scripts/check-fallback-paragraphs.py.

Documentation: docs/fallback-paragraphs.md, docs/decisions/0253-font-stack-paragraphs.md, crates/ravet-surface/tests/fixtures/fallback-paragraph/README.md.

Explicit selected-instance CFF1 and CFF2 text outlines

Default-disabled PostScript outlines reuse the caller-owned text reader and exact normalized variation instance for existing SVG and CPU renderers, with whole metadata/profile admission and output rollback.

Limits: Optional postscript-outlines pins skrifa0.48.0 defaults off/std; read-fonts0.45.0 remains identical, isolated resolution adds exactly one package without existing version/checksum changes. Original present-glyf precedence; otherwise exactly one CFF1/CFF2 scalable table, Type2 monochrome/unhinted only. DICT<=4096bytes, finite decimal<=64ASCII chars with exponent<=1000 and no leading-zero exponent, effective stack<=48, FDArray<=256; every DICT must tokenize identically (operator count, per-operator operand count and integer/real kind) with RAVET's source decoder and read-fonts0.45.0 before use, and RAVET's own admission code refuses malformed bytes with TextError rather than panicking (complete panic freedom also depends on the read-fonts/skrifa backend; fuzzing is panic-only over two first-party seed fonts with no time/memory budget); known role/arity/unique keys, whole FDSelect0/3/4 glyph coverage, private/subroutine bounds and actual CFF2 private blends. Current CFF2 Top/Font profile excludes legacy FD matrices/maxstack; equal positive decimal scales, zero off-diagonal/translation and abs(scale*UPEM-1)<=1e-12; missing matrix only UPEM1000. Signed font-unit flooring precedes normalized fixed-matrix rounded products; tiny degenerate cubics retained, distinct from fractional interpolation and HMTX/variation advances. Existing4096output commands per glyph; complete SVG rollback/CPU preparation on late errors. Backend CharString parsing/temporary memory/time and allocating text work are not globally bounded by output limits; no audio-callback/deadline claim.31 authored assets reproduced exactly,13 renderer groups+5 metadata unit groups, plus W246 R2 untrusted-input groups: crafted review DICT, FDArray variant, exponent/leading-zero/truncation/alignment checks, exhaustive<=5-nibble BCD agreement and a seeded 20000-input-per-font mutation loop over both analytic fonts; CFF2 single-FD FDSelect is a conservative refusal and outline_glyph repeats whole metadata admission per glyph; exact boundary4096/4097 source preflight distinguishes other profile failures. Independent HB14.4.0/FT2.14.3/CoreText10 profiles preserve matrix/fractional/advance differences, FT exact commands/selected coords; at650 native advance855.99609375 versus rounded856.39 feature-on and21 feature-off scoped surface checks include existing regressions, not universal font/platform validation. No Type1/color/bitmap support, font substitution, complete malformed-font validation or mixed-paragraph closure claim. Known limits: per-glyph full metadata re-admission cost and backend CFF2 blend cost at non-default instances are unmeasured; leading-zero exponent refusal may reject some valid fonts.

Source: crates/ravet-surface/Cargo.toml, crates/ravet-surface/src/text.rs, crates/ravet-surface/src/text/postscript.rs, crates/ravet-surface/src/drawing.rs, crates/ravet-surface/src/raster_text.rs.

Tests: crates/ravet-surface/tests/postscript.rs, crates/ravet-surface/tests/postscript_untrusted.rs, crates/ravet-surface/tests/fixtures/postscript/generate.py, crates/ravet-surface/tests/fixtures/postscript/provenance.json, crates/ravet-webview/native/tests/postscript-authored-outlines.c, crates/ravet-webview/native/tests/postscript-authored-coretext.mm, crates/ravet-webview/native/tests/compare-postscript-authored.py, scripts/check-postscript-outlines.py.

Documentation: docs/postscript-outlines.md, docs/decisions/0259-explicit-postscript-outlines.md, crates/ravet-surface/third-party/skrifa.md, crates/ravet-surface/tests/fixtures/postscript/README.md.

Explicit copied system fonts and styled standalone rendering

Opt-in portable copied catalogue tokens and macOS main-thread CoreText discovery/load preserve exact style identity and feed a normal paged standalone Rust text-rendering consumer.

Limits: Cargo feature ravet-webview/system-fonts is default-disabled; native macOS only, main-thread !Send/!Sync. <=4096 entries/1024UTF8 bytes per name/4MiB total names; <=256tables/16MiB checked SFNT/32axes. No global registration/download/window creation by discovery. Invalid native traits remain explicit unavailable metadata; loading rejects unavailable/CFF/bitmap/synthetic/unrepresentable resources. Exact source fvar/tag/default/hidden/current admission; native min/max-only rounding difference<=1e-4 preserved with original/source values, never coordinate/glyph tolerance or clamping. Measured1139entries/308families;16styles/80fixedLatin glyph IDs/advances exact, tightbound difference<=.484375fontunit in scoped receipt. Whole JSON<=65536/commands<=128/sample<=64/preview128x48 orSVG32768; prior selection/image preserved on refusal. Owned native29 and first-partyWK/Chromium39 each +trustedstylebutton proof; no native-selector keyboard-change/systemAX/VoiceOver/allfont/allplatform/deadline certification.

Source: crates/ravet-webview/src/fonts/mod.rs, crates/ravet-webview/src/fonts/macos.rs, crates/ravet-webview/src/fonts/sfnt.rs, crates/ravet-webview/native/SystemFonts.mm, crates/ravet-webview/native/SystemFonts.h, crates/ravet-webview/Cargo.toml, crates/ravet-webview/build.rs, examples/tutorials/src/bin/system_fonts.rs, examples/tutorials/src/system_fonts/model.rs, examples/tutorials/src/system_fonts/live.rs, examples/tutorials/src/system_fonts/index.html.

Tests: crates/ravet-webview/native/tests/system-fonts.mm, crates/ravet-webview/native/tests/system-font-glyphs.mm, crates/ravet-webview/native/tests/compare-system-font-glyphs.py, examples/tutorials/src/system_fonts/model_tests.rs, examples/tutorials/src/system_fonts/glyphs.rs, examples/tutorials/src/system_fonts/first_party.rs, examples/tutorials/src/system_fonts/browser.rs, scripts/check-system-fonts.py.

Documentation: docs/system-fonts.md, docs/decisions/0244-explicit-system-fonts-and-immutable-variations.md, docs/surface-drawing.md, examples/tutorials/README.md, LICENSING.md.

Opt-in native CFF source loading and standalone renderer consumption

Explicit macOS PostScript font loading copies the exact admitted CoreText selected source into checked OTTO and feeds the normal shared standalone selection model, SVG and CPU controls.

Limits: Default-disabled postscript-fonts includes existing system-fonts; exact native OpenType PostScript format1 only, no automatic face matching. Feature-off original glyf behavior unchanged. Whole CFF/CFF2 xor, no glyf/loca, checked OTTO directory/checksum/head rules, exact identity/user axes and existing owner/downloadable/unavailable/PreventAutoActivation policies. Native authored CFF1 format4 is refused honestly, never recast; process-registered authored CFF2 format1 copied at100/400/650/900, resource/owner/sentinel/refusal/cleanup checks. Process-scoped registration exists only in the authored test helper, never public loader or normal reference. Eight installed CFF1 styles/40 glyphs agree on tested advances/tight bounds<=1.14e-13 units; installed bytes memory-only and no proprietary/system assets. Normal23 plus CFF2 16 hidden-window renderer/resize/default-popup/teardown checks;66 actual WK prepared-state/invalid-snapshot groups.60 first-party prepared images+3 invalid groups in Chromium and trusted click/Enter/Space source-equality; final document.hasFocus=false retained, no native visual-focus/AX/screenreader validation. Standard Audio/MIDI popup default retained. Font/render preservation on source/capacity failures, explicit source limits and existing bounded JSON model. Native/system evidence scoped to tested macOS fixtures, no other-platform/all-font/live-device/deadline certification.

Source: crates/ravet-webview/Cargo.toml, crates/ravet-webview/build.rs, crates/ravet-webview/native/SystemFonts.mm, crates/ravet-webview/src/fonts/macos.rs, crates/ravet-webview/src/fonts/sfnt.rs, examples/tutorials/Cargo.toml, examples/tutorials/src/bin/postscript_fonts.rs, examples/tutorials/src/postscript_fonts/model.rs, examples/tutorials/src/postscript_fonts/index.html, examples/tutorials/src/postscript_fonts/live.rs.

Tests: crates/ravet-webview/src/fonts/sfnt.rs, crates/ravet-webview/native/tests/postscript-font-loader.mm, crates/ravet-webview/native/tests/postscript-font-glyphs.mm, crates/ravet-webview/native/tests/compare-postscript-glyphs.py, crates/ravet-webview/native/tests/postscript-fixture-registration.mm, crates/ravet-webview/native/tests/postscript-consumer/src/main.rs, crates/ravet-webview/native/tests/postscript-browser-host.js, examples/tutorials/src/postscript_fonts/model_tests.rs, examples/tutorials/src/postscript_fonts/first_party.rs, scripts/check-postscript-outlines.py.

Documentation: docs/postscript-outlines.md, docs/decisions/0259-explicit-postscript-outlines.md, crates/ravet-webview/native/tests/postscript-consumer/README.md.

Optional local-font horizontal run shaping

Optional HarfRust-backed owned local fonts shape independent directed runs into visual glyph IDs, UTF8 clusters, scaled positions and advance measurement.

Limits: Default-disabled text feature; font <=16 MiB, text <=4096 UTF8 bytes, size (0,1024], <=32 global features, returned glyphs <=16384 after backend work. UI/worker allocations/time not globally bounded; default from_bytes instance; optional checked immutable fvar settings, no fallback/discovery/global registration/network, paragraph bidi/wrapping/context, raster/native/GPU/accessibility or deadline claim. Public Noto Arabic and independent HarfBuzz fixtures only.

Source: crates/ravet-surface/src/text.rs, crates/ravet-surface/src/lib.rs, crates/ravet-surface/Cargo.toml, crates/ravet/Cargo.toml.

Tests: crates/ravet-surface/tests/text.rs, crates/ravet-surface/tests/fixtures/text/README.md, scripts/check-text-shaping.py, crates/ravet-surface/examples/shape-text.rs.

Documentation: docs/surface-drawing.md, docs/decisions/0092-local-font-shaping.md, LICENSING.md.

Checked immutable font variation instances

Explicit source fvar axes and user coordinates create immutable local font instances consumed by the existing shaping, glyph outlines, SVG, CPU drawing and caller-owned fallback APIs.

Limits: Existing optional text/raster dependencies; exact fvar1.0/reserved2/20-byte axis records; <=32 unique valid axis tags, finite in-range f32 user settings; omitted axes reset to defaults. Source bounds/default/hidden remain exact, actual normalized2.14 backend coordinates explicit. Existing font16MiB/run4096bytes/glyph16384/outline4096-command bounds; backend transient memory/time not globally bounded. TrueType glyf rendering; no color/CFF/hinting/implicit system fallback or all-native pixel-equivalence claim. First-party analytic6 +independent HarfBuzz6/fontTools6 profiles; actual CoreText80glyph agreement separately qualified.

Source: crates/ravet-surface/src/text.rs, crates/ravet-surface/src/drawing.rs.

Tests: crates/ravet-surface/tests/variation.rs, crates/ravet-surface/tests/fixtures/variation/README.md, crates/ravet-surface/tests/fixtures/variation/generate.py, crates/ravet-surface/tests/fixtures/variation/harfbuzz-variation.c, scripts/check-font-variations.py.

Documentation: docs/system-fonts.md, docs/surface-drawing.md, docs/font-fallback.md, docs/decisions/0244-explicit-system-fonts-and-immutable-variations.md, LICENSING.md.

Typed bounded filled SVG paths

Finite typed move/line/quadratic/cubic/close paths validate subpath topology and append atomically within existing SVG document bounds.

Limits: 1..4096 path commands, 4096 drawing commands/1 MiB document; filled paths/implicit SVG fill closure only. No arbitrary markup/URLs/transforms, hit testing, text semantics, native/GPU/raster or accessibility claim.

Source: crates/ravet-surface/src/drawing.rs.

Tests: crates/ravet-surface/tests/paths.rs, crates/ravet-surface/tests/visual.rs.

Documentation: docs/surface-drawing.md, docs/decisions/0093-svg-local-glyph-outlines.md.

Owned bounded SVG image import

Optional resource-free static SVG import owns normalized shapes/paths/transforms/styles/gradients/clipping and prepares independent sRGB-encoded premultiplied RGBA8 with explicit viewport fitting; a complete Rust image consumer retains the standard standalone settings popup.

Limits: Default-disabled svg-image; UTF8 XML1..1MiB,8192XML nodes/4096elements/32levels,64attributes/namespaces,1024ASCII IDs,65536attribute bytes/path segments,4096segments per path/points per shape,256expanded transform tokens/stops per gradient,4096stops total and8192normalized visits including clips. Output1..4096/64MiB, finite source/composed/device geometry<=65536; checked private shape/PMA and whole output publication. Typed local paint/clip references only; no DTD/SVGZ/text/fonts/images/use/href/stylesheets/filters/masks/patterns/animation/external resources. Backend working memory/flattening/time/process/allocator failure unbounded; UI/worker only. Resvg/usvg0.48.1, roxmltree0.21.1, svgtypes0.16.1/simplecss0.2.2, transitive tiny-skia0.12.0 std/SIMD/PNG and roxmltree positions/std explicit. No ICC/display/screenreader/general SVG fidelity/platform/DAW/deadline claim. Independent small Chromium/WK pixel-oracle fixture tolerances and synthetic native transport remain separate from trusted browser control evidence.

Source: crates/ravet-surface/src/svg.rs, crates/ravet-surface/Cargo.toml, crates/ravet/Cargo.toml, examples/tutorials/Cargo.toml, examples/tutorials/src/bin/svg_workspace.rs, examples/tutorials/src/svg_workspace/model.rs, examples/tutorials/src/svg_workspace/index.html.

Tests: crates/ravet-surface/tests/svg_image.rs, crates/ravet-surface/tests/fixtures/svg/scene.svg, crates/ravet-surface/tests/fixtures/svg/integer.svg, examples/tutorials/src/svg_workspace/model.rs, examples/tutorials/src/bin/svg_workspace.rs, examples/tutorials/src/svg_workspace/index.html.

Documentation: docs/svg-images.md, docs/decisions/0232-owned-svg-image-import.md.

Optional local TrueType glyph SVG outlines

Local default-instance glyf extraction feeds shaped SVG filled paths at caller baselines without text/font URLs, with whole-run rollback on failure.

Limits: Optional text; <=4096 finite commands per glyph after backend allocation, existing text/SVG bounds. Default TrueType glyf only, no CFF/Type1/color/bitmap/variable-instance/hinting/native/GPU/raster/accessibility/text-selection claim. Empty outlines skipped, missing glyph zero retained. Noto fixture/browser geometry/librsvg artifact evidence; backend transient memory/time not globally bounded.

Source: crates/ravet-surface/src/text.rs, crates/ravet-surface/src/drawing.rs, crates/ravet-surface/Cargo.toml.

Tests: crates/ravet-surface/tests/paths.rs, crates/ravet-surface/examples/font-outlines.rs, crates/ravet-surface/tests/fixtures/text/README.md.

Documentation: docs/surface-drawing.md, docs/decisions/0093-svg-local-glyph-outlines.md.

Optional single-line Unicode bidirectional ordering

Pinned Unicode 16.0 data resolves explicit/first-strong base, line-adjusted UTF8 byte levels and logical directional ranges in visual order before shaping.

Limits: Optional text, <=4096 UTF8 bytes/<=512 runs after backend work; controls/line/paragraph separators/noncharacters reject, format/isolate characters retained. No wrapping/multiline paragraphs, script/font fallback/selection, glyph mirroring/mark ordering, caret/input/native/GPU/accessibility or global memory/time/deadline guarantee. Thirty-two normative vectors and controlled mixed-text fixture only.

Source: crates/ravet-surface/src/bidi.rs, crates/ravet-surface/src/text.rs, crates/ravet-surface/src/lib.rs, crates/ravet-surface/Cargo.toml.

Tests: crates/ravet-surface/tests/bidi.rs, crates/ravet-surface/tests/fixtures/bidi/README.md, crates/ravet-surface/examples/bidi-outlines.rs.

Documentation: docs/surface-drawing.md, docs/decisions/0094-single-line-bidi.md, LICENSING.md.

Rust control-thread runtime services

Bounded binary files/atomic replacement, explicit HTTPS POST, owned bounded serial workers, worker timers, wall-clock conversion and environment-derived user locations are reusable Rust APIs outside portable processing.

Limits: Allocating/blocking control or worker services only. HTTP uses normal platform TLS verification, 0..=16 MiB responses, 16 MiB requests and 1..=300-second deadlines; redirects/cookies/implicit credentials/proxy discovery disabled. Atomic replacement does not sync parent directories. Accepted work drains; blocked callbacks cannot be cancelled. macOS arm64 and Omarchy x64 tests with synthetic localhost TLS; no Windows or DAW support claim. No product authorization policy or automatic network activity.

Source: crates/ravet-runtime/Cargo.toml, crates/ravet-runtime/src/lib.rs, crates/ravet-runtime/src/files.rs, crates/ravet-runtime/src/http.rs, crates/ravet-runtime/src/tasks.rs, crates/ravet-runtime/src/paths.rs, crates/ravet-runtime/src/clock.rs.

Tests: crates/ravet-runtime/tests/runtime.rs, crates/ravet-runtime/src/http/tests.rs, crates/ravet-runtime/src/clock.rs.

Documentation: docs/runtime-services.md, docs/decisions/0020-rust-runtime-services.md.

Control-thread XML and cryptographic compatibility

Bounded attribute XML, SHA-256, and existing little-endian unpadded RSA integer verification are available through an explicit data crate.

Limits: Allocating control/worker-thread services only. XML permits 65,536 bytes, 16 levels, 1,024 elements, ASCII names, and Unicode values; no text content or external entities. Integer keys are bounded to 4,096 bits; no PKCS#1/PSS or product licensing policy.

Source: crates/ravet-data/src/lib.rs, crates/ravet-data/src/xml.rs, crates/ravet-data/src/crypto.rs.

Tests: crates/ravet-data/tests/data.rs.

Documentation: docs/control-data.md, docs/decisions/0007-control-data-services.md.

Explicit local signed-entitlement verification

Canonical bounded consumer claims and a domain-separated Ed25519 envelope verify against explicit trusted public keys, product IDs and half-open validity, with time-rechecked cached feature grants.

Limits: 8192-byte tokens, 32 trusted keys, 256 subject bytes/64 features; strict verification via pinned ed25519-dalek. No private-key signing API, endpoint, clock/hardware access, stored grant, product gating, trial/account policy, remote revocation or anti-tamper guarantee. Worker/control threads only; synthetic records tested.

Source: crates/ravet-data/src/entitlement.rs, crates/ravet-data/Cargo.toml.

Tests: crates/ravet-data/tests/entitlement.rs.

Documentation: docs/entitlements.md, docs/decisions/0042-local-signed-entitlements.md.

Explicit opt-in worker analytics

A default-disabled numeric-event queue provides bounded JSON batches, immediate revoke/discard, explicit sender invocation and retained whole batches on delivery errors.

Limits: 1024 events/1 MiB batch, 4096 bytes/64 unique metrics per event. No endpoint, identifiers, consent UI, background scheduling, storage or automatic network activity. Consumer owns consent/data policy/acceptance; lost responses can duplicate delivery. Control/worker threads only.

Source: crates/ravet-runtime/src/analytics.rs.

Tests: crates/ravet-runtime/tests/analytics.rs.

Documentation: docs/runtime-services.md, docs/decisions/0041-opt-in-analytics.md.

Mono and stereo gain reference

Separate native f32/f64 gain references share GAIN_ID amplitude 0..4, unity/default 1 and 5 ms f32 control smoothing across channels.

Limits: Finite out-of-range parameter values clamp; nonfinite values reject the block. Audio samples are not sanitized. CLAP exposes bypass; meter transport remains a product Rust API with a prototype macOS UI.

Source: examples/gain/src/lib.rs, examples/gain/src/main.rs, examples/gain/src/precision64.rs.

Tests: examples/gain/tests/processing.rs, examples/gain/tests/precision64.rs.

Documentation: docs/getting-started.md, docs/parameters.md, docs/decisions/0001-portable-processing.md, docs/decisions/0065-native-f64-gain.md.

Native-precision identified performance sine reference

An independent f32/f64 mono/stereo instrument applies exact native voice values with timed ADSR, volume/expression, balance, tuning and vibrato, committing private candidate rendering and original-target completions only after whole success.

Limits: 1..128 slots,65536 frames/1024 input/output events, no auxiliary buses. Positive output capacity enables bounded NoteEnd; zero suppresses notifications. Pressure/brightness are exact readable state without timbre shaping. Other parameters/MIDI/UMP/incoming completion and transport are ignored after validation. Level/schema only; no pedals, MIDI conversion, programs/codec/editor/native facade/format export or deadline/platform claim. Preparation allocates; candidate state and process/reset avoid heap actions.

Source: crates/ravet-instrument/src/performance_sine.rs, crates/ravet-instrument/src/lib.rs, crates/ravet-instrument/src/synthesis.rs.

Tests: crates/ravet-instrument/tests/performance_sine.rs.

Documentation: docs/midi.md, docs/decisions/0164-transactional-performance-sine.md.

Portable sine instrument reference

A no-input mono/stereo processor connects sample-timed notes, voice stealing/sustain, optional RPN negotiation, phase-continuous bend and linear ADSR release completion.

Limits: f32, 1..128 voices, positive finite rates with ADSR counts fitting u32, 65536 frames/1024 events. Fixed ADSR, level/N mix, normalized-note velocity quantization, pressure/timbre not mapped to sound. No f64, state codec, editor, plug-in instrument export, device validation or click-free stealing; held notes have infinite tail.

Source: crates/ravet-instrument/src/synthesis.rs, crates/ravet-instrument/examples/synthesis.rs.

Tests: crates/ravet-instrument/tests/synthesis.rs.

Documentation: docs/midi.md, docs/decisions/0039-portable-sine-instrument.md.

Bypass and metering

Portable gain has sample-timed dry bypass, continuing gain smoothing, block input/output sample peak and RMS, and a separate bounded coherent meter mailbox.

Limits: Bypass has no crossfade, latency compensation or tail policy. CLAP exposes bypass and coalesced product meter APIs, with a prototype macOS meter UI. Meter blocks coalesce without peak retention; mailbox requires 64-bit atomics. No native allocation or deadline evidence.

Source: examples/gain/src/lib.rs, examples/gain/src/meter_transfer.rs, crates/ravet-signal/src/meter.rs.

Tests: examples/gain/tests/parameters.rs, crates/ravet-signal/src/meter.rs.

Documentation: docs/parameters.md, docs/decisions/0010-parameter-state-and-meters.md.

Complete gain reference program catalogue

Unity/Silence/Bypass are complete schema-bound physical states with permanent IDs/MIDI addresses, restored and persisted through existing f32/f64 controls.

Limits: Three immutable proposals, no current identity/raw MIDI handling/host menu or automatic switching policy. States [1,0]/[0,0]/[1,1], stable IDs 1..3, bank 0/numbers 0..2; control persistence stays unchanged.

Source: examples/gain/src/programs.rs, examples/gain/src/lib.rs.

Tests: examples/gain/tests/programs.rs.

Documentation: docs/parameters.md, docs/decisions/0083-native-gain-programs.md.

Serialized native reference gain meter snapshots

Fixed-layout C records copy complete f32/f64 input/output block peak/RMS/count/diagnostics while preserving native f64 levels.

Limits: Public gain reference only; exclusive serialized DSP handle access, 128-byte caller record with 32-byte readings. No concurrent UI reads/format-editor delivery/deadline or other-platform runtime claim. Nonfinite audio remains unsanitized; empty/rejected blocks retain readings.

Source: examples/gain-native/src/lib.rs, examples/gain-native/include/RavetGainMeters.h.

Tests: tools/native-validation/meters.cpp, tools/native-validation/CMakeLists.txt.

Documentation: docs/vst3.md, docs/decisions/0098-native-gain-meter-snapshots.md.

Optional native VST3 host-mediated gain meters

Audio-owned meter copies travel through twelve hidden read-only host output parameters into Rust snapshots and four native WebKit meter controls.

Limits: Native editor option/macOS reference only; IDs 10..21, UI levels saturate at four. Missing/rejecting queues drop telemetry; empty/fault/stop retain prior values. Host parameters deliver independently, no complete-block UI atomicity or framework control reads of live DSP. REAPER 7.82/macOS arm64 twelve normalized parameters/window handle pass; no visual/assistive-tech/other-format/platform/deadline claim.

Source: examples/gain-vst3/src/gain.cpp, examples/gain-vst3/editor/index.html, examples/gain-native/src/editor.rs, examples/gain-native/include/RavetGainEditor.h.

Tests: tools/vst3-validation/contracts.cpp, tools/vst3-validation/editor.cpp, tools/vst3-validation/programs.cpp, tools/reaper-validation/native-meters.lua, tools/reaper-validation/test_checks.py.

Documentation: docs/vst3.md, docs/native-editor.md, docs/decisions/0099-vst3-host-meter-delivery.md.

Optional AUv2 native reference meter transfer

The external SDK output transfer/timer updates twelve readable AU meter values and shared Rust/native editor peak/RMS/diagnostic controls.

Limits: Optional macOS native editor, f32 reference rendering; timer/run loop and live AudioUnit required. UI levels saturate at four, individual updates lack complete-block atomicity, host bypass/stopped/empty/fault renders retain prior meters. AU hidden metadata is not assumed. No DAW/auval/assistive-tech/other-architecture/platform/deadline claim.

Source: examples/gain-vst3/src/gain.cpp, examples/gain-vst3/editor/index.html, examples/gain-native/src/editor.rs, examples/gain-vst3/CMakeLists.txt.

Tests: tools/au-validation/editor.mm, tools/au-validation/contracts.mm, tools/au-validation/programs.mm.

Documentation: docs/audio-unit.md, docs/decisions/0100-auv2-meter-transfer.md.

Small synth, effect and expressive MIDI examples

Four entry points provide live macOS subtractive synth/stereo delay/MPE UIs and a MIDI 2.0 packet inspector; explicit flags retain portable WAV and expression fixtures.

Limits: Native UI/device path is a macOS prototype; offline fixtures are stereo PCM16 at 48 kHz, 256-frame blocks and up to 32 scheduled events, refusing overwrite. Existing Gain/Sine plug-in exports remain distinct. No new subtractive plug-in, MIDI 2.0 synthesis/export, physical controller conformance or deadline claim.

Source: examples/tutorials/Cargo.toml, examples/tutorials/src/lib.rs, examples/tutorials/src/support/mod.rs, examples/tutorials/src/bin/midi-synth.rs, examples/tutorials/src/bin/effect.rs, examples/tutorials/src/bin/mpe.rs, examples/tutorials/src/bin/midi2.rs.

Tests: examples/tutorials/tests/walkthroughs.rs, examples/tutorials/src/ui/mod.rs.

Documentation: docs/examples.md, docs/getting-started.md, docs/midi.md.

Portable subtractive teaching synth

Eight voices combine selectable sine/saw/square/triangle oscillators, resonant low-pass VCF and VCA, with one shared ADSR per voice and audible MPE pressure/timbre mapping.

Limits: Mono/stereo f32 output, 8..192 kHz, up to 1024 frames and 128 input events. Control-thread prepared 256-step filter table; ADSR edits latch at note-on. Immediate phase-preserving wave changes, no crossfade/limiter; triangle may alias. MIDI 1.0/note input only, no subtractive plug-in export or MIDI 2.0 synthesis.

Source: examples/tutorials/src/synth.rs.

Tests: examples/tutorials/tests/subtractive.rs.

Documentation: docs/examples.md, docs/decisions/0132-standalone-settings-and-knobs.md.

Native fixed-delay processing reference

Delay8/16 native f32/f64 exports provide bounded mono/stereo processing, complete Level/Bypass state and exact latency/tail metadata for reusable adapter validation.

Limits: Main mono/stereo only; transient FIFO is excluded from complete persistent state. Bypass preserves fixed delay; Samples(Delay) tail is diagnostic. Existing native schema/audio/cache provenance obligations apply. Local independent impulse/state/event-order/fault/heap and initialized AAX consumer evidence only. No public production Delay AAX factory, inferred host compensation, history migration or device/DAW/deadline support.

Source: examples/bus-routing-native/src/delay.rs, examples/bus-routing-native/include/RavetDelayRouting.h.

Tests: examples/bus-routing-native/src/delay.rs, tools/aax-validation/timing-model.cpp.

Documentation: docs/aax-timing.md, docs/decisions/0230-aax-prepared-timing.md.

Portable stereo teaching delay

A prepared stereo delay replaces gain in the live effect example, with time/feedback/mix knobs, stereo or ping-pong cross-feedback, dry bypass that retains the tail, and rhythmic demo input.

Limits: Mono/stereo f32, 8..192 kHz, up to 1024 frames/128 events and 2 seconds per channel. Time 1..2000 ms glides over 20 ms; feedback 0..0.95, wet mix and ping-pong routing ramp over 5 ms. Immediate bypass, nonfinite input becomes zero, conservative infinite tail. No limiter, tempo sync, preset persistence or delay plug-in export; live device/UI integration remains a macOS prototype.

Source: examples/tutorials/src/delay.rs, examples/tutorials/src/bin/effect.rs, examples/tutorials/src/ui/audio.rs, examples/tutorials/src/ui/mod.rs, examples/tutorials/editor/index.html.

Tests: examples/tutorials/tests/delay.rs, examples/tutorials/tests/walkthroughs.rs, examples/tutorials/src/ui/audio.rs, examples/tutorials/src/ui/mod.rs.

Documentation: docs/examples.md, docs/decisions/0133-stereo-delay-example.md.

Independent offline project starter

An explicit generator creates a publish-disabled independent consumer workspace outside RAVET with local framework/reference dependencies, borrowed stereo DSP lifecycle and a timed-event fixture.

Limits: Offline gain starter only; explicit new destination/name/licence, absolute local dependency paths and separately generated lockfile. macOS offline build/run evidence; no format/device/UI/installer or production/platform support claim.

Source: scripts/new-project.py, templates/offline-gain/main.rs.

Tests: scripts/tests/test_projects.py, templates/offline-gain/main.rs.

Documentation: docs/project-starters.md, docs/decisions/0036-independent-project-starters.md.

Independent embedded and Pi Linux starters

Explicit embedded-rust, arduino and pi-linux generator kinds create separate consumer projects with no_std libraries, a local C++ sketch/library or headless Linux fixture.

Limits: Existing offline default and repository/existing-destination protections retained. Local paths/copied headers require deliberate updates. No startup/HAL/linker/codec/DMA/device/UI integration or toolchain installation. Pi target follows OS bitness; Arduino sketch compile/link checked in the recorded environment; board runtime/flashing and workload suitability unvalidated.

Source: scripts/new-project.py, templates/embedded/lib.rs, embedded/arduino/library.properties.

Tests: scripts/tests/test_projects.py, templates/embedded/lib.rs.

Documentation: docs/project-starters.md, docs/embedded-projects.md.

Processing heap instrumentation

Processing-thread allocation and deallocation probes exercise gain, the CLAP bridge, and host ABI callbacks, including resets and malformed inputs.

Limits: Rust allocator evidence only; no native allocation accounting, callback deadline measurement, device latency, or DAW support claim.

Source: examples/gain/src/lib.rs, crates/ravet-clap/src/lib.rs, examples/gain-clap/src/lib.rs.

Tests: examples/gain/tests/realtime.rs, examples/gain-clap/tests/bridge.rs, examples/gain-clap/tests/host.rs.

Documentation: docs/WORK_STATUS.md, docs/architecture.md.

Live searchable documentation portal

Canonical guides, generated capabilities and decision records build into a searchable responsive static portal with live rebuilding and linked workspace Rustdoc.

Limits: Requires isolated pinned Python tooling; API generation retains Rust/native prerequisites. Guide and Rustdoc searches are separate. Strict builds reject stale canonical metadata; previews cannot infer omitted features or certify support. Public deployment is not configured.

Source: mkdocs.yml, scripts/docs.py, scripts/docs/site.py, scripts/docs/requirements.txt, .github/workflows/documentation.yml.

Tests: scripts/tests/test_docs_site.py.

Documentation: docs/documentation-site.md, docs/decisions/0124-live-documentation.md.

Bounded source text editing, undo and layout identity

Owned grapheme-safe source replacement/deletion and directional selection provide exact bounded undo/redo and atomic errors, while distinct owner/revision tokens invalidate stale or foreign edits and prepared paragraph caches.

Limits: Optional text feature; UI/control-thread allocation/deallocation. 4096 source/replacement bytes;64 snapshots total across undo/redo. Process-local nonserialized identity; selection changes conservatively invalidate caches. Unicode17 graphemes; paragraph control policy rejects Tab/other controls. Net content no-ops preserve selection/redo; no implicit typing coalescing or grouped transaction. No native/browser input, IME/clipboard/rich text/accessibility, backend work bound or deadline claim.

Source: crates/ravet-surface/src/editing.rs, crates/ravet-surface/src/text.rs, crates/ravet-surface/src/paragraph.rs, crates/ravet-surface/src/lib.rs.

Tests: crates/ravet-surface/tests/editing.rs, crates/ravet-surface/src/editing.rs, crates/ravet-surface/tests/paragraph.rs, crates/ravet-surface/tests/caret.rs.

Documentation: docs/text-editing.md, docs/surface-drawing.md, docs/decisions/0180-bounded-source-text-editing.md.

Optional bounded Ogg Vorbis worker encoding

Explicit mono/stereo lossy Ogg Vorbis complete-clip and incremental worker encoding uses caller rate/quality/stream serial with bounded prepared batches and cumulative input/output budgets, original sink errors, explicit EOS/flush and gated Drop output.

Limits: Default-disabled vorbis-encode pins BSD vorbis_rs0.5.6 and vendored cc-built codecs, defaults/RNG/bindgen disabled; C compiler required. Mono8000..96000Hz/stereo16000..96000Hz, finite quality-0.2..1, finite[-1,1] input rejected on overload, complete input<=4194304samples, calls<=65536frames,4096frame scratch plus one65307byte Ogg page, completed distinct headers and single-page priming packet (continued/mixed headers or spanning priming reject),totalframes<=16777216,bytes<=64MiB. Backend working allocations remain external; !Send/Sync writer constructed/used/destroyed on one worker. Preflight preserves state; later codec/I/O/output-budget errors poison irreversible prefixes; consuming finish errors lose sink. Framework Drop never writes/flushes caller sink; user sink destructor separate. Stereo<16k rejected before output after measured sustained backend second-channel loss; no hidden rate/quality/coupling changes. Automatic capture uses a separate worker-created controller; this writer is not a movable RecordingPump. No bitexact PCM/perceptual/deadline/MP3/chained-stream/resampling/multichannel speaker-map/physical/platform claim.

Source: crates/ravet-audio-file/src/vorbis.rs, crates/ravet-audio-file/src/lib.rs, crates/ravet-audio-file/Cargo.toml, crates/ravet-audio-file/third-party/vorbis.md.

Tests: crates/ravet-audio-file/tests/vorbis.rs, crates/ravet-audio-file/src/vorbis.rs.

Documentation: docs/audio-files.md, docs/decisions/0181-bounded-vorbis-worker-encoding.md, LICENSING.md.

Bounded browser text editor

Consumer-labelled textarea ownership with bounded committed UTF-8 source, local identity revisions, grapheme-safe selections, shared undo/redo history, native-input reconciliation and composition guards.

Limits: One connected live-document textarea; configured maximum 1..4096 UTF-8 bytes, source 0..maximum, LF source and 0..64 combined history snapshots. Browser Intl.Segmenter Unicode data is unpinned and independent of Rust Unicode 17/EditRevision. Rejects lone UTF-16 surrogates, control/noncharacter source, stale tokens and revision exhaustion; native ranges snap/expand to complete graphemes. One pending composition finalization/history transaction; programmatic composition writes reject Busy. Native preedit, browser history/layout and OS work remain opaque. Consumer transport/Rust request-ack protocol, actual IME/screenreader/mobile keyboard and backend certification are not supplied; automated Chromium document.hasFocus=false establishes DOM keyboard evidence only.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/text-editor.js, crates/ravet-surface/native/tests/text-editor.html, crates/ravet-surface/native/tests/text-editor.mm.

Documentation: docs/browser-text-editing.md, docs/web-controls.md, docs/decisions/0184-bounded-textarea-frontend.md.

Worker-created automatic MP3 capture ownership

A prepared-ring controller constructs and retains the MP3 encoder on one worker, acknowledges pause/resume, validates stopped or permanently retired producers, and returns explicit finalized/aborted/original-failure evidence with recovered seekable destination, consumer and distinct accepted/dequeued/file/write counts.

Limits: Default-disabled mp3-encode and device mp3-recording forwarding; Send preparation/results only, codec sessions have no Send bound. Source scratch 1..4096 frames and fixed ring; existing bounded MP3 profiles, normalized PCM, gain policy, physical-write limits, gapless file semantics and independent LGPL obligations apply. Preparation performs no codec/thread/destination operations; start acknowledges spawn rather than codec success, failed spawn retains preparation. Pause/resume waits for worker acknowledgement; all control waits and sink I/O may block indefinitely without cancellation/deadline. Matching stopped or permanently retired producer proves bounded final tail; foreign/live/leaked proof preserves state. Outer Ok proves recovered ownership only; inspect private-constructed Finalized/Aborted/Failed(original error) completion. Fault stops later dequeue and retains original operational error, exact partial destination and consumer suffix; accepted/dequeued and file/physical write counts may differ. Startup seek errors trigger no restoration retry. Abort/Drop never drain, finalize, seek, rewrite or flush; sink destructor separate. Panic loses unwound local owners and reports Failed/Poisoned. Shared local-codec controller preserves existing public Vorbis APIs and genuinely non-Send codec ownership. Synthetic actual PreparedCapture retirement/overload/heap and independent exact-file decoder evidence do not validate physical CPAL shutdown/capture timing, deadlines, resampling, clock drift, backend memory ceiling or other targets.

Source: crates/ravet-audio-file/src/mp3_recording.rs, crates/ravet-audio-file/src/codec_recording.rs, crates/ravet-audio-file/src/mp3_factory.rs, crates/ravet-audio-file/src/vorbis_factory.rs, crates/ravet-audio-file/src/vorbis_recording.rs, crates/ravet-audio-file/src/mp3.rs, crates/ravet-audio-file/src/lib.rs, crates/ravet-device/Cargo.toml.

Tests: crates/ravet-audio-file/tests/mp3_recording.rs, crates/ravet-audio-file/src/mp3_recording.rs, crates/ravet-audio-file/tests/vorbis_recording.rs, crates/ravet-audio-file/src/vorbis_recording.rs, crates/ravet-audio-file/tests/mp3_faults.rs, crates/ravet-device/tests/mp3_recording.rs, crates/ravet-device/tests/vorbis_recording.rs.

Documentation: docs/audio-files.md, docs/decisions/0198-worker-created-mp3-recording.md.

Worker-created automatic Vorbis capture ownership

A dedicated prepared-ring recording controller creates and retains the genuinely non-Send Vorbis codec on one worker, acknowledges pause/resume, validates stopped or permanently retired producers, and returns explicit finalized/aborted/original-failure evidence with recovered sink, consumer and counts.

Limits: Default-disabled vorbis-encode and ravet-device vorbis-recording forwarding; transferable Send sink/preparation/result only, codec stays local. Existing mono8..96k/stereo16..96k quality/input/frame/output/page limits apply; source scratch1..4096frames and prepared fixed ring. Start acknowledges OS spawn, not header completion; spawn failure retains preparation. Successful pause acknowledges no future dequeue until resume/finalize; control waits can block indefinitely on selected sink I/O. Foreign/live/leaked producer preflight preserves worker; stopped final tail drains at most fixed capacity. Ok controller result proves recovery only; private-constructed Finalized/Aborted/Failed(original error) completion enum must be inspected. Failed dequeue stops further pumping; accepted/dequeued/actual-byte counts distinct and irreversible prefix retained. Startup/pump/EOS/flush faults recover sink/consumer/error; abort/Drop never drain/EOS/flush; sink destructor separate. Panic loses unwound local owners and returns Failed/Poisoned. W170 public writer consuming new/finish signatures unchanged. Synthetic PreparedCapture hidden-producer/heap/timing evidence does not validate physical CPAL shutdown timing, recording deadlines, clock drift, resampling, backend memory ceiling or other targets.

Source: crates/ravet-audio-file/src/vorbis_recording.rs, crates/ravet-audio-file/src/codec_recording.rs, crates/ravet-audio-file/src/vorbis_factory.rs, crates/ravet-audio-file/src/vorbis.rs, crates/ravet-audio-file/src/lib.rs, crates/ravet-device/Cargo.toml.

Tests: crates/ravet-audio-file/tests/vorbis_recording.rs, crates/ravet-audio-file/src/vorbis_recording.rs, crates/ravet-audio-file/tests/vorbis.rs, crates/ravet-device/tests/vorbis_recording.rs.

Documentation: docs/audio-files.md, docs/decisions/0186-worker-created-vorbis-recording.md.

Local control document ownership

Connected slider/knob/numeric/toggle/choice/action controls share gesture ownership by their original document, with child-window lifecycle routing and child-focus refresh protection.

Limits: UI-thread local DOM only; one active gesture per owner document, WeakMap ownership, connected elements and same-document paired inputs preflight before mutation. Rejected end/disposal retains ownership and listeners for accepted retry. Same-origin iframe Chromium/hidden WebKit contracts only; consumers finish/dispose before hiding/removing their owner frame. No cross-origin access, automatic frame/stylesheet retirement, shadow-root focus engine, native-window/screenreader/backend/deadline certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/owner-documents.js, crates/ravet-surface/native/tests/owner-documents.html, crates/ravet-surface/native/tests/owner-documents.mm.

Documentation: docs/web-controls.md, docs/decisions/0189-control-owner-document.md.

Local one-level popup menu

Explicit consumer-created native action buttons compose bounded one-level menu semantics, one roving Tab stop, exact-once activation, focus/dismissal and attribute restoration.

Limits: 1..256 fixed distinct nonnested type=button entries in one live owner document; unique nonblank action strings1..128 code units and menu label1..256. Consumer labels/placement/CSS/transport policy; no submenus/typeahead/radio/check items/modal trap/OS menu integration. One pointer identity and one next-task intent reset; activation guard covers focus restoration and callbacks, focus-time disposal cancels action. Same-origin Chromium/hidden WebKit DOM evidence; trusted key cases explicitly reopen because hidden automation blurs after each key, document.hasFocus=false. No native-window focus/screenreader/other-backend/deadline certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/popup-menu.js, crates/ravet-surface/native/tests/popup-menu.html, crates/ravet-surface/native/tests/popup-menu.mm.

Documentation: docs/popup-menus.md, docs/web-controls.md, docs/decisions/0190-local-popup-menu.md.

Optional bounded CPU path and local-font rasterization

Owned premultiplied RGBA8 canvases render prepared typed affine paths, explicit fill rules, antialiased device strokes and optional prepared local TrueType glyph outlines, with independent readback and explicit Metal bitmap composition.

Limits: Default-disabled raster pins tiny-skia/path0.12.0, std only; no PNG/SIMD/native Skia. UI/worker allocation; dimensions1..4096/64MiB, raw draws0..4096, cumulative commands65536, clear/covered work67108864. Paths1..4096 commands, finite transformed control coordinates magnitude<=65536 before f32; empty/degenerate paths consume budgets. Device stroke width(0,256],miter[1,16],caps/joins; positive thin AA coverage follows backend. Numeric source-over without gamma conversion. text integration uses matching caller font/run/size(0,1024],<=16384glyphs/run,TrueType outlines only, one operation/run. Backend flattening, working allocations and time remain external. No font discovery/fallback/PNG/dashes/zero-width hairline/window/GPU-path/native-editor/deadline or platform runtime support claim from compiler checks.

Source: crates/ravet-surface/src/raster.rs, crates/ravet-surface/src/raster_text.rs, crates/ravet-surface/src/lib.rs, crates/ravet-surface/Cargo.toml, crates/ravet/Cargo.toml, crates/ravet-surface/third-party/raster.md.

Tests: crates/ravet-surface/tests/raster.rs, crates/ravet-surface/src/raster.rs, crates/ravet-surface/examples/raster-preview.rs, crates/ravet-metal/tests/raster.rs.

Documentation: docs/cpu-raster.md, docs/surface-drawing.md, docs/metal-drawing.md, docs/decisions/0187-optional-cpu-raster.md, LICENSING.md.

Local labelled tabbed panels

Fixed consumer-created tabs and panel containers compose labelled ARIA associations, independent manual focus/selection or automatic activation, native Tab navigation and exact attribute restoration.

Limits: 1..256 fixed distinct nonnested native type=button tabs/panels in one live owner document; stable consumer-supplied IDs1..128 code units without whitespace and list label1..256. Manual default; disabled/hidden/inert/ARIA/CSS eligibility, first/null lifecycle fallback, owned retiring-panel focus transfer and guarded focus/callback/disposal. Quiet focus:false consumer updates own retiring-panel focus; selection commits before optional focus, failed focus/eligibility cancels notification or rejects stale success with next observer/refresh reconciliation. Invalid associations retire immediately. ID ownership checks do not audit arbitrary duplicate consumer markup; no dynamic membership/loading, native OS tabs/modal trap/layout/assistive-tech/backend/deadline certification. Chromium and hidden WebKit DOM contracts plus trusted arrows/Enter/Space/Tab; hidden document.hasFocus=false and explicit focus-event fixture wrappers.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/tabbed-panels.js, crates/ravet-surface/native/tests/tabbed-panels.html, crates/ravet-surface/native/tests/tabbed-panels.mm.

Documentation: docs/tabbed-panels.md, docs/web-controls.md, docs/decisions/0192-local-tabbed-panels.md.

Optional owned PNG/JPEG worker assets

Explicit static PNG/selected JPEG byte decoding and bounded private-sink PNG encoding own immutable straight RGBA8 with deliberate consuming PMA conversion for consumer presentation.

Limits: Default-disabled image forwards exact png0.18.1 and zune-jpeg0.5.15 std-only defaults disabled, safe strict JPEG paths; locked core0.5.3, selected pure-Rust miniz compression, optional zlib-rs unselected. Source1..16MiB, dimensions1..4096/output64MiB,8192 structural chunks/markers and32 JPEG scans; exact IEND/EOI/no trailing bytes. Static PNG palette/sub8/gray/alpha/tRNS/Adam7,16-bit high byte only, explicit CRC/Adler checks; no text/ICC decompression. Selected8-bit mono/RGB/YCbCr baseline/progressive JPEG opaque; CMYK/YCCK/arithmetic/hierarchical reject. Numeric components no ICC/gamma/EXIF transform; JPEG codec conversion applies. PNG output budget1..16MiB private gated sink/no partial output, backend Drop may attempt private completion only. Allocator/backend working memory/time unbounded, no RT/globalRSS claim. First-party independent PNG/Pillow fixture evidence; actual local macOS Metal adoption and compiler-only Linux/iOS evidence recorded separately. JPEG encoding and explicit static GIF decoding have separate optional features; this PNG/JPEG API claims no WebP/SVG/animation/resample/window/platform support.

Source: crates/ravet-surface/src/image.rs, crates/ravet-surface/Cargo.toml, crates/ravet/Cargo.toml, crates/ravet-surface/third-party/image.md.

Tests: crates/ravet-surface/tests/image.rs, crates/ravet-surface/tests/fixtures/image/generate.py, crates/ravet-surface/tests/fixtures/image/provenance.json, crates/ravet-metal/tests/image.rs.

Documentation: docs/image-assets.md, docs/decisions/0195-owned-worker-image-codecs.md, LICENSING.md.

Explicit sRGB and linear-light color preparation

Dependency-free checked linear scalar colors and bounded borrowed RGBA views with caller-buffer standard transfer, encoded-space alpha reassociation and linear-light source-over, consumed by a resizable standalone image workspace.

Limits: Default dependency-free std UI/worker API; scalar finite normalized [0,1], standard sRGB primaries/transfer only. Immutable packed RGBA8 dimensions1..4096/<=64MiB/exact bytes, premultiplied RGB<=alpha checked fully; alpha association occurs in declared encoded space. Full destination/shape preflight before writes, identical profile exact copy, same-encoding association exact integer half-up, changed transfer f64/byte quantization with lossy RGBA8 linear storage. Straight hidden RGB retained; transparent composite canonical zero. 8192 prepared operations zero allocations, independent Decimal256 scalar/4096 conversion/2048 composite agreement, scoped owned WK11groups/Chromium trusted Rust-data/resize evidence. Consumer32x8 images/<16KiB snapshots/messages<=64bytes/two palettes/checked u32 revision, native macOS only/default popup. No ICC/DisplayP3/HDR/profile inference/embedding/display calibration, implicit renderer change, SVG parsing/font discovery, library/native working-time/allocator/deadline or other-platform runtime/AX/screenreader/device/DAW certification.

Source: crates/ravet-surface/src/color.rs, crates/ravet-surface/src/lib.rs, examples/tutorials/src/bin/color_workspace.rs, examples/tutorials/src/color_workspace/model.rs, examples/tutorials/src/color_workspace/index.html.

Tests: crates/ravet-surface/tests/color.rs, examples/tutorials/src/color_workspace/model.rs, examples/tutorials/src/bin/color_workspace.rs, crates/ravet-surface/tests/fixtures/color/reference.rs, crates/ravet-surface/tests/fixtures/color/README.md, scripts/check-color-preparation.py.

Documentation: docs/color-preparation.md, docs/image-assets.md, docs/examples.md, docs/decisions/0229-explicit-color-preparation.md.

Optional bounded opaque baseline JPEG encoding

Explicit quality and chroma sampling encode validated opaque image assets into a private bounded owned JPEG sink, with whole alpha preflight and no partial output or external I/O.

Limits: Default-disabled jpeg-encode includes image and exact jpeg-encoder0.7.1 std-only/defaultsfalse, no runtime dependencies/native C/SIMD; non-SIMD backend forbids unsafe. Quality1..100 validated without clamping,444/422/420 explicit average chroma filter, baseline8-bit/standard Huffman only. All alpha255 required before codec/sink, consumers composite explicitly; numeric RGB to codec YCbCr, no ICC/EXIF/metadata/hidden quality sampling. Image dimensions1..4096/RGBA64MiB inherited, output1..16MiB gated private Vec; failure exposes no partial bytes/caller I/O. Backend allocations/time/RSS/quality unbounded worker obligations.36 first-party profiles cross-checked independent Pillow and strict Zune, measured max2 components/4byte fixture tolerance; no general fidelity/production/platform/deadline claim. Linux/iOS compile only. Upstream(MIT OR Apache2) AND IJG notices/attribution/required executable acknowledgement independent of RAVET commercial terms.

Source: crates/ravet-surface/src/image/jpeg.rs, crates/ravet-surface/src/image.rs, crates/ravet-surface/Cargo.toml, crates/ravet/Cargo.toml, crates/ravet-surface/third-party/jpeg.md.

Tests: crates/ravet-surface/tests/jpeg.rs.

Documentation: docs/image-assets.md, docs/decisions/0201-bounded-opaque-jpeg-encoding.md, LICENSING.md.

Optional bounded local MP3 worker encoding

Complete and incremental worker-only MPEG1 Layer III encoding uses explicit mono/stereo rate/192–320kbps choices, full source preflight, prepared bounded batches, physical-write budgets including finalized Info-frame replacement, parsed gapless metadata/CRC and recovered original sink errors.

Limits: Default-disabled mp3-encode pins mp3lame-encoder0.2.5 and mp3lame-sys0.1.11 with defaults disabled, bundled LAME3.100 static C build; Unix configure/make/C toolchain required, only local macOS arm64/offline evidence. Independent LGPL3 binding, LibraryGPL2-or-later core and LGPL2.1-or-later ReplayGain obligations remain; RAVET commercial agreements do not relicense or certify combined/static distribution. Explicit CBR192/256/320kbps highest quality, mono/stereo and32000/44100/48000Hz only;192 backend preset scales input0.97,256/320 use1.0, no hidden compensation/resample/remap. Finite normalized[-1,1] source; complete<=4194304samples,call<=65536frames,batch4096frames/12320output bytes,tag4KiB,total<=16777216frames,actual writes<=64MiB including first metadata-frame rewrite. Codec working allocations external, no RSS/deadline guarantee. Write+Seek sink must start at EOF; caller owns prefix/truncation/concurrent access. Original seek errors return recovered sink without restoration retry; failed seeks may already move cursor. Preflight rejects are retryable; backend/I/O/capacity faults poison and preserve original error plus partial sink/source/file/write counts at consuming finish. Abort deliberately discards diagnostics; Drop/abort never encode/finalize/write/seek/flush, sink destructor separate. Exact source-frame metadata applies to finalized files and gapless-aware decoders, stream players may retain padding; no arbitrary PCM trim. No other bitrate/rate/VBR/ID3/general perceptual/physical capture/platform claim.

Source: crates/ravet-audio-file/src/mp3.rs, crates/ravet-audio-file/src/lib.rs, crates/ravet-audio-file/Cargo.toml, crates/ravet-audio-file/third-party/mp3.md.

Tests: crates/ravet-audio-file/src/mp3.rs, crates/ravet-audio-file/tests/mp3.rs, crates/ravet-audio-file/tests/mp3_faults.rs.

Documentation: docs/audio-files.md, docs/decisions/0193-bounded-mp3-worker-encoding.md, LICENSING.md.

Local native modal dialog

Consumer-created native dialogs compose labelled opening, browser-owned modality/focus, bounded close/form/cancel completion, guarded document/node ownership and exact disposal restoration.

Limits: One connected initially closed native dialog with one fixed same-document focus descendant; required native showModal/close/:modal runtime APIs, label1..256 code units and scalar completion values0..128. One live modal per original document; normal queued completion retains owner through notification. Disposal cancels callbacks, releases document admission after synchronous native closure/focus and callback unwinding, retains one per-node tombstone until trusted native close; synthetic close never drains. Different nodes remain usable if retired-node delivery is abandoned; same-node reuse requires actual drain, with no timeout/deadline. Direct native close and method=dialog supported with bounded final returnValue; external reopening/open mutation unsupported with guarded native recovery and no previous-focus guarantee. Chromium/hidden WebKit DOM plus trusted Tab/ShiftTab/Escape evidence only, inactive document.hasFocus=false and browser focus-boundary limits. No custom trap/native OS dialog/nested application stack/action discovery/backend/screenreader/native-window/deadline/global-memory certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/modal-dialog.js, crates/ravet-surface/native/tests/modal-dialog.html, crates/ravet-surface/native/tests/modal-dialog.mm.

Documentation: docs/modal-dialogs.md, docs/web-controls.md, docs/decisions/0196-bounded-native-modal-dialog.md.

Explicit native semantic companion for custom editor content

Copied checked flat button/slider/static-text snapshots, native AppKit protocol getters/frames/actions and original-editor revision/callback retirement; complete opt-in content traversal with None/default WebKit restoration.

Limits: macOS native API only; portable allocating model1..64nodes/65536combinedUTF8bytes and bounded finite local rectangles. Consumer supplies complete semantics/geometry/reported focus; no HTML inference, implicit focus, host parameter gestures, editable text or nested roles. Native direct-protocol getter/action and owned injected-key/WebKit consumer evidence does not certify system AX discovery, notification delivery, VoiceOver or other screen readers. Default Audio/MIDI title-bar popup remains independent.

Source: crates/ravet-webview/src/accessibility.rs, crates/ravet-webview/src/macos.rs, crates/ravet-surface/native/RavetAccessibility.inc, examples/tutorials/src/bin/native_semantics.rs.

Tests: crates/ravet-webview/native/tests/native-semantics-protocol.mm, crates/ravet-webview/native/tests/native-semantics-owner.rs, examples/tutorials/src/native_semantics/model.rs, scripts/check-native-semantics.py.

Documentation: docs/native-semantics.md, docs/decisions/0236-explicit-native-semantic-companion.md.

Local control disabled and label ownership

Custom knobs coordinate disabled Tab/input state and retryable parameter ownership; meters preserve explicit label precedence and reject retired formatter writes.

Limits: Knob boolean setEnabled removes sequential focus and disables its optional native number, restores owned prior tabindex/native-number-disabled state on enable and exact original attributes on accepted disposal. All refused/thrown ends retain owner and block new edits/re-enable until accepted recovery; healthy disabled host refresh retains existing focused/active suppression. Live original pair checked before admission, after own/competing end callbacks and after accepted host sends before paint. Accepted host messages cannot be rolled back; retired accepted begin attempts end and retains pending recovery if rejected. Original-document observer and explicit refresh handle eligibility; foreign retirement writes no new presentation. Meter live connected same-document pair, explicit label1..256 code units removes competing aria-labelledby and restores exact name attributes on disposal, formatter1..4096 nonblank code units cannot recursively update or write after retirement/disposal.25 Chromium/hidden WebKit DOM/native-property groups plus trusted enabled/disabled keyboard traversal; preview hasFocus=false. Consumer meaningful labels/presentation/focus relocation/host acknowledgement remain explicit. No full accessible-name engine/native AX tree/screenreader/other-platform/deadline/global-memory certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/control-semantics.js, crates/ravet-surface/native/tests/control-semantics.html, crates/ravet-surface/native/tests/control-semantics.mm.

Documentation: docs/control-semantics.md, docs/web-controls.md, docs/decisions/0200-local-control-semantics.md.

Local resizable split-pane layout

Bounded two-pane CSS grid layout with a labelled separator, measured pixel minima, axis/RTL keyboard and pointer ownership, and exact local cleanup.

Limits: Root direct child nodes<=64, only CSS-collapsible ASCII text/comments between members; noncollapsible direct text retires and in-flow root pseudo-content rejects/suspends, none/normal/display:none/out-of-flow decorators allowed. Non-native non-editable separator with no element children; text-only separator allowed. Exactly three direct live same-document HTML members with fixed distinct pane IDs; explicit label1..256 UTF16 units, fraction0..1, pixel minima0..4096 each, thickness1..64 and positive step<=1. Own physical horizontal writing mode/root grid templates and placement plus member static position/spacing/size/alignment and separator semantics; original per-node style text<=16384, owned original values<=4096. Actual root rect minus borders/padding measures subpixel constraints. TooSmall fits clipped fraction tracks, suspends Tab/input and cannot honor requested minima; feasible refresh silently clamps/re-enables without global focus move. One original-window pointer owner; exact release/cancel/blur/hidden/extent-change ends delta anchor. Programmatic setValue rejects during held pointer; accepted keyboard cancels pointer. Reject all member/root ancestor CSS transforms/individual transforms/nondefault zoom with ancestor bound64; no coordinate guessing. Callback/focus reentry guarded, fixed association mutation retires immediately; accepted notified state cannot roll back after callback failure. Dispose restores owned styles/priorities/attributes, preserves unrelated edits, queued observers cannot mutate disposed state.37 Chromium/hidden WK DOM/actual-grid groups and trusted Chromium Tab/arrow/Home/End, preview hasFocus=false; pointer/focus reentry fixtures synthetic. No native pointer/focus/AX/screenreader/window-minimum/shadow/cross-origin/deadline/global-memory certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/split-pane.js, crates/ravet-surface/native/tests/split-pane.html, crates/ravet-surface/native/tests/split-pane.mm.

Documentation: docs/split-pane.md, docs/web-controls.md, docs/decisions/0204-local-split-pane-layout.md.

Bounded explicit row/column grid geometry

Independent constrained row and column tracks resolve explicit checked area spans into atomic caller-owned rectangle output.

Limits: 1..32 tracks per axis,0..256 areas,exact output length; finite nonnegative gaps and min/preferred/max/grow constraints. Reuses axis proportional shrink/normalized weighted capped growth and trailing unused space. Nonzero checked spans include internal gaps; explicit overlap and output order retained. Fixed stack scratch/no heap/I/O/native access; complete destination preservation on every error. No automatic placement,intrinsic measurement,wrapping,CSS conformance,pixel scaling/rounding/clipping or deadline certification. Five focused numerical/capacity/atomic groups and10,000resize transitions with measured0heap allocations pass.

Source: crates/ravet-surface/src/layout.rs.

Tests: crates/ravet-surface/tests/grid.rs, crates/ravet-surface/tests/visual.rs.

Documentation: docs/grid-layout.md, docs/surface-drawing.md, docs/decisions/0220-explicit-grid-measured-window.md.

Explicit standalone content constraints

Portable bounded min/max content value and allocation-free free/aspect resolver, with opt-in owned macOS policy installation, immediate fitting, exact original-native-bound restoration and synchronous resize/policy reentry rejection.

Limits: Finite widths 320..4096/heights 240..4096 logical points; portable value/resolver, native installation macOS 12+ main-thread only. No policy by default; original aspect/popup/owner retained. None restores original content min/max without size request. Invalid/incompatible proposals preflight before writes; foreign admitted Cocoa observer effects cannot roll back. Actual Cocoa bounds/aspect projection may round by <=1 logical point per dimension. Native property/programmatic and synchronous callback evidence, no human drag, devices, DAW, AX/screenreader or deadline certification.

Source: crates/ravet-webview/src/content_constraints.rs, crates/ravet-webview/src/standalone.rs, crates/ravet-webview/native/StandaloneWindow.mm, examples/tutorials/src/bin/layout_workspace.rs.

Tests: crates/ravet-webview/src/content_constraints.rs, examples/tutorials/tests/content_constraints.rs, crates/ravet-webview/native/tests/content-constraints.rs, crates/ravet-webview/native/tests/content-constraints-observer.mm, scripts/check-window-constraints.py.

Documentation: docs/window-constraints.md, docs/decisions/0223-standalone-content-constraints.md.

Owned standalone window state and closure

Copied exact-window native status distinguishes hidden/live from monotonic close admission; veto-aware close requests share operation guards, retire future window effects, and retain borrowed editors for explicit child-before-parent cleanup.

Limits: macOS 12+ exact main-thread standalone owner; four copied native flags with closed-admitted-before-notification semantics, other flags still native observations. request_close invokes performClose/veto; synchronous close/resize/policy reentry refuses, already-closed true only outside busy operations. Closed effects reject; last copied policy stays readable. Existing borrowed editor remains until Drop, already-admitted JavaScript/application/foreign effects not cancelled or rolled back. Native snapshot completion retains only native window object and checks closure before output. Five own hidden-window fixtures/15 lifecycle groups plus existing constraint consumer regression; synthetic native action, no human titlebar/foreground/minimization/global focus, arbitrary public notification/delegate, AX/screen-reader, device/DAW/deadline or other-platform claim. Default Audio/MIDI popup preserved.

Source: crates/ravet-webview/src/standalone.rs, crates/ravet-webview/src/lib.rs, crates/ravet-webview/native/StandaloneWindow.mm.

Tests: crates/ravet-webview/native/tests/window-lifecycle.rs, crates/ravet-webview/native/tests/window-lifecycle-owner.mm, scripts/check-window-lifecycle.py.

Documentation: docs/window-lifecycle.md, docs/native-editor.md, docs/window-constraints.md, docs/decisions/0225-owned-standalone-window-lifecycle.md.

Local fixed-model virtual text list

Bounded copied text model with reusable viewport rows, exact active/pressed identity pins, virtual root focus and separate single/multiple selection.

Limits: One original live document/window/frame and connected noninteractive noneditable empty root; copied fixed model1..65536 with unique IDs1..128 and explicit nonblank labels1..256 UTF16 units. Finite fixed row height12..256,overscan0..32,extent<=1000000px and positive viewport height<=4096. Mounted plus detached free rows<=512 including active/pressed pins; dense selected arrays<=256,single<=1,complete Capacity failure. Generated owner namespace monotonically safe-integer with bounded original-document preflight lookup/collision rejection. Root profile owns important inline layout and exact bounded attributes/styles; direct nodes<=64 before construction/65 generated,ASCII whitespace/comments only. Unsupported transform/individual translate/rotate/scale/perspective/zoom on root/ancestors<=64/generated members,root in-flow pseudo content and any generated visible pseudo content suspend coordinate admission; measured extent/row geometry within2px. Copied disabled selection retained,range baseline separate,refresh/scroll quiet; all-disabled model remains removable. Root-only Tab/virtual active reference,UpDownHomeEnd/Space/ranges; accepted navigation boundary cancels abandoned pointer without model/anchor/callback changes. Original-document capture retires old press before any fresh admission,exact trusted PointerEvent row/index/modelID/pointerID/owner remains pinned through matching up/click. Capacity native click consumes pointer phase while preserving exact pin/model/active/anchor,no duplicate retry; keyboard/programmatic Capacity rejection retains complete token. Explicit bounded cancellation,no timer. Free-node adoption/reparenting,ID/profile/member/document replacement retires; cleanup restores old root locally and skips replaced/inaccessible WindowProxy. Every owned write guards synchronous disposal; callbacks/focus reentry rejected with accepted-model boundary explicit.60 Chromium/hidden WK groups plus separate trusted browser input and own-window AppKit/WK native pointer proof,native Option-release and Command Capacity phases; Chromium modifier getter injection is separate from native modifier proof. Hidden/inactive document.hasFocus=false and explicit focus-method hooks are DOM evidence; no AX/screenreader/OS focus/other-platform/DAW/deadline/globalmemory certification. Browser layout/global lookup/consumer allocation unbounded. Variable heights,dynamic model/customrenderers/sorting/editing/virtualtreegrid remain separate.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/virtual-list.js, crates/ravet-surface/native/tests/virtual-list.html, crates/ravet-surface/native/tests/virtual-list.mm, crates/ravet-surface/native/tests/virtual-list-pointer.mm, crates/ravet-surface/native/tests/listbox-navigation.html.

Documentation: docs/virtual-list.md, docs/web-controls.md, docs/decisions/0217-fixed-virtual-text-list.md.

Local fixed flat-list selection

Bounded labelled listbox with separate virtual active focus and single/multiple selection, retained unavailable model state, keyboard ranges and exact attribute ownership.

Limits: Dense indexed selected-ID arrays reject holes before model mutation; Original document/window identity is required for admission; disposal removes accessible original-window listeners even after frame detachment, skips replaced/inaccessible/closed WindowProxy and restores original nodes without touching replacement documents. One live original-document root,1..256 fixed distinct direct HTML options/IDs1..128, nonblank explicit label1..256 and owned original attributes<=4096 UTF16 units. Reject native interactive/editable members/descendants and nested tabindex; no shadow/cross-origin support. Initial bounded selected model may include unavailable options; later admission can carry/remove already-selected unavailable IDs but cannot newly add them. Eligibility refresh never prunes selection; quiet active fallback and root-only Tab lifecycle separate. Explicit single/multiple user/programmatic replacements may remove unavailable IDs. Up/down/Home/End, single Ctrl/Meta active-only arrows, multiple Space/click/toggle and additive Shift baseline/range shrinking; unavailable additions excluded and eligibility/failure/Space/Shift lifecycle clears anchor. Only actual selected changes notify bounded frozen indices/IDs/unavailable IDs/active/source. Original-document observation/refresh reasserts owned roles/tabindex/name precedence/vertical orientation and retires member/order/ID/profile mutation; exact originals restored on disposal, queued disposed work inert. Callback/focus reentry guarded and late native-focus failure cannot roll back notified model state; actual callback exceptions classified separately from focus/lifecycle exceptions.35 Chromium/hidden WK DOM groups plus trusted Tab/ArrowDown/Space, preview hasFocus=false; pointer/focus reentry synthetic. No native AX/screenreader/native pointer/focus/tree/table/virtualization/typeahead/global shortcut/deadline/global-memory certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/listbox.js, crates/ravet-surface/native/tests/listbox.html, crates/ravet-surface/native/tests/listbox.mm, crates/ravet-surface/native/tests/listbox-navigation.html.

Documentation: docs/listbox.md, docs/web-controls.md, docs/decisions/0208-fixed-list-selection.md.

Local fixed hierarchical tree expansion and selection

Bounded labelled TreeView with separate virtual active focus, branch expansion and single/multiple selection, retained collapsed descendants, native toggle focus admission and exact ownership cleanup.

Limits: Dense indexed selected-ID arrays reject holes before model mutation; Tree expansion arrays are equally dense. Original document/window identity is required for admission; disposal removes accessible original-window listeners even after frame detachment, skips replaced/inaccessible/closed WindowProxy and restores original nodes without touching replacement documents. One original live document/window,1..256 fixed depth-first preorder HTML entries,depth<=32,exact direct group/member/native explicit type=button toggle profile,distinct item/group IDs1..128,explicit nonblank labels1..256 and descendant scan<=8192 elements. Original owned attributes/display<=4096 and group raw style<=16384 UTF16 units; browser layout/global document/ancestor cost remains unbounded. Root-only sequential Tab/virtual active reference; visible eligible Up/Down/Home/End, branch Left/Right without implicit expansion selection, single changed-destination selection/modifier active-only movement,multiple Space/click toggles/additive Shift baseline ranges. Initial unavailable/collapsed selected model allowed; later carry/remove already-selected unavailable IDs allowed,new unavailable additions rejected; refresh/collapse never prunes selection and quiet active fallback/recovery stays separate. Native toggle default focus remains intact,then guarded root-focus and current row/toggle eligibility before any user expansion; failed/redirected/focus-time hide/disable/disposal/profile change leaks no model/callback. Separate changed-only frozen selection/expansion snapshots<=256 IDs/indices; reentry rejected,disposal allowed,committed notifications cannot roll back after later callback retirement/failure. Original-document refresh/observation reasserts owned roles/names/Tab/profile; member/order/ID/type/nested interactive/editable/focusable changes and removed original frame retire. Synchronous custom-element disposal after owned writes stops later presentation changes; exact attributes/display/priority restored,unrelated style edits survive.49 Chromium/hidden WK groups with no-movement Shift boundary/anchor regression, plus trusted browser Tab/Right/Down/Space and native button nested-span pointer default-focus/exact-once collapse; ordinary preview hasFocus=false, trusted pointer true. No native OS focus/AX/screenreader/other-platform,dynamic membership,virtualization,typeahead,sorting,table/grid,drag/reorder,global shortcut,deadline/global-memory certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/tree-view.js, crates/ravet-surface/native/tests/tree-view.html, crates/ravet-surface/native/tests/tree-view.mm.

Documentation: docs/tree-view.md, docs/web-controls.md, docs/decisions/0211-fixed-tree-expansion-selection.md.

Prepared file playback at an explicit output rate

Bounded off-audio WAV/AIFF and optional FLAC/MP3/Vorbis preparation converts complete validated source frames into the existing memory transport at a selected output rate, retaining explicit fractional causal delay and finite tail; an output-only processor integrates with actual PreparedOutput/open_output and rejects configuration mismatches before rendering.

Limits: Default-disabled audio-file/device resampled-playback; own-crate optional ravet-signal only. Explicit equal-rate bit-exact Copy or fixed 1025-phase Blackman Sinc, even16..256 taps, ratio1/16..16; no hidden gain/bypass/delay compensation/decoder trimming. Frame-zero source, channels1..64/rates1..768000, source/output<=16,777,216 interleaved samples, output<=64MiB, converter/scratch<=32MiB, sourcebatch1..4096/render1..65536; reader/codec own allocations separate. Known durations/output budgets preflight before new reads; unknown duration reserves conservatively from caller maximum. Integer nominal ceil(Nout/in) and retained floor((N+T-2)out/in)+1 lengths distinct, fractional (T-1)/2 source delay and <=T actual zero padding reported. Failure owns original reader/error/committed read-submission-padding-output counts/incomplete prefix; source logical/byte cursor may advance, no automatic seek rollback/retry/complete-prefix claim. Callback renders/copies preallocated memory only; exclusive transport controls before output ownership, no new cross-thread mailbox. Reset stops at zero/configured loop start; failed prepare/deactivate retires processing preserving clip/cursor. No live buffered conversion/drift/clock mapping/physical-device/callback deadline/RSS or other-target support claim.

Source: crates/ravet-audio-file/Cargo.toml, crates/ravet-audio-file/src/file_playback.rs, crates/ravet-audio-file/src/playback.rs, crates/ravet-audio-file/src/lib.rs, crates/ravet-device/Cargo.toml, crates/ravet-device/src/file_output.rs, crates/ravet-device/src/lib.rs.

Tests: crates/ravet-audio-file/tests/file_playback.rs, crates/ravet-audio-file/tests/playback.rs, crates/ravet-device/tests/file_output.rs.

Documentation: docs/audio-files.md, docs/audio-devices.md, docs/decisions/0207-prepared-output-rate-file-playback.md.

Buffered file playback at an explicit output rate

Bounded worker conversion publishes WAV/AIFF and optional compressed readers into an explicit output-rate queue, interoperating with automatic read-ahead ownership and an actual PreparedOutput processor bridge; stopped candidate replay preserves old source/phase/suffix/queue/generation on failure.

Limits: Default-disabled existing resampled-playback; no new dependency. Original source<=16,777,216 frames separately from codec interleaved-sample bounds; channels1..64/rates1..768000, ratio1/16..16, even16..256 Sinc taps, batches1..4096 and explicit source/converter/output arrays<=32MiB. Reader/backend and ring memory separate; old+candidate working states coexist during O(target) replay without cancellation/deadline guarantee. Equal-rate bit-exact Copy or explicit Sinc, including equal-rate filtering; causal(taps-1)/2 source-sample delay and finite floor((N+taps-2)*out/in)+1 output tail retained, no hidden trim/gain/delay compensation. Framezero reader and explicit fresh same-version factory; metadata does not authenticate content and factory side effects cannot roll back. Known/unknown conservative limits preflight before reads/factory when determinable; over-limit or faulty reads can advance original cursor. One read/conversion step/publication per pump; full ring preserves input and output suffix, input-only downsampling qualifies pure bounded worker progress, native hook default remains publication. Typed original input vs converted output coordinates; generic transport/read-ahead cursors/seek/progress use queue-rate frames. Exact EOF needs source integrity/tail/suffix publication plus audible ring drain. First original pump error belongs to caller/worker exit, later pumpPoisoned; reader/factory/producer/count recovery without hidden retry/I/O. Foreign/generation/out-of-range and failed replay candidates preserve queue/generation; previously verified EOF rechecks actual input duration even when output totals coincide. Device bridge owns unique BufferedPlayback, preallocates planar scratch and exposes relaxed wrapping atomic snapshots; reset pauses retaining queue/cursor, mismatches rejectbefore render. Exclusive stopped endpoint reclamation applies only directlyowned processor, not inaccessible native open_output closure. No arbitrary-u64/long-WAV, clock/drift/scheduling, cross-thread mailbox, physical-device/live native seek/recovery or callback deadline claim.

Source: crates/ravet-audio-file/src/converted.rs, crates/ravet-audio-file/src/automatic.rs, crates/ravet-audio-file/src/buffered.rs, crates/ravet-audio-file/src/ring.rs, crates/ravet-audio-file/src/lib.rs, crates/ravet-device/src/buffered_file_output.rs, crates/ravet-device/src/lib.rs.

Tests: crates/ravet-audio-file/tests/converted.rs, crates/ravet-audio-file/tests/converted_phase.rs, crates/ravet-audio-file/tests/automatic.rs, crates/ravet-device/tests/buffered_file_output.rs.

Documentation: docs/audio-files.md, docs/audio-devices.md, docs/decisions/0212-converted-buffered-file-playback.md.

Explicit static GIF worker assets

One complete GIF image becomes owned straight RGBA with explicit transparent/global-palette canvas policy, local palette/transparency/interlace validation and strict bounded structural/LZW preflight.

Limits: Default-disabled gif-image includes image; exact gif0.14.2/weezl0.1.10 defaults disabled/std only/no color_quant/native C, complete independent MIT/Apache notices retained. Source1..16MiB, logical-screen/frame1..4096/output64MiB,8192total block/subblock records; exact one image/trailer/no trailing file data. Explicit Transparent zero fill or LogicalPalette valid opaque global background; local palette overrides and transparent pixels replace numericRGBA with alpha0. Every palette/pixel/transparency index checked; decode through strict LZW end code after required pixels, extra output rejects. Interlaced static GIF87a/89a; GIF87 extensions reject, GIF89 comments/nonloop opaque apps ignored. Second image/looping/plaintext/unknown extensions/user-input/reserved malformed profile reject. No animation/disposal/delay scheduling/color management/metadata/cache/file I/O, allocator/working-memory/time/RSS/deadline or runtime-platform claim. First-party independent Pillow exact pixels and literal-LZW partial canvas/truncation/8192boundary evidence; Linux/iOS checks compiler-only.

Source: crates/ravet-surface/Cargo.toml, crates/ravet-surface/src/image.rs, crates/ravet-surface/src/image/gif.rs, crates/ravet/Cargo.toml.

Tests: crates/ravet-surface/tests/gif.rs, crates/ravet-surface/tests/fixtures/gif/generate.py, crates/ravet-surface/tests/fixtures/gif/provenance.json.

Documentation: docs/image-assets.md, docs/decisions/0206-explicit-static-gif-assets.md, crates/ravet-surface/third-party/gif.md, LICENSING.md.

Local fixed readonly table grid

Bounded readonly native table grid with virtual cell navigation, explicit column-header associations and separate single/multiple row selection, retained unavailable models and exact attribute cleanup.

Limits: Dense indexed selected-ID arrays reject holes before model mutation; Original document/window identity is required for admission; disposal removes accessible original-window listeners even after frame detachment, skips replaced/inaccessible/closed WindowProxy and restores original nodes without touching replacement documents. One original live document/window/frame,exact fixed native table/thead/tr/th(scope=col)/tbody/tr/td profile,1..256 rows,1..32 columns,total body cells<=4096 and descendant scan<=16384. Distinct header/row/cell IDs1..128,nonblank explicit table/header/cell labels1..256 and owned original attributes<=4096 UTF16 units. No caption/extra sections/spans/nested tables/native interactive/editable/other-tabindex content; shadow/cross-origin outside profile. Browser layout/global lookup/ancestor/memory cost remains unbounded. Root-only sequential Tab/virtual active cell,vertical/horizontal/HomeEnd/ControlMetaHomeEnd movement; single changed-row navigation selection,multiple Space/click/toggle/additive vertical Shift ranges. Header eligibility explicitly disables columns; nearest same-row column then nearest row/column fallback is quiet with forward ties. Initial unavailable selected rows allowed, later carry/remove retained unavailable IDs allowed but newly unavailable additions reject; refresh never prunes selection. No-movement boundaries cannot create or expand row ranges; Only genuine ShiftUpDown without ControlMeta retains established boundary anchor,other navigation clears. Changed-only bounded frozen selected row IDs/indices/unavailable IDs plus active cell/source; reentry rejected,disposal permitted,actual callback/focus failures distinct. Original-document focus admission before pointer model mutation and post-callback ownership/focus revalidation; committed notification cannot roll back. Refresh/observation reasserts owned semantics/association/Tab; fixed profile/order/ID/scope/span and nested focusable mutation retire; synchronous DOM setter disposal guards every owned write,exact originals restore,queued disposed work inert.41 Chromium/hidden WK groups plus trusted Tab/ShiftUp boundary/Right/Down/Space/ControlEnd/Tabexit and nested-span pointer root-focus/selection delivery; ordinary hasFocus=false, trusted pointer true, reentrant setter/focus cases synthetic. No sorting/editing/dynamic membership/virtualization/column resize/reorder, native AX/screenreader/OS focus/other-platform,deadline/global-memory certification.

Source: crates/ravet-surface/web/controls.js, crates/ravet-surface/src/web_controls.rs.

Tests: crates/ravet-surface/native/tests/table-view.js, crates/ravet-surface/native/tests/table-view.html, crates/ravet-surface/native/tests/table-view.mm.

Documentation: docs/table-view.md, docs/web-controls.md, docs/decisions/0214-fixed-readonly-table-grid.md.

Prototype capabilities

Embedded gain and native Arduino processing subset

An allocation-free Rust stereo gain and caller-owned C ABI accompany a header-only C++11 stereo adapter/reference for Arduino cores without a Rust archive.

Limits: Immediate gain 0..4/default unity; Rust reference <=64 frames/eight events, C ABI block-start gain and <=128 samples. Native C++ stereo f32 timed parameters only, no arbitrary Rust DSP export. Matching C/Rust float ABI and pointer/exclusive lifetime obligations; explicit standalone panic policy. Arduino compile/link evidence only; no physical MCU/codec validation, audio-workload suitability or desktop gain parity.

Source: examples/embedded-gain/src/lib.rs, examples/embedded-gain/src/ffi.rs, examples/embedded-gain/include/RavetEmbeddedGain.h, embedded/arduino/src/RavetEmbedded.h, embedded/arduino/examples/OfflineGain/OfflineGain.ino.

Tests: examples/embedded-gain/tests/processing.rs, embedded/tests/bridge.c, embedded/tests/arduino.cpp, scripts/check-embedded.py.

Documentation: docs/embedded-projects.md, docs/decisions/0152-embedded-processing.md.

Extended block-start transport metadata

Optional portable details and checked bidirectional CLAP conversion preserve recording, active loop, pre-roll, signature, bar and tempo increment metadata.

Limits: Explicit details availability; CLAP cannot distinguish unknown/false status bits. Positive signature components, finite BPM/sample increment with tempo, bar with beats, active ordered loop bounds per known timeline. Native ingress ignores inactive loop fields; outgoing supplied inactive bounds reject. Sample/fixed-point rounding must preserve order. No extrapolation, DSP reset, mid-block updates or new DAW/device/deadline claim; offline macOS arm64 adapter evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/transport.rs, crates/ravet-host/src/transport.rs.

Tests: crates/ravet-clap/tests/transport.rs, crates/ravet-host/tests/transport.rs, examples/gain-clap/tests/bridge.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/decisions/0127-extended-block-transport.md.

Prepared acyclic processor routing

Owned portable f32/f64 nodes run in compiled topological order with channel mixing, parallel dry/wet routes, prepared latency compensation, bounded scratch and conservative tail declarations.

Limits: 128 nodes, 4096 connections, 65536 frames/path latency, 1024 input/output events per node, 64 MiB graph prepared audio/event storage. Later-node faults can leave preceding state advanced; explicit GraphStatus disables until reset. One selected native precision per graph; no implicit conversion, native discovery, GUI hosting or feedback cycles. Explicit filtered/generated event routes are a separate capability. Prepared whole-graph handoff is a separate capability.

Source: crates/ravet-graph/Cargo.toml, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-graph/tests/routing.rs, crates/ravet-graph/tests/precision.rs.

Documentation: docs/audio-graphs.md, docs/decisions/0029-prepared-audio-graphs.md, docs/decisions/0055-native-graph-precision.md.

Buffered f32 graph-worker device output

A prepared no-input graph retains its audio-owner session on an explicit worker and publishes retained whole-frame queue suffixes; a separate output processor silences/counts underflow with live atomic diagnostics.

Limits: No-input f32 fixed blocks, 0..1024 explicit events per direction and zero aux buses; 1..64 matching channels and 1..65536 frames. Worker scratch<=32MiB and consumer scratch<=16MiB outside graph/native caps, plus queue memory. Explicit thread/wake/priming/rate matching/stream stop/worker join/main retirement. No clock/resampling/automatic recovery/audio input/edit/asynchronous event scheduler or deadline guarantee; reset preserves pending/queued audio. Loaded public silent sine and UMC1820/macOS arm64 20-channel 96kHz 10-second output observation; no long-session/drift/fault/deadline or broader platform/device support.

Source: crates/ravet-device/src/graph_output.rs, crates/ravet-device/src/lib.rs, crates/ravet-audio-file/src/ring.rs, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-device/tests/graph_output.rs, tools/device-probe/src/bin/graph-output.rs.

Documentation: docs/audio-devices.md, docs/audio-graphs.md, docs/architecture.md, docs/plugin-hosting.md, docs/decisions/0117-buffered-graph-worker-output.md.

Queued audio input for native graph workers

Explicit matched input/output rings feed fixed f32 graph worker blocks, zero input shortages and preserve once-only input consumption through retained output publication.

Limits: 1..64 channels per direction, zero aux buses, fixed 1..65536 frames and graph 1024 event limit; combined worker scratch<=32MiB outside graph/native/queue caps. Outer malformed input/storage rejects before dequeue. Graph faults may consume input/advance histories, suppress faulty publication and retain error until reset without more drain; reset preserves queued/pending audio. Explicit rates/priming/wake/capture/stream stop/join/main retirement; no clock conversion/resampling/replay/physical capture/GUI/recovery/deadline claim. Loaded public native gain macOS arm64 offline evidence only.

Source: crates/ravet-device/src/graph_output.rs.

Tests: crates/ravet-device/tests/graph_input.rs, crates/ravet-device/tests/graph_output.rs, tools/device-probe/src/bin/graph-input.rs.

Documentation: docs/audio-devices.md, docs/plugin-hosting.md, docs/decisions/0124-buffered-graph-audio-input.md.

Buffered worker input-clock conversion

An explicit worker reuses prepared sinc/FIFO clock correction to publish graph-rate f32 input, retaining destination suffixes without repeated capture consumption or conversion.

Limits: Matched 1..64 queue channels, nominal integer 8000..192000 rates and existing sinc ratio/correction bounds; raw capacity 2..65536 power-of-two with matching clock capacity/interior target, fixed 1..65536 frames. Output block<=16MiB additional to converter/internal/source/destination queues. Priming/underflow zeros and independent counters retain existing policy. Explicit capture/rates/wake/graph/events/shutdown/join; no reset/resampling-timestamp/physical clock alignment/stability/deadline/hotplug/platform claim. Synthetic 96k-to-48k stereo and loaded native gain offline macOS arm64 evidence only.

Source: crates/ravet-device/src/clocked_input.rs, crates/ravet-device/src/clocked.rs.

Tests: crates/ravet-device/tests/clocked_input.rs, crates/ravet-device/tests/clocked.rs, tools/device-probe/src/bin/graph-input.rs.

Documentation: docs/audio-devices.md, docs/decisions/0125-buffered-clocked-input-worker.md.

Live prepared graph replacement in buffered workers

Already-prepared dynamic f32 graph engines share fixed worker input/output queues and consider live offers only after old audio suffixes publish, retaining main-owned retirement.

Limits: Exact prepared configuration, fixed graph 1024-event/worker32MiB limits; existing 1..4 handoff/retirement slots and separate per-graph/native memory budgets. Fresh renders return swap outcome, pending none; failed start/full retirement preserve old processing. Historical last_swap remains observable after processing faults. Fault latch/reset and once-only input/generated events remain. No reprepare/crossfade/tail drain/state migration/rate-layout-latency changes, GUI/event-generation/recovery scheduler or physical clock/device/deadline claim. Loaded two-instance public gain offline macOS arm64 evidence only.

Source: crates/ravet-device/src/graph_output.rs, crates/ravet-graph/src/dynamic.rs.

Tests: crates/ravet-device/tests/graph_dynamic.rs, crates/ravet-device/tests/graph_input.rs, crates/ravet-device/tests/graph_output.rs, tools/device-probe/src/bin/graph-live.rs.

Documentation: docs/audio-devices.md, docs/audio-graphs.md, docs/decisions/0126-buffered-live-graph-workers.md.

Native-precision CLAP main-bus effects and instruments

Prepared main-bus adapters map 0..64 inputs/1..64 outputs at native f32/f64 precision, global parameters, selected-port short MIDI and validated block-start transport.

Limits: 65536 frames/1024 events, up to 64 MiB f64 scratch; no aux, pointer-based SysEx, CLAP note-ID/wildcards or modulation; UMP packet routing is separate from processor semantic support; generated output is an explicit separate opt-in API. Old gain EffectBridge retains its narrower f32 effect policy. f64/multichannel verified by offline bridge fixtures; sine f32 actual-binary checks pass.

Source: crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/lib.rs.

Tests: crates/ravet-clap/tests/main_bus.rs, examples/sine-clap/tests/host.rs.

Documentation: docs/extended-processing.md, docs/decisions/0040-clap-main-bus-instrument.md.

Native CLAP auxiliary bus bridge

Native f32/f64 main and ordered auxiliary buses use independent compact input/output ports, complete input preflight and prepared sample/event storage.

Limits: Eight auxiliary buses, 64 channels per direction/bus, 65536 frames and 1024 input/output events each; combined samples/events cap 64 MiB. Exporters must advertise matching ports and precision. Existing gain/sine exports unchanged; separate sidechain reference records one REAPER mapping/render. General DAW auxiliary and other-format validation pending.

Source: crates/ravet-clap/src/multi_bus.rs, crates/ravet-clap/src/main_bus.rs.

Tests: crates/ravet-clap/tests/multi_bus.rs.

Documentation: docs/extended-processing.md, docs/decisions/0058-clap-auxiliary-buses.md.

Explicit bounded CLAP generated-event delivery

Native main-bus processing maps bounded physical parameter values/global gesture boundaries/modulation amounts and selected-port MIDI/normalized notes into core host events, with separate DSP/delivery status and explicit prefix rejection.

Limits: 1024 generated events; MIDI7 velocity quantization, reserved parameter ID/missing MIDI port rejects whole delivery. Host refusal discards suffix without audio rollback/retry. UMP packets map to CLAP MIDI2 with zero unused words; no pointer-based SysEx, CLAP note IDs/scoped modulation or other formats. Exporter modulation flags/DSP remain consumer policy. Prepared offline field/order/fault/heap fixtures pass; exported MIDI-output host evidence pending.

Source: crates/ravet-clap/src/output.rs, crates/ravet-clap/src/main_bus.rs.

Tests: crates/ravet-clap/tests/output.rs.

Documentation: docs/extended-processing.md, docs/decisions/0047-clap-output-events.md.

Explicit native CLAP performance ports in exported adapters

Selected native input/output ports preserve optional note IDs, unquantized f32 note velocity and all seven standard f64 expressions independently of raw MIDI/UMP routes.

Limits: Port indices 0..256; opt-in defaults retain MIDI output/native filtering. Exporter-owned CLAP dialect metadata/voice semantics. Concrete On channel/key; scoped Off/choke supported by the explicit native profile, while completion and scoped parameters use independent profiles. Unknown/unselected expression output/input filter; malformed selected input rejects pre-DSP with silence. Selected representable performance rejects at zero-frame process; flush input ignores performance, native performance output rejects whole delivery. Native IDs nonnegative i32; portable wider IDs reject before host prefix. Host refusal discards suffix without replay; rendered audio/DSP remain progressed. Offline adapter f32/f64/auxiliary evidence only, no new instrument/DAW/physical-device/deadline claim.

Source: crates/ravet-clap/src/notes.rs, crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/output.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/multi_bus.rs.

Tests: crates/ravet-clap/tests/notes.rs, crates/ravet-clap/tests/output.rs, crates/ravet-clap/tests/main_bus.rs, crates/ravet-clap/tests/multi_bus.rs.

Documentation: docs/extended-processing.md, docs/midi.md, docs/decisions/0135-exported-native-performance-ports.md.

Endpoint-scoped values and modulation in exported CLAP adapters

Distinct portable f64 scoped parameter events, independent native input/output selectors and explicit per-scope metadata flags preserve voice-target information without editing global state.

Limits: Finite full-f64 physical values/amounts, portable u32 IDs/native nonnegative i32; exact selected note input port 0..256, even all-wildcard targets remain port-scoped. Default input filters; malformed selected input rejects pre-DSP, raw exact all--1 alone is global. Whole generated missing routes/invalid IDs reject before prefix while successful audio/DSP remain progressed. Scoped parameter flush uses zero offsets, independently of performance flush policy. Empty cookies; exporter-owned range/voice precedence/base state/lifecycle. Metadata's eight scoped flags default false and enable no translation/DSP. Hosted metadata validation and instrument application separate; offline f32/f64/auxiliary adapter evidence only, no third-party/DAW/deadline claim.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/output.rs, crates/ravet-clap/src/parameters.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/multi_bus.rs, crates/ravet-graph/src/events.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-foundation/tests/scoped_parameters.rs, crates/ravet-clap/tests/scoped_parameters.rs, crates/ravet-clap/tests/parameters.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-graph/tests/events.rs.

Documentation: docs/parameters.md, docs/extended-processing.md, docs/decisions/0137-exported-scoped-parameters.md.

CLAP audio and event bridge

Clack-backed preallocated scratch storage adapts mono/stereo f32 effects and global parameter values to the portable processor.

Limits: At most 65,536 frames and 1,024 total input events; two sample copies per channel. Block-start transport is forwarded. No instruments, notes, modulation, f64, extra buses, or output events in this adapter.

Source: crates/ravet-clap/src/lib.rs.

Tests: examples/gain-clap/tests/bridge.rs.

Documentation: docs/decisions/0002-clap-backend.md.

Reusable native f32/f64 planar processor adaptation

SDK-independent prepared main/auxiliary scratch, checked raw bus pointers, complete typed event preflight and copied-input output rendering adapt exclusively borrowed portable processors to consumer native shims.

Limits: One main plus eight ordered auxiliaries, up to 64 channels per direction/bus, frames<=65536 and events<=1024 per direction; owned sample/generated-event payload<=64 MiB. Foreign live/aligned ranges and serialized lifecycle remain caller obligations. All inputs copy before outputs, output overlaps reject; zero frames permit null arrays. Exact supplied portable transport with consumer format validation. Faults silence supported declared prefixes/discard generated delivery without history rollback. Audio/reset panic poisons until fresh stopped preparation; normal heap evidence only, exceptional handlers may allocate. Consumer processor support, schemas/state C codecs, format-specific event/transport mappings, SDK registration/editor/delivery and native deadline remain separate; public Gain C ABI uses both precision paths.

Source: crates/ravet-native/Cargo.toml, crates/ravet-native/src/lib.rs, crates/ravet-native/src/raw.rs, crates/ravet-native/include/RavetNativeAudio.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/processing.rs, examples/gain-native/src/lib.rs, examples/gain-native/src/precision64_tests.rs.

Documentation: docs/native-processing.md, docs/architecture.md, docs/vst3.md, docs/decisions/0142-native-planar-adapter.md.

Consumer-selected native processor lifecycle entry

A reusable opaque owner and immutable exported v1 table compose prepared f32/f64 multibus processing, complete native events/transport, lifecycle and latency/tail queries for consumer-selected processors; Gain exposes the entry alongside its existing ABI.

Limits: Default+Send processors, exact table/handle/precision and loaded-library lifetime; exclusive serialized ownership and stopped control lifecycle/query calls. Fixed canonical preparation, native adapter bounds plus separately bounded decoded input events; full prepared native output capacity required before DSP. Foreign ranges/nonoverlap remain caller obligations, faults silence supported raw prefixes and expose no events without DSP rollback. Panics poison until fresh preparation; exception/consumer paths carry no deadline promise. No generic schema/state/metadata/editor, SDK registration or additional DAW/platform support claim.

Source: crates/ravet-native/src/entry.rs, crates/ravet-native/include/RavetNativeProcessor.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/entry.rs, tools/native-validation/processor_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/decisions/0145-native-processor-entry.md.

Bounded native global schemas and complete state

An optional paired native facade table exposes stable-ID f32 schema metadata, UTF-8 roles/ranges, pure mapping, revalidated complete snapshots and atomic decoded-state recall; Gain's thin facades retain canonical and explicit legacy codec behavior.

Limits: Up to 1024 global f32 parameters; UTF-8 names<=255/unit<=63 bytes without NUL; immutable schemas/roles. Exact paired processor handle/precision/library and exclusive stopped state ownership; no live publication. Canonical Foundation little-endian records, explicit consumer legacy decoder<=8208 bytes; consumer restore must reject atomically. Metadata roles do not implicitly filter events. Foreign ranges/consumer callbacks remain obligations; panics poison until fresh preparation. No scoped granularity/f64 persistence, formatting/groups/programs/editor, generic SDK registration or additional DAW/platform/deadline claim.

Source: crates/ravet-native/src/parameters.rs, crates/ravet-native/include/RavetNativeParameters.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/parameters.rs, tools/native-validation/parameter_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/parameters.md, docs/decisions/0146-native-parameter-state-companion.md.

Explicit native live global state publication

An opt-in paired native table provides independent coherent publication objects, controller complete-state decoding, prepared audio apply and conditional reflection that preserves newer restores and ongoing smoothing.

Limits: 64-bit atomics; <=1024 global f32 values and <=8208 state bytes, cached immutable schema. Explicit no-allocation/deallocation/blocking/I/O audio hooks and atomic consumer restore; exact type/precision/library pairing and exclusive prepared DSP owner. Control-only creation/byte codecs/destruction; retire after all callers stop. Single attempts return Busy/Stale, coalescing/retry/scheduling owned by consumer. Identity/generation cannot wrap in relevant lifetimes. Panics poison DSP until fresh preparation; arbitrary callbacks/foreign ranges remain obligations. No scoped/f64 persistence, automatic SDK registration/notifications/session scheduling or additional DAW/platform/deadline claim.

Source: crates/ravet-native/src/state_publication.rs, crates/ravet-native/include/RavetNativeState.h, crates/ravet-native/src/entry.rs, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/state_publication.rs, tools/native-validation/state_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/decisions/0147-native-live-state-publication.md.

Explicit trusted VST3 catalogue ownership

Default-disabled caller-linked Rust provider ABI and thread-restricted module owner compose an external-SDK native loader and immutable whole factory/class catalogue.

Limits: Explicit unsafe provider/module trust and executable lifetime; main-thread load/query/retirement, no factory/handle escape. UTF8 paths1..4096bytes withoutNUL; classes1..256 unique nonzero opaque IDs, positivecardinality, exact terminated UTF8/pairedUTF16 metadata and native statuses. Highest available interface failure rejects whole catalogue. Heap host context outlives module; one live owner per exact factory identity, up to256 reserved, no lock held across foreign calls. SDK NotImplemented context result accepted explicitly without delivery claim; consuming clear failures retire once, other rejection recovers owner. Cargo builds ABI only, external SDK/native linking explicit and macOS native recipe only. Public native Gain/Performance repeated load/retirement, all three CTest executables, relinked Rust main-thread owner/provider probe and shared Rust gates pass. Pointer-valid unsuccessful or throwing interface outputs released before status checks; caught native C++ exceptions map to InternalError. Authored nine-case context/reference/module-exit fixture passes through the public CMake target with public SDK interfaces, separate from actual module loader evidence. Catalogue-v1 has no instance/audio API; separate ABI-v2 record covers scoped component/controller/f32 processing and explicit non-discardable retention. No sandbox/crash/RSS/deadline/third-party/DAW/other-platform runtime claim.

Source: crates/ravet-host/src/vst3.rs, crates/ravet-host/Cargo.toml, crates/ravet-host/native/vst3/RavetVst3Provider.h, crates/ravet-host/native/vst3/RavetVst3Catalogue.hpp, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/CMakeLists.txt.

Tests: crates/ravet-host/src/vst3_tests.rs, crates/ravet-host/native/vst3/catalogue-tests.cpp, crates/ravet-host/native/vst3/provider-tests.cpp, crates/ravet-host/native/vst3/context-tests.cpp.

Documentation: docs/vst3-hosting.md, docs/plugin-hosting.md, docs/decisions/0210-trusted-vst3-catalogues.md.

Scoped trusted VST3 instances and main f32 audio

An independent caller-linked ABI-v2 table retains native component/controller ownership and lends one non-escaping audio capability from main-owned Rust instances.

Limits: Explicit unsafe table/code/module trust and original main control ownership; default-disabled existing vst3-catalogue feature, no implicit SDK discovery or Cargo native link. Library/child !Send/!Sync, borrowed parent and sole Send/!Sync/non-Clone HRTB audio scope; joined worker return/unwind/forget ends on main; unexpected failed end poisons and retains native ownership. Bounded256parents/classes/children; known canonical aliases reject before load, non-discardable pin before first create even failure/throw, consuming ProcessPinned facade close and same-core v2reopen; v1 ABI unchanged and excludes pinned core. Provider executable/host code must also remain process-lifetime; no static pin destruction. Finite0<rate<=768000Hz,1..65536prepared frames, main mono/stereo f32 and no-input or matching inputs; bounded16bus metadata per direction, event buses inactive, mandatory controller handler/reverse successful cleanup, explicit coalesced restart read without reconciliation. Whole caller shape/capacity/alignment/overflow/reserved/protected-range/output-overlap preflight; input scratch before output permits raw cross-alias, known native process faults silence valid prefixes and fault-close, tails retained. Staged native CMake9/9, actual Gain/Performance10000mono/stereo loops/profile, independent measured0regularCppnew/delete and0Rustalloc/dealloc, eight negative compilation contracts, public-path Rust5unit groups and10doctests/warning lint/Rustdoc pass locally; public focused110Rust tests/doctests plus9native CTest and actual complete Rust/native consumer pass; combined workspace validation follows source adoption. Stopped state is a separate companion; no live restore. No event/parameter/transport/editor/graph/f64/aux/latency-tail reconciliation, arbitrary third-party compatibility, sandbox/crash/RSS/deadline/DAW/other-platform runtime claim.

Source: crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/RavetVst3Provider.h, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/RavetVst3CoreRegistry.hpp.

Tests: crates/ravet-host/src/vst3/instance_tests.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/abi-tests.c, crates/ravet-host/native/vst3/core-registry-tests.cpp, crates/ravet-host/native/vst3/process-pin-tests.cpp, crates/ravet-host/native/vst3/instance-protocol-tests.cpp, crates/ravet-host/native/vst3/instance-block-fault-tests.cpp, crates/ravet-host/native/vst3/instance-v2-actual-tests.cpp, tools/vst3-validation/instance-owner.rs, tools/vst3-validation/check-instance-owner.py.

Documentation: docs/vst3-instances.md, docs/vst3-hosting.md, docs/decisions/0215-scoped-vst3-instances.md.

Owned VST3 controller parameters and timed input

An exact-table-paired companion owns stopped controller metadata/control and delivers bounded immutable sample-timed parameter queues through the scoped audio owner.

Limits: Default-disabled vst3-catalogue and explicit caller-linked external SDK; tested64bit macOS only. Main/exclusive stopped controller; all mutable module CONTROL waits for every AUDIO scope joined, already-prepared distinct children can borrow scopes. Existing provider/state ABIs unchanged; companion72/record1568/report24/point16. At most1024 copied unique parameters, bounded UTF16/UTF8 text/recognized flags, opaque units and explicit bypass/program flags without banks. Controller edits do not deliver DSP; failed foreign or malformed edit invalidates preparation without rollback, explicit refresh/reprepare. Whole2048points/64writableIDs/global-order/per-ID-strict-offset/finite-normalized/shape/known-storage preflight before DSP/output effects, zero-frame offset0. Per-core16pools/64MiB, each16fixed slots/64queues/2048points, permanent host refs; retained individual queues prevent slot reuse. AUDIO immutable admitted-thread-only data then freeze, sticky queue faults distinct from returned status/throws. Host-only detached payload reclaimed CONTROL; foreign release never final-free. Observed retention pins exact reserved core before facade retirement; ProcessPinned/same-core reopen/provider-code process lifetime/no automatic unpin. Successful state restore needs explicit refresh/parameterprepare; native preparation fault requires fresh child. Local SDK fixtures/fast-math/actual Gain timed smoothing-bypass and Performance serialized Level/safe Rust state recall/10000variable blocks profile/heap observations only. No active controller callbacks, output automation/events/transport/editor/f64/aux/graph/arbitrary third-party/DAW/other-platform/deadline or whole-plugin RSS claim.

Source: crates/ravet-host/src/vst3/parameters.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/RavetVst3Parameters.h, crates/ravet-host/native/vst3/BoundedParameterChanges.hpp, crates/ravet-host/native/vst3/ParameterCatalogue.hpp, crates/ravet-host/native/vst3/ParameterPoolKeepers.hpp, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/BoundedStateStream.hpp, crates/ravet-host/native/vst3/provider.cpp.

Tests: crates/ravet-host/src/vst3/parameter_tests.rs, crates/ravet-host/native/vst3/parameter-abi-tests.c, crates/ravet-host/native/vst3/parameter-changes-tests.cpp, crates/ravet-host/native/vst3/parameter-catalogue-tests.cpp, crates/ravet-host/native/vst3/parameter-pool-tests.cpp, crates/ravet-host/native/vst3/parameter-transaction-tests.cpp, crates/ravet-host/native/vst3/parameter-actual-tests.cpp, tools/vst3-validation/parameter-owner.rs, tools/vst3-validation/check-parameter-owner.py.

Documentation: docs/vst3-parameters.md, docs/vst3-instances.md, docs/vst3-state.md, docs/decisions/0233-owned-vst3-parameters.md.

Owned stopped VST3 component/controller state

An exact-table-paired companion captures owned opaque component/controller snapshots and applies bounded stopped state with explicit partial-failure poisoning and retained-stream lifetime.

Limits: Default-disabled vst3-catalogue and explicit caller-linked external SDK; main/exclusive stopped non-faulted child borrowing parent. Catalogue-v1/provider-v2 layouts unchanged; state companion32/record32/report24 on tested64bit macOS. Each explicit capture/source stream1..8MiB, keepers16/64MiB per core; whole range/shape/presence/UID preflight and capture publication, independent controller-component reader. Controller absent/NotImplemented/successful empty distinct. Opaque bytes do not authenticate version/schema/code. Success requires explicit reprepare; failed foreign compound restore or swallowed stream fault poisons processing without rollback but permits joined retirement/new-child recovery. Original returned SDK status/throw/stream diagnostic distinct; malformed restore reports fail closed. Frozen owned SDK streams retain host references; foreign release cannot cause final payload free, CONTROL reclaims. Retained streams force existing reserved-slot process pin even on failed/thrown getter, same-core v2 reopen and provider executable process lifetime; no unpin/static exit destruction. Controlled SDK-interface and actual Gain/Performance safe Rust capture/restore/render/controller rejection/recovery evidence only. No live restore, implicit restart/bus/parameter reconciliation, arbitrary third-party/DAW/editor/event/graph/other-platform or heap/RSS/deadline claim.

Source: crates/ravet-host/src/vst3/state.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/RavetVst3State.h, crates/ravet-host/native/vst3/RavetVst3State.hpp, crates/ravet-host/native/vst3/BoundedStateStream.hpp, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/RavetVst3CoreRegistry.hpp.

Tests: crates/ravet-host/src/vst3/state_tests.rs, crates/ravet-host/native/vst3/state-abi-tests.c, crates/ravet-host/native/vst3/state-stream-tests.cpp, crates/ravet-host/native/vst3/state-transaction-tests.cpp, crates/ravet-host/native/vst3/state-module-retention-tests.cpp, tools/vst3-validation/state-owner.rs, tools/vst3-validation/check-state-owner.py.

Documentation: docs/vst3-state.md, docs/vst3-instances.md, docs/decisions/0227-owned-vst3-state-transactions.md.

Prepared hosted VST3 events and block context

An exact-paired stopped catalogue and main-f32 audio companion copies selected buses/MIDI assignments, owns all input event payloads and publishes complete verified event/parameter output batches with independent native failure facts.

Limits: Trusted caller-linked native provider and plug-ins; 16 event buses/direction, 1..16 selected channels, 2048 events and 65536 payload bytes/direction, 64 output queues/2048 points. Main f32 mono/stereo effect or instrument only. 64MiB native event-pool keeper cap; observed six concurrently prepared children on the measured arm64 layout, about10.1MB event storage each plus parameter storage, separate from16 retained batches/child. Revised Rust wire tests and native fixtures are locally qualified; actual Gain mono/stereo and Performance SDK-image consumers pass through that revised owner against fresh W241 modules/canonical W227-243 archives. Core-owned controller-handler keepers, complete sibling numeric ownership protection and CONTROL exception provenance (R4) pass 98 native fixture commands and 31 CTest profiles. No DAW/platform/deadline support inference. Late native faults require stopped child retirement/recreation. Native f64/auxiliary buses and Graph ownership are the separate hosted-vst3-graph-banks record; editors are the separate hosted-vst3-editor-ownership record.

Source: crates/ravet-host/src/vst3/processing.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/RavetVst3Processing.h, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/ProcessingBoundary.hpp, crates/ravet-host/native/vst3/ProcessingCatalogue.hpp, crates/ravet-host/native/vst3/BoundedEventLists.hpp, crates/ravet-host/native/vst3/BoundedParameterChanges.hpp, crates/ravet-host/native/vst3/EventWire.hpp, crates/ravet-host/native/vst3/EventCodec.hpp, crates/ravet-host/native/vst3/ContextWire.hpp, crates/ravet-host/native/vst3/ProcessingPoolKeepers.hpp, crates/ravet-host/native/vst3/ImmutableCoreProtection.hpp, crates/ravet-host/src/vst3/parameters.rs, crates/ravet-host/src/vst3/state.rs.

Tests: crates/ravet-host/src/vst3/processing_tests.rs, crates/ravet-host/native/vst3/processing-provider-tests.cpp, crates/ravet-host/native/vst3/processing-instance-tests.cpp, crates/ravet-host/native/vst3/processing-abi-tests.c, crates/ravet-host/native/vst3/event-list-tests.cpp, crates/ravet-host/native/vst3/output-parameter-tests.cpp, crates/ravet-host/native/vst3/context-wire-tests.cpp, crates/ravet-host/native/vst3/event-wire-tests.cpp, crates/ravet-host/native/vst3/processing-catalogue-tests.cpp, crates/ravet-host/native/vst3/core-metadata-protection-tests.cpp, crates/ravet-host/native/vst3/processing-module-retention-tests.cpp, crates/ravet-host/native/vst3/paired-reservation-tests.cpp, crates/ravet-host/src/vst3/processing_followup_tests.rs.

Documentation: docs/vst3-processing.md, docs/vst3-instances.md, docs/vst3-parameters.md, docs/decisions/0246-hosted-vst3-events-context.md.

Hosted VST3 native 32/64 aux buses and owned Graph banks

Default-disabled vst3-hosted-audio companion negotiates explicit main/aux bus profiles in native f32/f64, processes complete rich lanes through the scoped capability, and owns hosted children as canonical Graph processors retained by a bounded MAIN retirement registry.

Limits: Explicit unsafe exact-origin table/code/module trust; default-disabled vst3-hosted-audio feature (enables vst3-catalogue), no Cargo SDK link. Every advertised bus (<=16 per direction, <=1 main) needs an explicit active/inactive request; no defaultActive inference, fallback precision or layout substitution; <=64 packed active channels per direction, rate 0<r<=768000, frames 1..65536. Native refusals keep original stage/tresult; local refusal preserves the prior profile. f64 never narrowed. Graph bank consumes Library<'static>, 1..128 children, all prepared before the first lease begins, leases begin last with reverse unwind; MAIN registry 64 banks, nonwrapping generations, deliberately leaked, platform main thread on Apple. Node drop moves its bundle to a one-slot return ring; control drop only orphans; reclaim ends all leases before stop/retirement and never guesses a lease ended; forgotten nodes, refused returns and failed ends retain the bank. Rich lanes 1..4 batches/node, 64MiB per-bank budget, exact sequence/frames. Without a declared translation, framework events refuse; explicit translation is the separate hosted-vst3-graph-framework-events record. Checked reset refuses with RebuildRequired; fresh bank required. Evidence: mock-provider Rust unit/bank scenarios, 126 native fixture commands normal/fast-math, 61 CTest incl. actual W241 Gain/Performance, actual caller-linked Rust consumer debug/release (Gain mono/stereo f32/f64, Performance f32/f64, Graph Performance->Gain banks, orphaned control, 10000 blocks zero Rust allocations). Rust allocations only; foreign SDK/C++ heap, crash isolation, deadlines, DAW, third-party plug-ins and other platforms not claimed. Actual auxiliary-bus and all-nine-event-kind evidence uses the RAVET reference VST3 modules (vst3-reference-modules record); Graph-bank child editors and controller edit gestures are the hosted-vst3-graph-bank-editors-edit-gestures record (scoped-instance editors are the hosted-vst3-editor-ownership record).

Source: crates/ravet-host/src/vst3/hosted_audio.rs, crates/ravet-host/src/vst3/hosted_audio/graph.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/Cargo.toml, crates/ravet-host/native/vst3/RavetVst3HostedAudio.h, crates/ravet-host/native/vst3/HostedAudioProfile.hpp, crates/ravet-host/native/vst3/HostedAudioScratch.hpp, crates/ravet-host/native/vst3/HostedAudioCatalogue.hpp, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/CMakeLists.txt, crates/ravet-foundation/src/processor.rs, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-host/src/vst3/hosted_audio/tests.rs, crates/ravet-host/src/vst3/hosted_audio/graph/tests.rs, crates/ravet-host/native/vst3/hosted-audio-abi-tests.c, crates/ravet-host/native/vst3/hosted-audio-profile-tests.cpp, crates/ravet-host/native/vst3/hosted-audio-range-tests.cpp, crates/ravet-host/native/vst3/hosted-audio-scratch-instance-tests.cpp, crates/ravet-host/native/vst3/hosted-audio-instance-tests.cpp, crates/ravet-host/native/vst3/hosted-audio-provider-tests.cpp, crates/ravet-graph/tests/checked_reset.rs, crates/ravet-native-dsp/tests/checked_reset.rs, crates/ravet-clap/tests/checked_reset.rs, crates/ravet-embedded/tests/checked_reset.rs, crates/ravet-native/tests/checked_reset.rs.

Documentation: docs/vst3-hosting.md, docs/vst3-processing.md, docs/decisions/0268-hosted-vst3-graph-banks.md.

Framework events in hosted VST3 Graph nodes

Opt-in per-node translation of ordinary RAVET parameter values, notes, note expression, poly pressure and block-start transport into hosted VST3 Graph-bank children, through declared parameter routes and scales, a selected note bus with an explicit note-ID policy, refuse/ignore policies and an explicit merge order with rich lanes.

Limits: Declared on MAIN with Vst3GraphBankBuilder::translate and checked against the refreshed catalogue before any lease begins; nodes without a translation still refuse framework events. Parameters: <=2048 declared routes (unique graph and native IDs, writable non-hidden native IDs), Normalized or declared Linear{minimum,maximum} scale, no inferred ID equality or plug-in mapping query, checked against a catalogue snapshot at build (no revalidation after a plug-in restart); exact-offset normalized points, no sorting or merging; same-ID same-offset Refuse (default) or opt-in LastWins (counted as ignored); <=64 distinct native IDs per block; bounded per-point admission (trailing equal-offset run and incremental 64-ID set); unmapped IDs Refuse or Ignore. Notes: one selected event input bus, Unidentified (-1) or RequireIdentified policy, NoteWithId 0..=i32::MAX, channel within the bus, velocity copied, tuning/length/ppqPosition/flags zero. Expressions (declared, not queried): volume /4, pan, tuning /240+0.5, vibrato, expression, brightness by note ID only (no channel/key); pressure as poly pressure with concrete channel/key, f32 narrowing. Transport: optional ProcessContext with flags exactly for present fields; playing and sample position required once anything is known; discontinuity, pre-roll, tempo increment, bar number and sample loops not represented. MIDI/UMP/modulation/gesture/scoped/choke/completion and undeclared capabilities follow Refuse or Ignore; ignored events are counted. Queued lanes: Refuse, FrameworkFirst or LaneFirst merge; two contexts refuse. <=2048 events and points per block, merged storage within the same limits, counted in the 64 MiB per-bank lane budget; AUDIO translation allocates, locks and frees nothing. Every refusal (including overflow) occurs before the plug-in runs, silences the block and returns ProcessStatus::Silence: neither the node nor an enclosing Graph latches, and GraphStatus does not carry the refusal. The reason is a distinct framework::Refusal, counted (refused), kept in a 16-record ring drained on MAIN (further details dropped, still counted), marked in diagnostics and, in queued mode, returned with the lane batch as Error::Framework. Native faults, admission refusals and events sent to untranslated nodes still fault and latch. No AUDIO panic path in translation. No IMidiMapping, output-event translation, note-ID synthesis or ppqPosition derivation. Evidence: Rust translator and mock-provider bank scenarios (exact offsets, every mapping and refusal with its exact reason, Graph-level refusal over seven blocks, 10000-cycle zero-allocation checks) and an actual caller-linked consumer over freshly built RAVET Gain and Performance VST3 bundles (f32/f64 nodes and a broadcast Graph chain against closed-form references, a refusing Gain node inside a Graph that continues with unity output and a later gain change, 10000 Graph blocks with zero Rust allocations), plus the VST3 native CMake/CTest suite. Local macOS arm64 only; Rust allocations only; no DAW, third-party plug-in, foreign-heap, deadline or other-platform claim.

Source: crates/ravet-host/src/vst3/hosted_audio/graph/framework.rs, crates/ravet-host/src/vst3/hosted_audio/graph.rs, crates/ravet-host/src/vst3/hosted_audio.rs, crates/ravet-host/src/vst3/processing.rs.

Tests: crates/ravet-host/src/vst3/hosted_audio/graph/framework/tests.rs, crates/ravet-host/src/vst3/hosted_audio/graph/translation_tests.rs, crates/ravet-host/src/vst3/hosted_audio/graph/tests.rs, crates/ravet-host/src/vst3/hosted_audio/mock.rs.

Documentation: docs/vst3-hosting.md, docs/audio-graphs.md, docs/decisions/0273-hosted-vst3-graph-framework-events.md.

Hosted VST3 editor ownership (macOS NSView)

Default-disabled vst3-editor companion creates a controller IPlugView on the main thread, attaches it to a caller-owned NSView, negotiates bounded sizes, handles IPlugFrame resize requests with explicit reentry policy, and releases the view before controller, component and module retirement.

Limits: macOS NSView only; explicit unsafe exact-origin table/code/module trust and unsafe caller-owned parent lifetime; default-disabled vst3-editor feature (enables vst3-catalogue), no Cargo SDK link. Accepted limitation for scoped instances: the Rust Editor exclusively borrows its Instance, so Rust-side scoped audio/prepare/start/stop/state calls need the editor closed (an editor open while AUDIO runs is the Graph-bank child editor of hosted-vst3-graph-bank-editors-edit-gestures). mem::forget leaks the native editor, child and module (memory-safe). One editor per child; child destroy LIFECYCLE and module close CHILDREN while open. Owner replies carry an authoritative attached state (refusals included). Extents 1..16384; host resize needs canResize kResultTrue, checkSizeConstraint kResultTrue (== kResultOk; kResultFalse/kNotImplemented refuse, no fallback) with bounded rect and onSize kResultOk; recorded size re-queried by getSize. resizeView acknowledged during attached/setContentScaleFactor is applied later (after the call when attached, else at next attach) or counted as discarded; refused during other host view calls, off-main, foreign view, out of range, while detached, faulted or after teardown; idle requests apply onSize under the module busy flag and publish a one-slot consumer request cleared by detach, teardown and host resize. Content scale 0.25..8 optional, normally unsupported on macOS. No Rust callbacks or pointer escape. Evidence: injected SDK view fixture and substituted-loader provider fixture (normal/fast-math), C11 layout, Rust mock-provider tests, and the actual RAVET Gain VST3 editor in a hidden offscreen NSWindow (three cycles, one with concurrent audio through the native table); Performance/default Gain report unavailable. Edit gestures stay kNotImplemented for scoped instances (adopted only by gesture-enabled Graph-bank children). No DAW, third-party editor, visual, keyboard/focus, accessibility or other-platform claim.

Source: crates/ravet-host/src/vst3/editor.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/Cargo.toml, crates/ravet-host/native/vst3/RavetVst3Editor.h, crates/ravet-host/native/vst3/RavetVst3EditorOwner.hpp, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/CMakeLists.txt.

Tests: crates/ravet-host/src/vst3/editor/tests.rs, crates/ravet-host/native/vst3/editor-abi-tests.c, crates/ravet-host/native/vst3/editor-owner-tests.cpp, crates/ravet-host/native/vst3/editor-provider-tests.cpp, crates/ravet-host/native/vst3/editor-view-fixture.hpp, crates/ravet-host/native/vst3/editor-window-tests.mm, crates/ravet-host/native/vst3/editor-visible-probe.mm.

Documentation: docs/vst3-hosting.md, docs/decisions/0271-hosted-vst3-editor-ownership.md.

Graph-bank child editors and controller edit gestures (macOS NSView)

A Graph-bank child can open its MAIN-thread NSView editor while the bank processes AUDIO on a worker, and an opt-in edit-gesture companion delivers paired controller beginEdit/performEdit/endEdit to the processor at offset 0 of the next dispatched block (the edit wins over a same-id block point) and to the host as ordered events with framework gesture/value identity, under an explicit restartComponent policy.

Limits: macOS NSView only, local arm64 evidence; default-disabled features (edit gestures need vst3-hosted-audio, bank editors also vst3-editor); additive exact-origin RavetVst3EditGestureProviderV1 (40 bytes); unsafe table/module trust and unsafe caller-owned NSView lifetime. Opt-in per child; other handlers keep kNotImplemented edits and original restart coalescing. Capture on the platform main thread only into a 256-record ring with gap-free sequences; unknown/read-only/hidden ids and non-finite or out-of-range values return kInvalidArgument; full ring, off-main and post-retirement calls return kResultFalse; all counted. Pairing: at most 64 open gestures, each reserving its end slot, so an accepted begin's end is never refused; duplicate begins and orphan ends are refused (unpaired) and never recorded; editor close records a flagged synthesised end per open gesture; gestures open at retirement are not closed, and a consumer-side panic or Abi pump error can drop records; kNoParamId is refused. restartComponent accepts only kParamValuesChanged, kLatencyChanged and kParamTitlesChanged (kResultOk means recorded, not applied); any other defined flag refuses the whole call; latency changes are published as rebuild_required and the node keeps its cached latency; the writable-id snapshot is not refreshed. pump_edits moves records only while both the AUDIO value ring (1..256) and the host queue (1..4096) have room and refuses after the node returns; values apply at offset 0 of the next successfully dispatched block, coalesce per id (last wins), replace a block point for the same id at offset 0 (edit wins, counted overridden), defer beyond 64 ids/2048 points, and stay pending across refused blocks and failed dispatches; block granularity only. No Rust allocation, lock or free on AUDIO (Rust heap evidence only); worst-case coalescing 65,536 comparisons per block. Bank editors: one per child; bank reclamation is deferred (ReclaimReport::editors) while any editor is open and never closes a caller's editor; native child destroy LIFECYCLE while open; refused drop-time destroy or mem::forget keeps the bank retained (memory-safe). Concurrent editor and AUDIO depend on the plug-in's own controller/processor thread safety (VST3 permits it); only RAVET's split-component Gain was exercised. Evidence: C11 layout, substituted-loader gesture fixture (normal/fast-math), Rust mock-provider bank scenarios, ThreadSanitizer runs of the native fixtures and the existing editor window test (RAVET C++ only; the Graph-bank window test cannot be linked with TSan), and the actual RAVET Gain editor (RAVET_GAIN_EDITOR=ON) attached to a bank child in a hidden offscreen NSWindow, never ordered front, for three cycles with edits injected into its script-message bridge, bit-exact delivery at the first block after pump_edits and zero Rust AUDIO allocations. No DAW, third-party or single-component plug-in, WebKit JavaScript or input-event, visual, accessibility, deadline, race-freedom or other-platform claim.

Source: crates/ravet-host/src/vst3/hosted_audio/graph/edits.rs, crates/ravet-host/src/vst3/hosted_audio/graph/editor.rs, crates/ravet-host/src/vst3/hosted_audio/graph.rs, crates/ravet-host/src/vst3/editor.rs, crates/ravet-host/native/vst3/RavetVst3EditGestures.h, crates/ravet-host/native/vst3/ControllerHandlerKeepers.hpp, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/CMakeLists.txt, crates/ravet-host/examples/vst3-editor-bank.rs, crates/ravet-host/Cargo.toml.

Tests: crates/ravet-host/src/vst3/hosted_audio/graph/edit_tests.rs, crates/ravet-host/src/vst3/hosted_audio/mock.rs, crates/ravet-host/native/vst3/edit-gesture-abi-tests.c, crates/ravet-host/native/vst3/edit-gesture-provider-tests.cpp, crates/ravet-host/native/vst3/editor-bank-window-tests.mm, crates/ravet-host/examples/vst3-editor-bank.rs.

Documentation: docs/vst3-hosting.md, docs/decisions/0276-graph-bank-editors-and-edit-gestures.md, docs/decisions/0271-hosted-vst3-editor-ownership.md.

RAVET reference VST3 modules for hosted-VST3 tests

Keyed Sidechain (stereo main plus mono/stereo auxiliary key, output main*key) and Event Probe (all nine SDK input event kinds and parameter points rendered as exact-offset impulses with FNV-1a payload hashes, echoed output events, an echoed-event count CC and a digest parameter) are built from portable Foundation processors and tested as actual loaded modules through the native provider, a direct SDK robustness harness and the Rust vst3-hosted-audio Graph bank.

Limits: Test references only: no state, editor, presets, bypass, latency or public plug-in product. Local macOS arm64; CMake refuses non-Apple hosts; external SDK; ad-hoc signature in the build tree with plug-in link/user path pinned off and a no-install CTest; never installed. One mono or stereo auxiliary input (5.1 refused); silence-flagged inputs read as zero. Event Probe per block: <=2048 events, <=4096-events Marker points, 65536+4096+16 bytes payload storage; other buses and unknown kinds ignored; other malformed input refuses the block silently with the digest unchanged, except that a host refusing output posts sees kResultFalse after the digest advanced. Same-offset records are summed (left code sums ambiguous); f32 exact while <=16 records share an offset, f64 always. Evidence: SDK validator, signature and no-install CTest per bundle; direct C ABI tests for every entry point; native provider normal and fast-math-harness tests (native32/64, aux stereo/mono active and inactive, 5.1 refusal, all nine kinds, 2000 variable and zero-frame blocks); direct SDK robustness harness (capacity, payload, offset, bus, unknown-kind, null-pointer, empty-block and sequencing cases, twin-instance digest checks); Rust Graph bank f32/f64 (600 blocks). Zero Rust heap operations inside the loaded modules (test-only allocation-probe counter, every process call), zero C++ new/delete on the provider AUDIO worker, zero host-side Rust heap in Graph::process and in ABI process/reset. Direct malloc by C++ wrappers/SDK not counted. No DAW, third-party host, other-platform or deadline claim.

Source: examples/vst3-reference-native/src/lib.rs, examples/vst3-reference-native/src/abi.rs, examples/vst3-reference-native/src/allocation_probe.rs, examples/vst3-reference-native/include/RavetVst3Reference.h, examples/vst3-reference-native/Cargo.toml, examples/vst3-reference/src/sidechain.cpp, examples/vst3-reference/src/event_probe.cpp, examples/vst3-reference/CMakeLists.txt, crates/ravet-host/native/vst3/CMakeLists.txt.

Tests: examples/vst3-reference-native/src/tests.rs, examples/vst3-reference-native/src/abi/tests.rs, crates/ravet-host/native/vst3/reference-module-tests.cpp, crates/ravet-host/native/vst3/reference-robustness-tests.cpp, crates/ravet-host/examples/vst3-reference-bank.rs, crates/ravet-host/native/vst3/reference-bank-main.c.

Documentation: docs/vst3-reference-modules.md, docs/vst3-hosting.md, docs/decisions/0274-reference-vst3-modules.md.

Optional asynchronous AUv3 host ownership and joined main-bus audio

Default-disabled ravet-host au-hosting feature over a caller-linked authored macOS provider: explicit bounded registry catalogue, AUAudioUnit asynchronous instantiation with nonblocking main poll, observed-load-mode admission, stopped mono/stereo f32 main-bus preparation and joined scoped rendering through the public cached renderBlock.

Limits: macOS 12+ arm64 local evidence only; the caller links the native provider (no Cargo native link or build script). Explicit trusted native execution; catalogue 1..256, 16 process pending requests (cancelled requests hold capacity until real completion), 256 instances/reservations. Main-only !Send/!Sync owners and one Send/!Sync/non-Clone HRTB audio scope; joined return/unwind/forget end on main; failed end poisons and retains native ownership. Required load mode is checked against observed isLoadedInProcess; NSError domain/signed64 code stays separate from OSStatus and host status. One main output bus, zero or one matching input bus, mono/stereo planar f32, 0<rate<=768000Hz, 1..65536 frames; whole preflight, input capture before render, failures silence admitted prefixes and fault-close, tails retained, no retry or rollback. In-process evidence only: a test-process-registered public Gain and an injected SDK fault fixture; zero ordinary C++ new and zero Rust allocator requests over 2000 prepared calls each (Objective-C, Apple framework and libc allocation not counted). Actual out-of-process (IPC) rendering is unvalidated: a reviewed ad-hoc signed, non-/Applications registration was never discoverable. No parameters/state/programs/editors/events/transport/aux/f64/latency/graph integration, iOS, auval, DAW, third-party compatibility, IPC crash isolation, RSS, production signing or deadline claim.

Source: crates/ravet-host/src/au.rs, crates/ravet-host/native/au/RavetAuHost.h, crates/ravet-host/native/au/provider.mm, crates/ravet-host/native/au/CMakeLists.txt, crates/ravet-host/Cargo.toml.

Tests: crates/ravet-host/src/au_tests.rs, crates/ravet-host/native/au/gain-tests.mm, crates/ravet-host/native/au/failure-tests.mm, tools/au-host-validation/host-owner.rs, tools/au-host-validation/fixture.mm, tools/au-host-validation/check-au-host.py.

Documentation: docs/au-hosting.md, docs/decisions/0269-auv3-asynchronous-host-ownership.md.

Prepared native AAX main and auxiliary audio buses

Fixed planar host-f32 mapping and stopped native layout/SDK profile composition adopt an actual Rust main/detector/monitor processor through initialized registered AAX callbacks.

Limits: One main plus8aux buses,64 total pointer channels per direction,1..1024frames; explicit static input slices or one connected dynamic sidechain, source-order compact outputs. Main None/mono/stereo SDK stems and live exact caller metadata capacities; no inferred inactive routing. Whole range/alias/protected-metadata map precedes MIDI/transport/state/dequeue/DSP; input/output sample alias uses authoritative native scratch. Known setup faults preserve readiness/profile; invoked backend failure retains original code/failsclosed. Default effect/instrument Context layouts remain; common guards protect outer/context/frame/owner fields, explicit effect multibus adds field4. Instrument+Multibus excluded pending separate registration. Supported silence covers union of safe prefixes and retains outside storage. Public nativeGain26/Performance4/stock14 CMake plus actual module/export/registered algorithms, Rust5/warning lint/docs and Python8 pass; combined workspace gate follows adoption. Explicit internal native32/64 selection is separate from host-f32 buses. No host-native64 buffers/auxiliary generated output/dynamic bus registration/publicauxplug-in/ProTools/signing/otherplatform/deadline claim.

Source: crates/ravet-native/include/RavetAaxAudio.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/bus-audio.cpp, tools/aax-validation/multibus.cpp, tools/aax-validation/processor.cpp, tools/aax-validation/model.cpp, tools/aax-validation/registered-native.cpp, tools/aax-validation/registered-instrument.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-bus-mapping.md, docs/aax.md, docs/decisions/0222-aax-prepared-native-bus-mapping.md, docs/aax-precision.md.

Prepared raw short MIDI AAX effect and auxiliary mapping

Opted-in native main and multibus effects combine complete short MIDI, queued scalar/state intent, native transport and both prepared auxiliary directions under one AUDIO admission token.

Limits: Host planar f32, exact selected native32/internal64; input-only raw Context appends to preserved legacy prefixes, raw+generated compile refusal. At most1024 packets/frames and whole effective controls+MIDI capacity; complete node/header/packet and directional metadata/audio preflight before getter/state/dequeue/DSP. Raw scalar/restore SPSC publication remains accepted during getter/native DSP; stopped lifecycle/telemetry/timing require stop/join and serialized CONTROL. Both auxiliary source orders and valid in-place mapping are qualified. Dynamic candidates explicitly carry exact optional telemetry; Delay8 retains old history while pending, matching ACK/reconciliation allows zero-history Delay16 adoption, CONTROL retirement. Refusal/mismatch/native fault remain explicit; output narrowing occurs after authoritative DSP with no rollback. Local initialized SDK/module32/64 normal/fast evidence and maximum ordinary C++ heap counters, no Pro Tools/ACF host chain/signing/other-platform/deadline claim; SysEx/MIDI2/source ports/raw output remain outside scope.

Source: crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp.

Tests: tools/aax-validation/raw-routing.cpp, tools/aax-validation/registered-raw-routing.cpp, tools/aax-validation/RawRoutingFaultTables.hpp, tools/aax-validation/midi-telemetry.cpp, tools/aax-validation/check-rejected-profile.py.

Documentation: docs/aax-raw-routing.md, docs/decisions/0254-aax-raw-effects-auxiliary.md.

Explicit AAX generated short-MIDI output

Opt-in fixed-capacity native AAX owners preflight generated short messages and register SDK output nodes, with exact partial-delivery facts and guarded process admission.

Limits: Caller-owned external public SDK; default output capacity0/context identities unchanged, explicit main-only host-f32 generated instrument profile with selected native32/64 DSP with input field3/output4, no auxiliary generated output or host-native64 buffers. Fixed stage<=1024 packets/frames; canonical bounded ordered subset includes channel notes/pressure/pitch/bank/program, no arbitrary CC/system/SysEx/UMP/note-ID erasure. Whole input/map/control/native-output-capacity preflight before native apply/dequeue; admission CAS before SDK input getter through Post rejects nested/concurrent calls before mutation. CONTROL availability reads lock-free admission only, not AUDIO staging/diagnostics; ordinary SPSC producer contract remains separate and stopped lifecycle/diagnostic access required. Late encoding/refusal/throw cannot roll back native history/dequeued intent or previous SDK posts. Delivery consumed before first attempt, no replay; hasStatus iff a call returned and retains last actual returned SDK status even after later throw. Native status, local failure and SDK attempted/returned/posted counts distinct; native fault fails closed, delivery fault preserves native preparation. Actual initialized registered Rust NoteRouting consumer and normal/fast native/default-reference/heap/concurrent-control receipts only. No packaged generated reference consumer, Pro Tools/PACE/physical MIDI/arbitrary routes/voice-identity/host-deadline/other-platform claim.

Source: crates/ravet-native/include/RavetAaxMidiOutput.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/midi-output.cpp, tools/aax-validation/generated-model.cpp, tools/aax-validation/processor.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-generated-midi.md, docs/aax.md, docs/decisions/0226-aax-generated-short-midi-output.md, docs/aax-precision.md.

Native silent note-routing reference

A separate exported native32/64 note producer scales Level and preserves bounded canonical note routing with explicit exact channel/key release lowering and complete state.

Limits: Existing bus-routing-native package, main no-input mono/stereo silent f32/f64, Level only/default1, RAVETNTE/version1/24-byte codec, distinct exact typed audio/cache/state origins. No voices/synthesis/bypass/auxiliary output events/physical clock. Prepared output capacity must be supplied even when actual burst0/1; transient saturating u64 frame counter resets on prepare/reset and survives recall. Explicit no-ID channel/key scoped release becomes Off; IDs and wildcard scopes reject rather than losing identity. Direct zero-On stays On, SDK zero-On input lowers release; positive encoder velocity minimum1 and nearest half-up. Actual Rust/native and initialized generated AAX model evidence, AAX adopts32 only; no separately packaged output-enabled plug-in/Pro Tools/physical host/deadline claim.

Source: examples/bus-routing-native/src/note.rs, examples/bus-routing-native/src/lib.rs, examples/bus-routing-native/include/RavetNoteRouting.h.

Tests: examples/bus-routing-native/src/note.rs, tools/aax-validation/generated-model.cpp, tools/aax-validation/midi-output.cpp.

Documentation: docs/aax-generated-midi.md, docs/decisions/0226-aax-generated-short-midi-output.md.

Portable native main, detector and monitor routing reference

Paired f32/f64 native processor/schema/cache/audio-state/codec/telemetry exports provide mono/stereo main gain/bypass and mono detector-to-mono/stereo auxiliary monitor processing.

Limits: Matching mono/stereo main plus exactlyone mono input-only detector andone mono/stereo output-only monitor in either source order; no arbitrary graph or instrument voices/generated events. Gain1=0..4/default1,Bypass2=0/1/default0;32byteRAVETBUS/version1 complete global state. Unsanitized sample pass-through and timed physical controls. Transient exact saturatingu64frame telemetry resets on prepare/reset and survives complete parameter recall; finite value0/hints0..1 plus exact samples sidecar, no clock/persisted state/automatic host publication. Five public Rust tests/warning lint/docs and actual eight-profile registered SDK/native composition pass; AAX selects32only. Public nativeGain26/Performance4/stock14 and packaging gates pass; combined workspace acceptance follows source adoption, no device/DAW/platform/deadline claim.

Source: examples/bus-routing-native/Cargo.toml, examples/bus-routing-native/src/lib.rs, examples/bus-routing-native/include/RavetBusRouting.h.

Tests: examples/bus-routing-native/src/lib.rs, tools/aax-validation/multibus.cpp.

Documentation: docs/aax-bus-mapping.md, docs/decisions/0222-aax-prepared-native-bus-mapping.md.

Native32/64 raw routing and delay consumers

Distinct RawBusRouting and RawDelayRouting exports share authoritative routing/FIFO kernels, observe exact canonical raw MIDI and consume complete two-global state, native transport and stopped telemetry.

Limits: Mono/stereo main alone or detector-input/monitor-output auxiliary pair in either source order; fixed Delay8/16 main. Gain/Level and Bypass affect existing kernels; raw wire has no implicit parameter binding. Exact selected32/64 core/schema/cache/audio/state/telemetry exports; RAVETRBS/RAVETRDL version1, two globals,10 transient telemetry fields. All123 defined statuses including standalone canonical F7, zero-frame offset0 events/controls without frame advancement; meaningful native64 resolution, late malformed/capacity/history and legacy strict-policy evidence. No SysEx inference, source-port metadata, arbitrary bus arrangements or deadline claim.

Source: examples/bus-routing-native/src/lib.rs, examples/bus-routing-native/src/raw.rs, examples/bus-routing-native/src/delay.rs, examples/bus-routing-native/include/RavetRawRouting.h.

Tests: examples/bus-routing-native/src/raw.rs, tools/aax-validation/raw-routing.cpp, tools/aax-validation/registered-raw-routing.cpp.

Documentation: docs/aax-raw-routing.md, docs/decisions/0254-aax-raw-effects-auxiliary.md.

Local raw main/auxiliary/timing AAX reference bundle

Six owned initialized AAX factories demonstrate reusable main, both auxiliary orders and raw+dynamic-latency consumption in separately selectable native32/internal64 local bundles.

Limits: org.ravet.rawrouting mono/stereo/main/aux/timed exact identities, one LocalInput node/mask0xffff, detector sidechain plus monitor auxiliary registration in prepared source order. Authored zero-class external-wrapper bootstrap, owned callbacks only; no stock algorithm mapping. Separate raw-routing/raw-routing64 bundles with notices, required exports/version, strictly verified local ad-hoc signature and actual normal/fast registered validators. Production CMake5 tests each includes maintained raw-generated refusal. Native-only/headless selection; no editor/AudioSuite/installation/production signing/Pro Tools/other-platform support. Generic reusable capability and local consumer remain separate from broader original format completion criteria.

Source: examples/raw-routing-aax/CMakeLists.txt, examples/raw-routing-aax/RawRoutingParameters.hpp, examples/raw-routing-aax/bootstrap.cpp, examples/raw-routing-aax/description.cpp, examples/raw-routing-aax/native-registration.cpp, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/registered-raw-routing.cpp, tools/aax-validation/RawRoutingRegistrationFixture.hpp, tools/aax-validation/check-bundle.py, scripts/tests/test_aax_bundle.py.

Documentation: examples/raw-routing-aax/README.md, docs/aax-raw-routing.md, docs/decisions/0254-aax-raw-effects-auxiliary.md.

Native AAX parameter schema and control adoption

External-SDK C++17 immutable native parameter metadata, staged SDK object ownership and exact-identity registered Gain control adoption.

Limits: Control-only f32 parameter scalar semantics with default32/explicit64 metadata provenance; this stock profile has host-f32 audio. The separately authored native owner can select internal native64 DSP. Exact p-uppercase-hex native IDs, bounded UTF8 text and cached physical display, read-only owned setter enforcement, actual SDK manager allocation recovery and retained shared display lifetime. Registration forwards original SDK statuses with exact mono/stereo effect identity; stock aggregate last-variant status may mask earlier refusal. SDK setter/notification sideeffects have no rollback. Actual registered factory/algorithm validates1024-frame Gain/bypass after explicit offline/realtime reprepare; ordinary initial stock mono remains rejected/silent while stereo renders. Uninitialize rejects stale callbacks before object retirement and fresh initialization readopts. Helper normal/fast-math and100000 allocation-counted cycles, actual module/CMake3validators and4Python packaging checks pass locally. This remains the explicit stock schema/control regression; the separate authored native-processing record now covers default checked initial mono/stereo lifecycle and complete global state. Programs/aux/MIDI/transport/instrument/editor/latency/tail and real ProTools/AudioSuite/PACE/deadline/other-platform evidence remain separate.

Source: crates/ravet-native/include/RavetAaxParameters.hpp, crates/ravet-native/include/RavetAaxFactoryRegistration.hpp, examples/gain-aax/GainParameters.hpp, examples/gain-aax/registration.cpp, examples/gain-aax/native-parameters.cmake, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/parameters.cpp, tools/aax-validation/registered.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax.md, docs/decisions/0209-aax-native-schema-control.md, docs/aax-precision.md.

Checked owned native AAX processing and global state

An authored external-SDK AAX_CEffectParameters model owns exact native processor/schema/state companions, checked initial main-bus preparation, bounded block-start control intent and complete native chunks; the default public Gain factories consume it.

Limits: Main planar host-f32 matched mono/stereo, 1..1024 frames and writable global parameters only; native table/cache/codec precision and callback provenance must match exactly. Up to1024 parameters/8208 state bytes; power-of-two SPSC slots2..1024, default32/capacity31. CONTROL serializes SDK, codec and stopped lifecycle; one AUDIO consumer owns prepared DSP, stop/join before retirement. Known whole buffer/control/state faults preflight before queue/DSP mutation; supported rejected outputs silence prefixes and preserve tails. Provider failures fail-close readiness; exact stopped native lifecycle status is distinct from atomic latest AUDIO status retained through the void SDK algorithm. Accepted intent and complete queued-before-render state survive reset/reprepare; local RvS1 including bypass changes the prototype stock chunk, with no released-session/legacy compatibility claim. SDK foreign notifications/partial exceptional mutations have no rollback; some public void SDK wrappers erase delegate statuses. Trusted live pointer/table/library ranges remain caller obligations, no isolation/global allocation bound. Actual registered factory→SDK Initialize→ordinary first realtime mono/stereo1024, complete state, status, retirement/fresh initialization pass in the normal local macOS arm64 package; 18 native and14 preserved-stock CMake contracts, both actual bundle probes and8 Python packaging tests pass. Normal/fast-math helper/model fixtures and10000 allocation-counted C++ prepared cycles are separate from actual module/whole-SDK and existing Rust allocation evidence. Separate records cover explicit short-note instrument, transport, auxiliary buses, timing, generated output, optional editor and internal native32/64 selection. The default Gain remains main-only/headless; no default programs/AudioSuite mapping, Pro Tools/PACE production signing/other-platform/deadline claim.

Source: crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, crates/ravet-native/include/RavetAaxParameters.hpp, examples/gain-aax/GainNativeParameters.hpp, examples/gain-aax/native-registration.cpp, examples/gain-aax/native-owner.cmake, examples/gain-vst3/CMakeLists.txt, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/processor.cpp, tools/aax-validation/model.cpp, tools/aax-validation/registered-native.cpp, tools/aax-validation/ControllerHost.hpp, tools/aax-validation/FaultTables.hpp, tools/aax-validation/check-bundle.py, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax.md, docs/decisions/0213-aax-checked-native-lifecycle.md, docs/aax-precision.md.

Explicit native precision behind AAX float audio

An external-SDK owner explicitly selects exact native32/64 processor/cache/state companions; the prepared64 bridge captures host-f32 inputs, runs the authoritative native DSP once and validates whole output narrowing before host samples or generated MIDI publication.

Limits: AAX host buffers remain planar f32; default32 direct path, f32 parameter/state scalars and public Context/descriptor/parameter identities preserved. Selected64 owners/models must be heap-resident for fixed 1 MiB CONTROL-created sample scratch; at most 9 buses/64 total channels per direction/1024 frames. Whole map/MIDI/effective-queue/transport/input capture preflights before native state/history; cross input/output alias safe, partial output overlap rejected. Exact finite IEEE widening, quiet NaNs/Inf/signed zero and software nearest-even finite narrowing/gradual underflow independent of fenv/fast-math; no blanket finite audio filter. Finite rounded output overflow is after DSP/queue consumption: whole supported output silence/tails, no partial audio/generated publication, readiness poison and no history rollback. Untimed stopped complete prepare may recover accepted intent; timed sticky faults retain Faulted through CONTROL old-slot retirement and require a fresh host-reconciled instance. Original state/process returned codes, attempt/return/consumption/transfer flags and local conversion/exception faults separate; lock-free last actually returned native DSP code retained through void algorithm, later local failure or throw. Native ABI remains nonthrowing; defensive C++ fixture containment does not authorize C/Rust unwinding. Explicit --internal-precision32/64 for native Gain/Performance/optional Gain editor, separate64 paths, stock64 early rejection. Canonical actual Rust Gain/BusRouting/Performance/NoteRouting/Delay8/16 and initialized SDK/editor composition, analytic phase/history, late fault/status, maximum prepared zero ordinary-C++ allocation and actual selected64 local package probes pass. Selected64 Gain48/editor 51/Performance 4 and default32 Gain 32/editor 35/Performance 4/stock 14 CMake plus actual packaged module contracts and 12 Python pipeline tests pass with canonical public Rust archives; public adoption/joint qualification remain separately tracked. Exclusive AUDIO, existing SPSC/control/stopped lifecycle and live foreign table/context/range/refcount ownership remain caller obligations. No host-native64 buffers, full short-MIDI/SysEx/UMP input, auxiliary generated output, production signing/Pro Tools/other-platform/foreign-global allocation or deadline claim.

Source: crates/ravet-native/include/RavetAaxPrecision.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, crates/ravet-native/include/RavetAaxWebEditor.hpp, examples/gain-aax/GainNativeParameters.hpp, examples/gain-aax/GainNativeEditor.hpp, examples/performance-aax/PerformanceParameters.hpp, examples/gain-aax/native-precision.cmake, examples/gain-vst3/CMakeLists.txt, examples/performance-aax/CMakeLists.txt, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/precision/precision.cpp, tools/aax-validation/precision/owner.cpp, tools/aax-validation/precision/model.cpp, tools/aax-validation/precision/multibus.cpp, tools/aax-validation/precision/generated.cpp, tools/aax-validation/precision/timing.cpp, tools/aax-validation/precision/faults.cpp, tools/aax-validation/precision/maximum.cpp, tools/aax-validation/instrument-model.cpp, tools/aax-validation/registered-native.cpp, tools/aax-validation/registered-instrument.cpp, tools/aax-validation/editor.mm, tools/aax-validation/editor-registered.mm, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-precision.md, docs/aax.md, docs/aax-bus-mapping.md, docs/aax-generated-midi.md, docs/aax-timing.md, docs/aax-native-editor.md, docs/decisions/0240-aax-native-precision.md.

Bounded native AAX short-note instrument adoption

An external-SDK whole-stream short-note collector and explicit native AAX instrument owner validate timed MIDI before state/queue/DSP transfer; the public Performance instrument consumes them through actual registered SDK factories.

Limits: Input None, mono/stereo main planar f32, frames<=1024, raw packets<=1024 and combined effective trailing global controls+notes<=1024. Positive NoteOn velocity exact widened f32 byte/127; velocityzero scoped channel+key Off, no invented identity. Defined short non-notes validate then omit; running status/undefined statuses/SysEx including SDK fragments/zero or long payload reject. Boolean immediate never overrides ordered relative timestamps. No fabricated bypass; actual originating audio-state cache/codec provenance required. Whole map/MIDI/capacity precedes applyState/dequeue, controls0 precede same-frame notes. Null node/stream malformed, valid empty stream renders; zero frames with queued intent/notes reject. Known late faults retain voice history/accepted Level and silence supported prefixes/tails, protect borrowed metadata; original provider AUDIO status/fail-closed lifecycle retained. CONTROL serializes proxy/codec/lifecycle, exclusive AUDIO and stop/join retirement; trusted foreign node/context/storage capacities and bounded stack remain caller obligations. Local strict normal/fast helpers/model, actual registered factory/Initialize/MIDI algorithm and4 CMake contracts plus8 Python packaging tests pass;10000 maximum collector and2000 prepared instrument cycles count no C++ heap, separate from Rust/whole-SDK allocation/fast-math/deadline evidence. Separate explicit transport adoption has its own record. No aux/f64/UMP/SysEx/controllers/expression/programs/generated output/latency-tail/editor/AudioSuite/Pro Tools/PACE/other-platform/released-session claim.

Source: crates/ravet-native/include/RavetAaxNoteInput.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/performance-aax/PerformanceParameters.hpp, examples/performance-aax/native-registration.cpp, examples/performance-aax/CMakeLists.txt, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/note-input.cpp, tools/aax-validation/instrument-model.cpp, tools/aax-validation/registered-instrument.cpp, tools/aax-validation/check-bundle.py, scripts/tests/test_aax_bundle.py.

Documentation: docs/performance-aax.md, docs/aax.md, docs/decisions/0218-aax-native-short-note-instrument.md.

Prepared AAX complete short MIDI input

Explicit raw instrument policy preflights every defined complete MIDI1 short message into canonical native events, with whole combined command capacity and AUDIO admission before SDK getters.

Limits: At most1024 packets/frames; raw-only zero-frame offset0 events/queued controls apply without phase/sample advance, existing default empty-only policy retained; source order and exact1..3-byte payloads. Standalone F7 only means canonical EndOfExclusive; no SysEx inference, running status or UMP. Explicit input-only instrument Context; Gain/Performance note defaults unchanged. Raw serialized SPSC scalar/restore/request controls remain accepted during AUDIO; stopped lifecycle still requires stop/join. Raw+generated is a compile-time refusal. Last returned native status and admitted-block flags distinguish Preflight/Busy/Exception; initial numeric1 has no has-returned bit and lifecycle does not reset it. Distinct getter/DSP publication and C++ TSan1000-publication evidence; Rust uninstrumented. Production Clang21 raw+transport model/owner/collector partial static-frame estimates about169KiB, not runtime stack/upper bound, other builds/small stacks unqualified. Late preflight faults preserve state/dequeue/history; internal64 output overflow retains its separate nonrollback contract. Actual registered mono/stereo macOS native32/64 references, no Pro Tools/other-platform/deadline claim.

Source: crates/ravet-native/include/RavetAaxNoteInput.hpp, crates/ravet-native/include/RavetAaxShortMidiInput.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp.

Tests: tools/aax-validation/short-midi.cpp, tools/aax-validation/registered-midi.cpp, tools/aax-validation/midi-telemetry.cpp, tools/aax-validation/check-rejected-profile.py, tools/aax-validation/reject-raw-generated.cpp.

Documentation: docs/aax-short-midi.md, docs/decisions/0247-aax-short-midi-input.md.

Optional native AAX stopped telemetry composition

AAX native owners compose exact core/precision telemetry caches after whole CONTROL preflight and expose explicit stopped snapshots with output-range protection.

Limits: 1024-field ceiling; caller stop/join ownership; admission checks detect already entered callbacks but do not exclude later AUDIO admission. Actual short/long capacity and known model/owner output aliases qualified. No automatic publication, host/UI reflection or telemetry session codec. Timing candidates do not inherit companions. Invalid metadata/copied origin rejects before schema/resource mutation; null/violating throw acquisition balances owned schema/client caches. Native ABI remains nonthrowing. Actual32/64 local component evidence, no DAW/deadline support.

Source: crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp.

Tests: tools/aax-validation/midi-telemetry.cpp, tools/aax-validation/registered-midi.cpp.

Documentation: docs/aax-short-midi.md, docs/native-client-acquisition.md, docs/decisions/0247-aax-short-midi-input.md.

Native Performance AAX instrument reference

Distinct public mono/stereo AAX factories register a sixteen-voice no-input host-f32 Performance instrument with explicit internal native32/64 selection with timed short MIDI notes, complete accepted Level intent and explicit local bundle packaging.

Limits: Software-generator category, LocalInput MIDI mask0xffff, no host bypass/multi-mono/AudioSuite; Level ID1 range0..1 default0.2, complete native RvS1 productRAVETPS/version1/24bytes. Voices/performance transient, no completion output requested. New reference IDs remain distinct from Gain and are not commercial allocation/session compatibility. Explicit --plugin performance requires native profile; default Gain/native and explicit stock paths preserved. Self-contained local macOS arm64 package uses external SDKs/notices/ad-hoc signing; actual factory→SDK Initialize(None input)→timed analytic audio, Level state, malformed input/silence/tails, independent late-fault voice-phase oracle and retirement pass locally. No general Pro Tools/production PACE/other-platform/deadline support or aux/host-native64-buffers/controller-expression/UMP/SysEx/program/generated MIDI/latency-tail/editor/AudioSuite claim. Explicit transport adoption is recorded separately.

Source: examples/performance-aax/PerformanceParameters.hpp, examples/performance-aax/native-registration.cpp, examples/performance-aax/description.cpp, examples/performance-aax/CMakeLists.txt, examples/performance-native/src/lib.rs, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/registered-instrument.cpp, tools/aax-validation/instrument-model.cpp, tools/aax-validation/note-input.cpp, tools/aax-validation/check-bundle.py, scripts/tests/test_aax_bundle.py.

Documentation: docs/performance-aax.md, docs/aax.md, docs/decisions/0218-aax-native-short-note-instrument.md, docs/aax-precision.md.

Local AAX-only raw MIDI sine bundle

Separate mono/stereo owned AAX factories consume raw MIDI with complete Level state, initialized transport and optional stopped telemetry in native32 or internal64 behind hostf32.

Limits: Distinct org.ravet.midisine.mono/stereo identities, LocalInput mask0xffff; no bypass/editor/AudioSuite. Only owned AAX callback creation is supported; proprietary ACF host registration chain remains unvalidated. Required external-wrapper bootstrap exposes zero VST3 classes and actual startup/descriptor/class-count/registered Process/shutdown is tested. Separate local midi/midi64 bundles include notices/strictly verified ad-hoc signature/export-version/actual-component validation plus maintained raw-generated compile refusal; shared ordinary Performance exports are present, no exclusive export-set claim; no installation, production signing or Pro Tools/other-platform/deadline claim. Stock/editor selections reject before commands.

Source: examples/midi-aax/CMakeLists.txt, examples/midi-aax/MidiParameters.hpp, examples/midi-aax/bootstrap.cpp, examples/midi-aax/description.cpp, examples/midi-aax/native-registration.cpp, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/registered-midi.cpp, tools/aax-validation/check-bundle.py, tools/aax-validation/check-rejected-profile.py, tools/aax-validation/reject-raw-generated.cpp, scripts/tests/test_aax_bundle.py.

Documentation: examples/midi-aax/README.md, docs/aax-short-midi.md, docs/decisions/0247-aax-short-midi-input.md.

Checked AAX initial and acknowledged dynamic timing

An optional two-core prepared owner validates initial native/host latency and adopts a complete matching-state replacement only after eligible host acknowledgement.

Limits: External separately licensed SDK; local initialized SDK/module fixtures only. Default disabled, mono/stereo main host-f32 with selected internal native32/64 DSP, no instrument/aux/transport/generated-output combination. CONTROL prepares exact matching schema/state/audio-cache origin before host request; caller reconciles a fresh eligible 24-bit acknowledgement and exact getter before AUDIO. Getter/request success alone is not acknowledgement; bounded nonwrapping notices. Whole callback preflight precedes adoption; current globals, queued complete recall and trailing controls retain their order. Replacement FIFO starts zero, no history migration/crossfade. Original request/getter/native refusal and exceptions remain distinct; possibly changed compensation fails closed without old-delay fallback. Sticky timing faults survive old-slot retirement and reject same-owner prepare/reset/reinitialization before foreign calls; recovery requires a new owner with known matching host compensation/profile. CONTROL retirement waits final old access; native tail diagnostic only. Atomic availability does not replace joined lifecycle obligations. No Pro Tools, PACE signing, arbitrary scheduling, other-platform, hardware or deadline support.

Source: crates/ravet-native/include/RavetAaxTiming.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/timing-model.cpp, tools/aax-validation/TimingControllerHost.hpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-timing.md, docs/decisions/0230-aax-prepared-timing.md, docs/aax-precision.md.

Initialized native AAX transport capture

An external-SDK output-last collector borrows initialized versioned transport proxies, preserves independent getter availability and raw positions, and forwards checked native transport before pending state or DSP.

Limits: Explicit CaptureTransport=false reusable default; native Gain and Performance opt in, stock unchanged. At most one playing/tempo/meter/ticks/divisor/configured-loop query per callback; sample location only after known playing=true. Original returned SDK statuses, attempted/returned/available masks and local fault/getter remain distinct. Positive finite tempo, meter1..65535, positive u32 tick divisor and ordered raw active loop; full signed-i64 samples/ticks/endpoints exact sidecars, explicitly rounded f64 PPQ with collapsed loop rejection. Independent getter errors remove their fields; successful malformed/throw projection rejects whole output before applyState/dequeue/DSP, retains old capture and pending intent/history, silences supported prefixes/tails. Map/MIDI/capacity preflight precedes collection; stopped joined diagnostics describe latest collection attempt, atomic process status separate. Unknown recording/discontinuity/preroll DETAILS flags remain zero/default; configured looping is not guaranteed execution or Loop Record, no host tuple coherence. Helpers fixed stack/storage with10000 zero C++ new/delete capture cycles, actual Rust transport validation and initialized SDK proxy/native Gain smoothing/Performance voice-phase fault oracles pass locally; normal public native Gain22/Performance4/stock14 contracts, all three bundle export/version/registered algorithm probes and8Python packaging tests pass locally. Trusted typed SDK output writes, lifetime/thread/ranges/foreign allocation/blocking remain caller obligations; no timeline selection/timecode/bar/reset/extrapolation/latency compensation, production PACE/Pro Tools/other-platform/whole-SDK fast-math/global-memory/deadline claim.

Source: crates/ravet-native/include/RavetAaxTransport.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/gain-aax/GainNativeParameters.hpp, examples/performance-aax/PerformanceParameters.hpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/transport.cpp, tools/aax-validation/transport-model.cpp, tools/aax-validation/TransportControllerHost.hpp, tools/aax-validation/registered-native.cpp, tools/aax-validation/registered-instrument.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-transport.md, docs/aax.md, docs/performance-aax.md, docs/decisions/0219-aax-native-transport-capture.md.

Prepared native AAX host meter publication

Reusable external-SDK preparation/registration and the native AAX owner/model compose explicit exact-origin telemetry bindings with complete host tap preflight and staged whole snapshot publication.

Limits: Opt-in1..64 host-f32 taps/1..1024 native telemetry fields; zero preserves legacy Contexts/defaults. CONTROL fully copies metadata and retires one unavoidable temporary cache before other resources; exact core/sample/companion origin, retained descriptor strings/IDs and compliant nonthrowing SDK/native ABI required. UnitClamp or deterministic IEEE FiniteFloat projection, no inferred dB/decay/clipped flag. Whole known owner/context/frame/node/pointer-array/audio ranges before getters/history; caller foreign extent/lifetime/stop-join remain explicit. Post-DSP snapshot/projection refusal preserves old taps and successful audio without native history rollback; original returned DSP/state/snapshot/SDK codes separate from unreturned exceptions and numeric1 sentinel. Meter-only/raw SPSC controls preserved, inherited timing/generated restrictions retained. Explicit compatible candidate telemetry and original metadata diagnostics before ACK-controlled dynamic adoption/CONTROL retirement. Isolated32/64 actual SDK Gain/instrument/raw/aux/timing and normal/fast maximum64-tap10000 ordinary-C++heap-free cycles; dependency/public/shared acceptance pending, no Rust/host allocation/deadline guarantee. Metered generated-output/editor composition remains syntax-only/no distributed reference. No Pro Tools/production signing/distribution/other platform claim.

Source: crates/ravet-native/include/RavetAaxMeters.hpp, crates/ravet-native/include/RavetAaxMeterRegistration.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp.

Tests: tools/aax-validation/meters.cpp, tools/aax-validation/meter-composition.cpp, tools/aax-validation/registered-meters.cpp, tools/aax-validation/MeterControllerHost.hpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-meters.md, docs/decisions/0262-aax-native-metering.md.

Reusable VST3 controller schema registration

An optional external-SDK C++17 helper preflights complete bounded native global metadata, registers root-unit SDK parameters and delegates control mapping to native linear/log/discrete ranges.

Limits: Control-only <=1024 descriptors; external VST3 SDK and exact retained native table/library. Reject reserved UINT32_MAX IDs, duplicate/conflicting IDs, invalid boolean bypass and titles >127 UTF16 units; complete UTF8 conversion without clipping. Global physical f32 and SDK numeric formatting precision, no custom choice labels/groups. Metadata preflight rejection preserves container; SDK allocation/insertion exceptions have no transaction guarantee. No audio automation/state/factory/editor/notification/scheduling or additional host/platform/deadline claim; executed contracts recorded separately.

Source: crates/ravet-native/include/RavetVst3Parameters.hpp, examples/gain-vst3/src/gain.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/schema.cpp, tools/vst3-validation/contracts.cpp.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0148-vst3-native-schema-registration.md.

Control-cached native global parameter mapping

An immutable control-prepared schema cache provides concurrent provider-free metadata/range reads and atomic bounded normalized-to-physical tagged event conversion; a separate paired native table retains existing ABI layouts.

Limits: <=1024 descriptors/events/output capacity and <=65536 frames; global normalized/physical f32, f64 normalized intent explicitly narrowed. Cached binary ID lookup, all u32 IDs, native UTF8 255/63 limits; roles do not implicitly filter. Create/drop/providers on control, retire after all borrowers stop and retain exact table/cache/precision/library/static schema. Cached callbacks no heap/locks/I/O/DSP/providers; failed outputs unchanged. Unknown IDs/out-of-range/nonfinite/timing/capacity reject whole conversion, consumer explicitly routes/filters. No scoped modulation/f64 parameter persistence, automatic host queues/SDK registration/notifications/scheduling or additional platform/DAW/deadline claim.

Source: crates/ravet-native/src/parameter_cache.rs, crates/ravet-native/include/RavetCachedParameters.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/parameter_cache.rs, tools/native-validation/cached_parameters.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/decisions/0151-native-cached-parameter-mapping.md.

Explicit native audio-owner complete state

An optional cache-paired companion applies fully validated physical global state and captures reordered complete snapshots on exclusively prepared native processors without control codecs or providers.

Limits: At most 1024 physical f32 fields/capacity; exact processor/cache/table/precision/library pairing and live aligned disjoint ranges are caller duties. Hooks require atomic failed restore and no heap actions, blocking or I/O. Panic shares DSP poison until fresh stopped prepare. Direct callbacks require no 64-bit atomics; live publication remains independently gated. No automatic generations/publication/scheduling/notifications/retry, consumer panic rollback, scoped/modulation/voice state, SDK factories or DAW/deadline claim. Repeated recall may restart smoothing; mixing protocols is explicit consumer policy.

Source: crates/ravet-native/src/audio_state.rs, crates/ravet-native/src/parameters.rs, crates/ravet-native/include/RavetNativeAudioState.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/audio_state.rs, tools/native-validation/audio_state_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/parameters.md, docs/decisions/0155-native-direct-audio-state.md.

Explicit prepared native telemetry

A separate consumer-selected native companion caches stable-ID readout metadata and revalidates complete physical f64 observations with exact u64 windows on exclusively prepared processors; Gain exposes its existing 12 meter fields.

Limits: At most 1024 descriptors/capacity with UTF-8 names255/units63, finite ordered display hints and known nonfinite-input flag. Raw finite f64 values preserve extremes/subnormals/signed zero and may exceed display hints. Exact cache/processor/table/precision/library and live aligned disjoint foreign ranges are caller obligations. Hook obeys no heap/blocking/I/O; snapshot panic shares DSP poison until fresh stopped prepare. No atomics required, implicit cross-thread observation/publication/UI-host scheduling, persistence/automation/events/clear, consumer panic rollback or DAW/deadline claim. Measurement/window/reset/retention and SDK display policy belong to consumers.

Source: crates/ravet-native/src/telemetry.rs, crates/ravet-native/include/RavetNativeTelemetry.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/telemetry.rs, tools/native-validation/telemetry_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/parameters.md, docs/decisions/0156-native-prepared-telemetry.md.

Reusable native C++ client and SDK reference adoption

An SDK-independent C++17 owner composes native lifecycle, optional explicit state and telemetry caches; the Gain VST3 processor consumes it with tagged events and retained controller/program/editor protocols.

Limits: Exact v1 shapes/required callbacks/precision/counts/originating core addresses; control acquisition/preparation/retirement, exclusive DSP callbacks and shared cached metadata. Selected state and telemetry companions require the exact supplied core pointer; byte-identical copied core tables reject before any resource creator. Violating CONTROL acquisition/query exceptions balance already acquired resources; native ABI/destruction remain nonthrowing obligations, with no arbitrary foreign-code authentication. Exact types/library and live aligned disjoint ranges remain caller duties. No copy/move, fallback, hidden state/mailbox/codecs, automatic publication/scheduling/retry, generic SDK factories/editor/buses, performance/scoped/transport/generated-event mapping or DAW/deadline/platform/signing claim. Native callback poison/result/silence semantics and consumer 31-bit generation/measurement/display policies remain explicit.

Source: crates/ravet-native/include/RavetNativeClient.hpp, examples/gain-vst3/src/gain.cpp.

Tests: tools/native-validation/client.cpp, tools/vst3-validation/contracts.cpp, tools/vst3-validation/editor.cpp, tools/vst3-validation/programs.cpp.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0157-native-cpp-client.md.

Exact native client origin and balanced acquisition

C++ native client admits exact originating state/telemetry core tables with whole CONTROL preflight and balanced partial acquisition.

Limits: C++ behavior change rejects callback-equivalent copied core tables; trusted library/table lifetimes and nonthrowing native ABI remain caller obligations. CONTROL acquisition exception cleanup is defensive only. Existing Gain32/64 actual archive normal/fast tests are local, not DAW/device/deadline validation. Public rebuild/format qualification pending.

Source: crates/ravet-native/include/RavetNativeClient.hpp.

Tests: tools/native-validation/client-companions.cpp, tools/native-validation/client-companions.cmake.

Documentation: docs/native-client-acquisition.md, docs/decisions/0250-native-client-acquisition.md.

Explicit VST3 block-start transport mapping

An external-SDK C++17 helper requests/maps canonical available sample/musical positions, tempo, signature and playback/details into native transport; Gain forwards it before pending state or processing.

Limits: Null means unknown. Finite positive SDK rate/tempo, finite advertised music/cycles, positive u16 signatures; exact i64/f64 and used signed zero preserved. Active ordered cycle bounds require known musical position for native v1; inactive/positionless bounds omitted with loop state retained. Bar start without exact bar number, system/continuous time, SMPTE/frame rate, clock/chord, increments/sample loops/discontinuity/pre-roll are unmapped. Unknown/unavailable/unmapped fields ignored; no invented availability/reset/extrapolation/rounding, transport-driven Gain DSP, DAW timeline/deadline/platform/signing claim. Live aligned context/output/library remain caller duties; normal framework mapping has no callbacks/heap/locks/I/O.

Source: crates/ravet-native/include/RavetVst3Transport.hpp, crates/ravet-native/include/RavetNativeScalars.hpp, examples/gain-vst3/src/gain.cpp.

Tests: tools/vst3-validation/transport.cpp, tools/vst3-validation/contracts.cpp, crates/ravet-native/tests/transport.rs.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0158-vst3-block-start-transport.md.

Explicit VST3 native performance input

An external-SDK C++17 helper maps selected-bus notes, poly pressure and six standard note expressions into canonical native records after complete bounded event-list validation.

Limits: At most1024 raw/expanded events and65536 frames; ordered offsets/ties/zero-frame rules, single getter reads,56KiB bounded stack scratch. SDK int32 IDs preserve all bits except absent-1; unquantized f32 velocity, cents to semitone tuning expansion, normalized volume4/tuning240(x-.5), exact other f64 expression values. Unknown expressions reject by default or explicitly filter after scalar/ID validation; other selected SDK types reject. Nonselected payloads filter after header/timing/order validation. Optional length/ppq/flags unrepresented; no voice matching, SDK instrument export/controller advertisement, output event delivery, SysEx/text/int expressions or DAW/deadline/platform claim. Visitor refusal retains its prior effects; stage privately before DSP/state/host publication.

Source: crates/ravet-native/include/RavetVst3PerformanceInput.hpp, crates/ravet-native/include/RavetNativeScalars.hpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/performance_input.cpp, crates/ravet-native/tests/events.rs.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0160-vst3-performance-input.md.

Explicit VST3 native performance output

An external-SDK C++17 helper maps representable canonical native notes and expressions into selected-bus SDK output, preflighting the complete stream and reporting exact host-prefix refusal.

Limits: At most1024 records/65536 frames; bounded1024-SDK-event stack scratch, ordered offsets/ties/zero-frame rules. Concrete/scoped-concrete Off and pressure require exact widened f32; standard expressions require ID-only scope, all int32 identity bits except reserved-1. Volume/4 is exact or rejects subnormal rounding/underflow; tuning/240+.5 is explicit floating unit arithmetic with possible rounding. No wildcard/precision loss, choke/end masquerade, implicit MIDI/UMP/SysEx/parameters/text/int conversion or inferred ppq/flags/length. Whole invalid output rejects before host calls; refusal retains accepted prefix/DSP and discards suffix without rollback/replay/retry. Gain has no performance output and does not adopt helper; no SDK instrument/DAW/deadline/platform claim.

Source: crates/ravet-native/include/RavetVst3PerformanceOutput.hpp, crates/ravet-native/include/RavetNativeScalars.hpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/performance_output.cpp, crates/ravet-native/tests/events.rs.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0161-vst3-performance-output.md.

Prepared VST3 native audio bus mapping

An external-SDK C++17 fixed profile maps logical native main/auxiliary buses into independent compact SDK directions at native f32/f64, with complete shape/range/output-overlap preflight and bounded fault silence; Gain adopts it.

Limits: Native config1..9 nonempty buses,0..64 channels per direction/576 total,1..65536 frames and up to 1024 events; failed control configure retains prior profile and does not prepare DSP. Fixed profile rejects host count/channel/precision mismatch; zero-frame fully omitted or exact metadata accepted, sample arrays ignored. Positive frames require all pointers even when silence flagged. Inputs may alias outputs across buses; output active ranges must be disjoint, aligned and nonoverflowing. Bounded sorted output ranges; no heap/locks/I/O in normal mapping. Foreign live metadata/array/sample ownership and writable metadata exclusions remain caller duty. Fault cleanup touches supported exact output shapes/frame/precision only, skips invalid sample pointers, retains tails and sets exact cleared flags. Generic SDK bus registration/speaker arrangements/factory/DAW/deadline/platform evidence remains separate; Gain retains mono/stereo effect layouts.

Source: crates/ravet-native/include/RavetVst3Audio.hpp, examples/gain-vst3/src/gain.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/audio.cpp, tools/vst3-validation/contracts.cpp, crates/ravet-native/tests/processing.rs.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0162-vst3-native-audio-buses.md.

Prepared VST3 cached global parameter input

Optional external-SDK helpers use precision-matched native caches and validate/copy all raw global queue points before a prepared visitor; Gain uses them for mapped automation with retained program expansion and stable merging.

Limits: Control creation/retirement, exact table/cache/library and borrowed host lifetime; <=1024 targets/queues/total points and <=65536 frames, <=16KiB raw scratch. Reserved/duplicate targets reject; explicit readonly/routing policy, global normalized f64 intent narrows to f32. Single point read, full raw/unknown value/timing/capacity validation before visitor, referenced-memory IEEE checks for fast-math. Visitor failure may retain private scratch effects; publish state/output/DSP only after success. No framework heap/providers/locks/I/O on cached/validation paths; host/visitor obligations remain. No continuous curve interpolation, gestures/scoped/performance/transport, generic factory/output/scheduling or additional host/platform/deadline claim.

Source: crates/ravet-native/include/RavetVst3ParameterInput.hpp, crates/ravet-native/include/RavetNativeScalars.hpp, examples/gain-vst3/src/gain.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/parameter_input.cpp, tools/vst3-validation/contracts.cpp, tools/vst3-validation/programs.cpp.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0154-vst3-cached-parameter-input.md.

Complete C-layout native event conversion

Version-one native records preserve every portable event kind with full identities/scoped f64 values, canonical fields and atomic bounded conversion into prepared storage; Gain shares the legacy global parameter decoder.

Limits: In-process native layout only, not wire/preset serialization or SDK registration. At most 1024 events; exact widened f32 scalars required for global controls/velocities. Consumers own endpoint routes, foreign ranges, storage, delivery/refusal, state and voice lifetime. No new DAW or deadline support claim.

Source: crates/ravet-native/src/event.rs, crates/ravet-native/include/RavetNativeEvent.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/events.rs, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp, examples/gain-native/src/lib.rs.

Documentation: docs/native-processing.md, docs/decisions/0143-native-event-records.md.

Exact C-layout native transport snapshots

Independent native availability/flags preserve exact block-start positions, tempo and extended transport while validating semantic dependencies and canonical fields without allocation.

Limits: In-process v1 record only; no wire serialization, fixed-point conversion, extrapolation or automatic reset. Finite beat/bar values and positive finite tempo, increment requires tempo, bar requires beats, active ordered loop bounds require their timeline, nonzero u16 signatures. Consumers decode before DSP and own foreign rejection/silence and SDK mapping. Direct typed adapter pass-through stays unchanged. No additional DAW/platform/deadline claim.

Source: crates/ravet-native/src/transport.rs, crates/ravet-native/include/RavetNativeTransport.h.

Tests: crates/ravet-native/tests/transport.rs, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/decisions/0144-native-transport-records.md.

Explicit CLAP discovery and trusted catalogues

Bounded explicit non-loading candidate scans and trusted native entry loading provide owned byte-preserving plugin metadata and live-instance library retention through Clack.

Limits: 32 directories/4096 entries/1024 candidates, 1024 plugins and bounded descriptor strings/features. No recursion/system scan, sandbox, signing check, crash timeout, automatic host callbacks/device/GUI or other formats. Native upstream Clack gain and RAVET gain/sine catalogue/state/three-block f32 lifecycles pass locally; broad compatibility pending.

Source: crates/ravet-host/Cargo.toml, crates/ravet-host/src/lib.rs, crates/ravet-host/examples/inspect.rs.

Tests: crates/ravet-host/tests/catalogue.rs, crates/ravet-host/src/lib.rs, crates/ravet-host/examples/inspect.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0046-explicit-clap-hosting.md.

Guarded trusted CLAP editor hosting

A main-thread instance-borrowing guard owns negotiated editor creation, embedded parent attachment, bounded resizing, idempotent show/hide and guaranteed paired destruction.

Limits: Embedded sizes 1..16384 per dimension; native parent attachment/transient lifetime is an explicit unsafe caller contract. No parent window creation/pump, host GUI request scheduling, focus/scale policy or device integration. Local Cocoa RAVET/upstream EGUI child/lifecycle fixtures pass; visual hide/accessibility, floating/other OS APIs and broad compatibility unvalidated.

Source: crates/ravet-host/src/editor.rs, tools/editor-smoke/examples/hosted.rs.

Tests: crates/ravet-host/tests/catalogue.rs, tools/editor-smoke/examples/hosted.rs, crates/ravet-host/tests/linked_sine.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0048-guarded-plugin-editors.md.

Explicit global parameter gesture boundaries

Typed stable-ID begin/end events cross parameter graph filters and complete worker queues, map to generated CLAP output and optionally map from hosted native graph output.

Limits: Raw boundaries only; no scalar state change, pairing/ownership/cancellation/recording policy. Hosted output requires explicit writable parameter mapping and opt-in; disabled/unmapped filters, read-only/offset/order/capacity rejects with nonrollback block failure. Zero-frame parameter flush permits offset zero. Shared graph 1024 and native slot limits; no native input translation, GUI scheduler, other-format or host automation-recording claim. Loaded public f32/f64 fixture macOS arm64 evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/output.rs, crates/ravet-graph/src/events.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-clap/tests/output.rs, crates/ravet-host/tests/graph_gestures.rs, crates/ravet-graph/tests/events.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-device/tests/graph_output.rs, crates/ravet-host/examples/gesture-fixture.rs, crates/ravet-host/examples/hosted-graph.rs.

Documentation: docs/parameters.md, docs/plugin-hosting.md, docs/decisions/0121-parameter-gesture-events.md.

Explicit CLAP parameter gesture input

Opt-in native begin/end translation and mapped hosted native input preserve raw boundaries alongside parameter values without automatic state edits or pairing.

Limits: Default ingress ignores native boundaries; default hosted input rejects portable boundaries. Explicit hosted writable input map required before activation; disabled/unknown input rejects before native mutation. Shared prepared capacities and process timing; flush ingress offsets normalize to zero, portable empty blocks require zero. No ownership/pairing/recording/GUI policy or new third-party/DAW/deadline claim; synthetic offline translator and linked native f32/f64 evidence only.

Source: crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/multi_bus.rs, crates/ravet-host/src/graph_parameters.rs, crates/ravet-host/src/graph_node.rs.

Tests: crates/ravet-clap/tests/gestures.rs, crates/ravet-host/tests/graph_gestures.rs, crates/ravet-host/examples/support/parameter_fixture.rs.

Documentation: docs/parameters.md, docs/plugin-hosting.md, docs/decisions/0130-parameter-gesture-input.md.

Explicit global parameter modulation signals

Finite signed physical modulation amounts remain separate from base values across graph filters/worker queues, opt-in CLAP input translation and generated global CLAP output.

Limits: Finite f32 physical amounts; no automatic base-value change, combination/clipping/smoothing/reset/persistence or per-note scope. CLAP input defaults to ignored modulation, explicitly enabled global amounts must narrow to finite f32; scoped events ignore, invalid whole input rejects before DSP, flush offsets normalize to zero. Output preserves representability preflight/host prefix refusal. No synthesized native metadata flags, reference plug-in support, native hosting/other-format/host/device/deadline claim. Existing graph/queue/bridge bounds apply.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/output.rs, crates/ravet-graph/src/events.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-foundation/tests/contracts.rs, crates/ravet-clap/tests/modulation.rs, crates/ravet-clap/tests/output.rs, crates/ravet-graph/tests/events.rs, crates/ravet-device/tests/graph_events.rs.

Documentation: docs/parameters.md, docs/extended-processing.md, docs/decisions/0122-global-parameter-modulation.md.

Mapped native global modulation in hosted nodes

Independent builder input/output opt-ins map finite global physical modulation through cached writable native modulatable identities, with reusable explicit CLAP metadata registration.

Limits: Explicit direction mappings, default disabled; 4096 native shared slots versus graph 1024 cap. Input finite f32 widens to f64 and unsupported targets reject before native mutation. Enabled global output requires writable modulatable metadata and finite f32 narrowing; disabled/unmapped/scoped filters, selected data/order/offset/capacity faults clear block with nonrollback BackendFailure. Scalar base range/step checks stay separate; zero-frame flush supported. No cookies/rescan/modulation matrix/per-note/other-format/crash isolation or host/device/deadline claim. Public synthetic f32/f64 macOS arm64 evidence only.

Source: crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/graph_parameters.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-clap/src/parameters.rs.

Tests: crates/ravet-host/tests/graph_modulation.rs, crates/ravet-host/examples/support/modulation_probe.rs, crates/ravet-host/examples/hosted-modulation.rs, crates/ravet-host/examples/modulation-fixture.rs, crates/ravet-clap/tests/parameters.rs.

Documentation: docs/parameters.md, docs/plugin-hosting.md, docs/decisions/0123-hosted-global-modulation.md.

Mapped scoped values and modulation in hosted CLAP graphs

Explicit mapped native graph directions validate cached scope metadata and preserve full f64 parameter values/modulation, selected input-port voice scope and zero-time flush separately from global state.

Limits: Selected CLAP note input endpoint plus explicit maps/nonzero shared capacities; writable input/output scoped metadata. Most-specific supplied ID/key/channel/port requires its corresponding automation/modulation flag, independently of global flags. Portable u32/native nonnegative i32; finite f64 values within native range/steps, signed finite modulation independent of base bounds/steps. Disabled/invalid input rejects whole prefix pre-native. Unknown IDs/unselected or wildcard ports filter; selected output metadata/scalar/timing/capacity faults discard complete portable output without native rollback. Raw exact all--1 alone is global; empty input cookies/owned private storage. Metadata changes require retirement/reprepare. No voice allocation/state migration/GUI/recording or third-party/DAW/deadline claim; linked offline f32/f64 fixture evidence only.

Source: crates/ravet-host/src/graph_parameter_scope.rs, crates/ravet-host/src/graph_parameters.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-host/src/graph_node.rs.

Tests: crates/ravet-host/src/graph_parameter_scope.rs, crates/ravet-host/tests/graph_scoped_parameters.rs, crates/ravet-host/examples/support/parameter_fixture.rs.

Documentation: docs/plugin-hosting.md, docs/parameters.md, docs/decisions/0138-hosted-scoped-parameters.md.

Explicit note identities in hosted CLAP graphs

Portable identified On/Off events and opt-in selected native CLAP routes preserve concrete note IDs, timing and velocity without inferred voice policy.

Limits: Portable u32 identities; native0..i32::MAX with explicitly selected CLAP note ports per enabled direction. Default input rejects, output filters specific IDs; wildcard native notes retain legacy events. Invalid input rejects whole prefix pre-native; selected raw native IDs<-1 reject rather than normalize. No identity-loss MIDI/MPE/UMP/generated-MIDI conversion, voice allocation/lifetime, choke/end/per-note parameter or new third-party/DAW/deadline claim. Offline portable/queue/unit and linked f32/f64 fixture evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-device/src/graph_events.rs, crates/ravet-clap/src/output.rs.

Tests: crates/ravet-foundation/tests/note_identity.rs, crates/ravet-graph/tests/events.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/tests/graph_notes.rs, crates/ravet-clap/tests/output.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/decisions/0132-native-note-identities.md.

Scoped standard note expressions in hosted CLAP graphs

Portable wildcard channel/key/ID targets and opt-in selected native routes preserve seven standard expression kinds with full f64 values.

Limits: Finite standard ranges; portable volume0..4, CLAP strictly positive0<x<=4 rejects mute rather than clamp. Portable u32 IDs/native nonnegative i32; exact selected CLAP port per enabled direction. Default input rejects, output filters expressions. Disabled/invalid input rejects whole prefix before native mutation; unknown types/other or wildcard ports filter; selected malformed output faults without native rollback. Default generated MIDI output rejects whole expression streams before delivery. No voice application/allocator, lifecycle/per-note parameters, loss to MIDI/MPE/UMP or third-party/DAW/deadline claim; offline linked f32/f64 ABI evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-host/src/graph_note_expression.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-device/src/graph_events.rs, crates/ravet-clap/src/output.rs.

Tests: crates/ravet-foundation/tests/note_expression.rs, crates/ravet-host/src/graph_note_expression.rs, crates/ravet-host/tests/graph_expression.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-graph/tests/events.rs, crates/ravet-clap/tests/output.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/decisions/0134-scoped-note-expressions.md.

Scoped note release and choke

Portable wildcard targets carry key release velocity and scalar-free choke through graph queues and selected hosted/exported native CLAP routes.

Limits: Finite Off velocity 0..1, portable u32 IDs/native nonnegative i32; receiver-owned voice matching/release/termination. Hosted flags default false and require selected CLAP directions; invalid/disabled input rejects whole prefixes pre-native, default/unselected output filters. Native wildcard-channel/key Off preserves scope; concrete output Off retains legacy/identity profile. Raw negative scope rejects rather than normalize; native choke velocity ignored. Selected output faults retain native history; zero-frame/flush performance restrictions remain. Generated MIDI rejects whole scoped streams before prefix. No note-end completion, implicit MIDI/MPE/UMP conversion, public instrument behavior or third-party/DAW/hardware/deadline claim; offline linked f32/f64 evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-clap/src/notes.rs, crates/ravet-clap/src/output.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-foundation/tests/note_release.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/tests/graph_release.rs, crates/ravet-clap/tests/notes.rs, crates/ravet-clap/tests/output.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-graph/tests/events.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/decisions/0136-scoped-note-release.md.

Directional note completion notifications

Portable completion targets, graph/queue preservation and opt-in native profiles notify controllers on originating note input endpoints independently of release/choke and performance output.

Limits: Checked channel/key/wildcard/u32 portable scope and native nonnegative i32 IDs. Carrier offsets order delivery without voice termination times. Hosted explicit CLAP input route/nonzero capacities; native timestamp/velocity ignored, canonical offset uses previous retained offset or zero. Disabled/unselected/wildcard ports filter; selected raw scope/capacity faults discard portable output without native rollback. Portable hosted input rejects whole prefixes. Exported independent input-endpoint output selector below 256, whole missing-route/width/flush rejection before host prefix with audio progressed; incoming native completions filter under generic timing validation. No automatic completion/allocator/ID reuse, MIDI conversion, public reference behavior or third-party/DAW/deadline claim; synthetic offline evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-clap/src/output.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/multi_bus.rs, crates/ravet-device/src/graph_events.rs, crates/ravet-graph/src/events.rs.

Tests: crates/ravet-foundation/tests/note_completion.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-host/tests/graph_note_end.rs, crates/ravet-clap/tests/note_end.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-graph/tests/events.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/midi.md, docs/decisions/0140-note-completion.md.

Sample-timed UMP and CLAP packet routing

Framed UMP portable events preserve ordered sample offsets and map to/from selected-port CLAP MIDI2 events without resolution conversion.

Limits: Packet transport only; processors own semantic validation and negotiated protocol. Existing reference processors advertise MIDI 1.0 only. No MIDI 2 DAW/device performance claim, pointer-based SysEx mapping, protocol negotiation or automatic synthesis conversion.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/output.rs.

Tests: crates/ravet-clap/tests/output.rs.

Documentation: docs/extended-processing.md, docs/decisions/0052-sample-timed-ump.md.

Explicit MIDI devices and bounded complete packets

Native midir connections enumerate/select exact ports, receive short/SysEx packets through prepared SPSC storage and send validated packets to explicit destinations.

Limits: 1024-byte complete packets, power-of-two 1..1024 slots; newest full input drops. Connection-local microsecond timestamps require explicit audio mapping. No fragmented SysEx, UMP, automatic reconnect/hotplug, physical-device or non-macOS runtime/deadline claim.

Source: crates/ravet-midi-device/Cargo.toml, crates/ravet-midi-device/src/lib.rs.

Tests: crates/ravet-midi-device/tests/packets.rs, crates/ravet-midi-device/src/lib.rs, crates/ravet-midi-device/examples/loopback.rs.

Documentation: docs/midi.md, docs/decisions/0032-midi-device-packets.md.

Guarded macOS CoreMIDI UMP endpoints

Exact-ID protocol-selected native inputs/outputs and owned virtual destinations/sources connect bounded exact-word UMP handoff through guarded native callback lifetime.

Limits: macOS/Xcode backend only, runtime scope macOS 27.0.1 arm64. 4096 endpoints/packet queue, 1023-byte display names, 1024 native packets/4096 words per callback. Handles thread-local; close waits outside callbacks. Native conversion/host-tick clock explicit; physical devices, negotiation/hotplug/deadlines and other OS backends unvalidated.

Source: crates/ravet-core-midi/Cargo.toml, crates/ravet-core-midi/build.rs, crates/ravet-core-midi/src/lib.rs, crates/ravet-core-midi/src/macos/mod.rs, crates/ravet-core-midi/src/macos/ffi.rs, crates/ravet-core-midi/native/core-midi.mm.

Tests: crates/ravet-core-midi/src/macos/ffi.rs, crates/ravet-core-midi/examples/virtual-probe.rs, crates/ravet-core-midi/examples/source-probe.rs.

Documentation: docs/core-midi-ump.md, docs/decisions/0061-core-midi-ump-endpoints.md, docs/decisions/0072-owned-ump-sources.md.

Standalone output audio devices

Explicit CPAL enumeration/ID selection and configured f32 output streams adapt owned prepared processors through bounded planar scratch; a CLI runs silent callback validation.

Limits: Output-only, 1..64 channels and at most 65,536 scratch frames; no inputs, auxiliary buses, MIDI/events, implicit resampling/conversion, hotplug subscriptions or automatic recovery. macOS UMC1820 20-channel 96 kHz silent callbacks exercised; audible output, latency, deadlines and other targets remain unvalidated.

Source: crates/ravet-device/Cargo.toml, crates/ravet-device/src/lib.rs, tools/device-probe/Cargo.toml, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/tests/output.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0018-output-devices.md.

Input capture and FIFO duplex effects

Explicit CPAL f32 input streams publish whole-frame prefixes to a prepared ring; duplex rendering zero-fills underflow, partitions variable callbacks and feeds portable effects.

Limits: 1..64 channels per direction, power-of-two ring 1..65536 frames, scratch up to 65536. Matching nominal rates, independently clocked/sequential streams; no drift compensation or sample-exact alignment. No automatic recovery, hotplug or MIDI/events; hidden-producer automatic recording integration is exercised synthetically, without physical recording validation.

Source: crates/ravet-device/src/input.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/tests/recording_worker.rs, crates/ravet-device/tests/input.rs, crates/ravet-device/tests/output.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0028-input-duplex-devices.md.

Caller-scheduled exact-device output recovery

An explicit control-thread owner preserves healthy f32 output, releases missing/failed streams and prepares/starts fresh DSP through a caller-supplied factory.

Limits: Exact host-local ID 1..4096 bytes/no NUL, fixed existing f32 config/scratch limits; no fallback/settings mutation/timer/hotplug subscription/state migration/clock compensation/duplex or native plugin scheduling. Backend work can block; errors retry only on service. Controlled transitions and UMC1820 silent manual restart evidence, physical unplug/real backend fault/other-platform/deadline unvalidated.

Source: crates/ravet-device/src/recovery.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/src/recovery.rs, crates/ravet-device/tests/output.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0090-explicit-output-recovery.md.

Caller-scheduled exact-pair duplex recovery

An explicit control-thread owner releases both streams when either exact device disappears or either backend fails, reopening fresh FIFO/DSP through a caller factory.

Limits: Fixed f32 1..64-channel matching-rate configs, scratch 1..65536, power-of-two ring 1..65536; exact IDs 1..4096 bytes/no NUL. No fallback/settings mutation/timer/hotplug subscription/state migration/clock compensation/recording or native plugin scheduling. Controlled transitions and silent UMC1820 manual pair restarts only; physical removal/real backend failure/drift/other-platform/deadline unvalidated.

Source: crates/ravet-device/src/recovery.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/src/recovery.rs, crates/ravet-device/tests/input.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0091-explicit-duplex-recovery.md.

Explicit paired clocked callback retirement and original-owner recovery

An additive f32 paired CPAL route retains the unique prepared clocked renderer and matching capture endpoints until all four callbacks retire, then allows stopped file/DSP extraction and explicit owner-preserving recovery.

Limits: No new dependency/defaults; existing clocked rate/channel/ring/frame/corrected-sinc profile. Failure-owned prepared constructors preserve original P/raw consumer; fallible scratch before child prepare; legacy consuming signatures unchanged, failed-prepare inactive contract. One control retirement worker; disjoint private UnsafeCell capture/renderer, unique non-Clone FnMut data guards, two atomic-only error guards, no Weak/public clones. All FOUR Acquire retirement flags plus stable sole strong ownership before extraction; callback Arc field Drop cannot be inferred from flags. Framework capture Drop only publishes flag/releases non-last Arc; no producer/consumer/DSP/scratch/counter disposal there, including early receiver Drop/asynchronous native owners. Native CPAL/OS locks/closure allocation/destructors and panic runtime remain separate limits. Nonblocking poll; explicit CONTROL wait without deadline/cancellation. Original spawn/input/output/preparation/start errors retain Immediate/Pending ownership, no hidden retry. Caught polling fault returns exclusive stopped owner; foreign lifecycle/restore panic may lose recovery, no forged receipt. Capture/output panic disables its guard, histories exceptional. Stopped result exposes no render/mutable child and consumes into original P and matching raw consumer/PreparedCapture, once-only deactivate; converted/prefetched histories discarded CONTROL, queued raw cursor unchanged. Explicit selected-ID recovery Owned/Live/Retiring/Disabled, known live callback faults retire before selection, healthy selection errors retain pair/original error without absence inference; no enumerate/open/restore while pending or disabled; after proof restore original P/receipt before fresh pair. Normal restore errors retain actual mutated P/receipt; successful restore once, failed opens preserve ownership, generation advances only after successful start. No automatic timer/fallback/subscription/state migration; ordinary DSP faults explicit reset/reopen policy. All24 Drop orders, actual concurrent capture/render and Wave/IntegerSinc/indexed-worker/W215 stopped failed/successful seek17/reprepare/exact suffix/drain qualified offline. Two short silent paired CoreAudio cycles on one USB interface prove original-owner retirement/reopen only; no acoustic validation, synchronized starts, timestamp alignment, live mailbox, physical hotplug/drift, long-session latency, callback/teardown deadline or broad device/platform claim.

Source: crates/ravet-device/src/lib.rs, crates/ravet-device/src/input.rs, crates/ravet-device/src/clocked.rs, crates/ravet-device/src/reclaimable_clocked.rs, crates/ravet-device/src/reclaimable_clocked_recovery.rs.

Tests: crates/ravet-device/src/reclaimable_clocked_tests.rs, crates/ravet-device/src/reclaimable_clocked_recovery_tests.rs, crates/ravet-device/tests/buffered_file_duplex.rs, crates/ravet-device/tests/indexed_buffered_output.rs, tools/device-probe/src/bin/reclaimable-clocked-duplex.rs.

Documentation: docs/audio-devices.md, docs/audio-files.md, docs/decisions/0231-reclaimable-clocked-duplex-ownership.md.

Native web editor backends

Local HTML editors use Cocoa/WebKit, Windows HWND/WebView2 or Linux X11/WebKitGTK with finite backing colours, bounded JSON messages, coalesced snapshots and explicit teardown. Cocoa editor views accept initial drags from inactive windows. WebKit browser context menus are suppressed in all frames while consumer right-click actions still receive events.

Limits: C++ API on all three platforms; the separate Cargo Rust binding remains macOS only. Caller owns the UI loop and callback lifetime. Linux requires GTK3 X11/XWayland, WebKitGTK 4.1 >=2.40 and UI-thread GLib pumping; an existing Wayland GTK context is rejected. Loaded SWELL hosts must provide cooperative LOAD_GTK initialization or editor creation is rejected. Windows requires the WebView2 loader and installed runtime; creation is asynchronous. 50 ms polling, one evaluation in flight, 65,536-byte JSON and 1 MiB inline HTML limits. WebKit context-menu suppression has no native opt-out; macOS synthetic DOM evidence only, Linux runtime validation pending. Windows context-menu policy is unchanged. Linux software painting is selectable with RAVET_WEB_LINUX_SOFTWARE_RENDERING (default OFF); UI CPU cost is unmeasured. Linux lifecycle evidence in local Ubuntu containers and native Omarchy/XWayland, Windows compile evidence only, macOS native probes; no DAW or deadline support claim.

Source: crates/ravet-surface/native/RavetWebView.h, crates/ravet-surface/native/RavetWebView.mm, crates/ravet-surface/native/RavetWebViewLinux.cpp, crates/ravet-surface/native/RavetWebViewWindows.cpp, crates/ravet-surface/native/mingw/EventToken.h, crates/ravet-surface/native/CMakeLists.txt.

Tests: crates/ravet-surface/native/tests/lifecycle.mm, crates/ravet-surface/native/tests/context-menu.mm, crates/ravet-surface/native/tests/context-menu.html, crates/ravet-surface/native/tests/first-mouse.mm, crates/ravet-surface/native/tests/editor.html, crates/ravet-surface/native/tests/portable.cpp, crates/ravet-surface/native/tests/portable.html, crates/ravet-surface/native/tests/linux-host-gtk.cpp, crates/ravet-surface/native/tests/linux-host-gtk-shim.cpp, crates/ravet-surface/native/tests/linux-paint.cpp.

Documentation: docs/native-editor.md, docs/decisions/0005-native-web-editor.md, docs/decisions/0014-cross-platform-native-web.md, docs/decisions/0205-webkit-context-menus.md.

Cargo macOS WebKit ownership binding

An explicit native crate builds Cocoa/WebKit through Xcode, checks main-thread creation, owns view and callback context, copies bounded snapshots and destroys native callback machinery before releasing state.

Limits: macOS only; Xcode build host required, native deployment target 12. View is not Send/Sync; caller supplies run loop and a valid live NSView parent through a documented unsafe attach. macOS owned-view resizing is available. No portable widgets, x86_64/macOS-12 runtime, native heap or DAW support claim.

Source: crates/ravet-webview/src/lib.rs, crates/ravet-webview/src/macos.rs, crates/ravet-webview/build.rs.

Tests: crates/ravet-webview/src/macos.rs, tools/editor-smoke/src/main.rs, crates/ravet-surface/native/tests/lifecycle.mm.

Documentation: docs/native-editor.md, docs/decisions/0013-cargo-native-gain-editor.md.

Rust-owned macOS editor C ABI

Native consumers create/attach/resize/show/destroy Rust-owned WebViews with counted UTF-8 callbacks, UI-thread status checks and retained exactly-once foreign-context release.

Limits: macOS/Xcode only; trusted HTML 1 MiB, snapshot 65536 bytes, dimensions <=16384. Consumers provide valid live handles/buffers/NSView parents and nonthrowing callbacks; host owns window/run loop. Wrong-thread destroy retains ownership; accepted destroy consumes. No format/product policy, other-OS/assistive-tech/DAW support claim.

Source: crates/ravet-webview/src/editor_abi.rs, crates/ravet-webview/include/RavetWebEditor.h, crates/ravet-webview/src/macos.rs, examples/gain-native/Cargo.toml, examples/gain-native/src/lib.rs.

Tests: crates/ravet-webview/src/editor_abi.rs, tools/native-validation/editor.cpp, tools/native-validation/CMakeLists.txt, tools/editor-smoke/src/probe.mm.

Documentation: docs/native-editor.md, docs/decisions/0076-native-editor-abi.md.

Default standalone Audio/MIDI settings popup

Reusable main-thread standalone windows resize their embedded page with native content and include a native title-bar settings button and standard device/channel-pair/rate/buffer/MIDI checklist popup with persistent exact device selections by default, with explicit full opt-out.

Limits: macOS 12+ Cocoa/WebKit and Xcode tools. Trusted local inline HTML up to 1 MiB with one closing body tag, reserved DOM IDs and control-thread snapshot/action contract. Consumer owns device inventory/validation/routing/lifecycle; creation opens no devices. Optional initial content aspect-ratio lock; programmatic resize fits the requested rectangle and native minimum size applies. Versioned preferences up to 8 KiB use a stable window-title key; hidden fixtures use process-local memory. Missing devices are unselected, restored settings never start audio. Plug-in editors and headless fixtures retain their own host/window policy. Programmatic native UI evidence, no broader platform or assistive-technology claim.

Source: crates/ravet-webview/src/standalone.rs, crates/ravet-webview/native/StandaloneWindow.mm, crates/ravet-webview/web/io-settings.html.

Tests: crates/ravet-webview/src/standalone.rs, examples/tutorials/src/ui/mod.rs.

Documentation: docs/native-editor.md, docs/project-starters.md, docs/decisions/0132-standalone-settings-and-knobs.md.

Reusable local web controls

Shared slider/number, linear/logarithmic rotary knob, polyphonic piano keyboard, toggle, choice, action-button and meter components provide explicit gestures/actions, held-key ownership, nonfeedback host refresh and retryable disposal; piano chords/glissando share lifecycle release, disabled keys remain opaque and meter text retains actual overload levels. Shared styles prevent UI label/body text selection while keeping editable fields and code output selectable. Knob and slider/fader pointer gestures leave numeric editing, suppress label activation and pointer focus outlines, and preserve direct number entry and keyboard focus styling.

Limits: Trusted inline documents up to 1 MiB; physical slider/knob values with optional logarithmic knob travel, 256 choices and 32-bit IDs. Meter labels 256 and formatter text 4096 JavaScript units; finite nonnegative readings. Consumer owns DOM labels/layout/theme, host schema/queue policy and asynchronous errors. Piano note bounds 0..127 with white endpoints and up to 128 external notes. Native macOS WebKit programmatic and browser keyboard evidence; no assistive-tech audit or complete native widget toolkit/platform claim.

Source: crates/ravet-surface/src/web_controls.rs, crates/ravet-surface/web/controls.js, crates/ravet-surface/web/theme.css, examples/gain-clap/editor/index.html, examples/gain-clap/src/gui.rs.

Tests: tools/editor-smoke/src/main.rs, examples/tutorials/src/ui/mod.rs, crates/ravet-surface/native/tests/control-semantics.js, crates/ravet-surface/native/tests/control-semantics.mm.

Documentation: docs/web-controls.md, docs/decisions/0034-reusable-web-controls.md, docs/decisions/0071-meter-text-and-held-keys.md.

Shared default semantic UI palette

Portable SVG themes, reusable local web controls, the standalone settings popup and example editors share semantic background/surface/text/accent colors.

Limits: Selected Amber default uses warm charcoal/plum surfaces and amber emphasis, with a warm paper light companion. Consumer CSS/theme overrides remain explicit; no platform-wide native styling or assistive-technology/contrast conformance claim.

Source: crates/ravet-surface/src/drawing.rs, crates/ravet-surface/src/web_controls.rs, crates/ravet-surface/web/theme.css, crates/ravet-webview/web/io-settings.html, examples/tutorials/editor/index.html, examples/gain-clap/editor/index.html.

Tests: crates/ravet-surface/tests/visual.rs, examples/tutorials/src/ui/mod.rs.

Documentation: docs/web-controls.md, docs/surface-drawing.md, docs/decisions/0132-standalone-settings-and-knobs.md.

Generic native open-file chooser

An explicit surface open-file API owns its completion callback, supports a native parent and extension filter, and returns cancellation without any product file policy.

Limits: UI thread after toolkit initialization; Cocoa/GTK asynchronous, Windows modal. macOS owned-window cancellation probe and Linux compile evidence; Windows and actual Linux chooser runtime unvalidated. One file; no save/folder/multi-selection or Rust binding.

Source: crates/ravet-surface/native/RavetFileDialog.h, crates/ravet-surface/native/RavetFileDialog.mm, crates/ravet-surface/native/RavetFileDialogWindows.cpp, crates/ravet-surface/native/RavetFileDialogLinux.cpp, crates/ravet-surface/native/CMakeLists.txt.

Tests: crates/ravet-surface/native/tests/file-dialog.mm.

Documentation: docs/runtime-services.md, docs/native-editor.md, docs/decisions/0020-rust-runtime-services.md.

CLAP editor control and gesture bridge

A main-thread gain/bypass edit API queues complete edits and continuous begin/value/end gestures, retains partial host output progress, invalidates stale edits after restore, and exposes coherent requested values and coalesced meters.

Limits: 32 queued commands/complete edits and at most 96 drain iterations per callback, also used by the macOS embedded gain editor. One continuous gesture at a time; live updates reserve end capacity and reject overflow. REAPER 7.82/macOS arm64 GUI gain recording exercised; no guaranteed host delivery. CLAP must serialize consumers; generation must not wrap across outstanding edits.

Source: examples/gain-clap/src/editor.rs, examples/gain-clap/src/lib.rs, examples/gain-clap/src/shared_gain.rs.

Tests: examples/gain-clap/src/editor.rs, examples/gain-clap/src/control_tests.rs, examples/gain-clap/tests/state.rs.

Documentation: docs/editor-control.md, docs/decisions/0012-clap-complete-state-and-edits.md, docs/decisions/0015-continuous-editor-gestures.md.

Rust runtime native ownership facade

Opaque handles, bounded returned buffers and consumed callback contexts expose Rust runtime APIs to native SDK consumers; narrow Rust OS bindings supply module paths, macOS UUID and Windows SMBIOS inputs.

Limits: Foreign callers guarantee pointer validity, nonthrowing callbacks and serialized teardown. C++ convenience read maps errors to empty text; Rust/C status retain errors. macOS arm64/Omarchy x64 ABI tests and native facade probes; private macOS consumer integration, Windows runtime validation pending. Raw hardware queries include no product hashing or transmission.

Source: crates/ravet-runtime-ffi/Cargo.toml, crates/ravet-runtime-ffi/src/lib.rs, crates/ravet-runtime-ffi/src/system.rs, crates/ravet-runtime-ffi/include/RavetRuntime.h, crates/ravet-runtime-ffi/include/RavetRuntime.hpp.

Tests: crates/ravet-runtime-ffi/src/lib.rs, crates/ravet-runtime-ffi/src/system.rs, crates/ravet-runtime-ffi/tests/native.cpp.

Documentation: docs/runtime-services.md, docs/decisions/0020-rust-runtime-services.md.

CLAP gain plug-in

A loadable gain plug-in advertises mono/stereo ports, gain and stepped bypass metadata/text, sample-timed automation, active/inactive flush, reset, reactivation, and complete session recall.

Limits: macOS arm64 validator/smoke-host and REAPER 7.82 session, automation and render evidence. Default macOS native-editor feature provides an embedded Cocoa gain GUI, committed and continuous gestures and coalesced meters. No broader host or production compatibility claim.

Source: examples/gain-clap/src/lib.rs.

Tests: examples/gain-clap/tests/host.rs, examples/gain-clap/tests/bridge.rs.

Documentation: docs/getting-started.md, docs/decisions/0002-clap-backend.md.

VST3 gain reference

External SDK builds separate processor/controller classes over shared Rust gain DSP, bounded sample-timed automation, bypass, complete state and normalized controller recall.

Limits: Mono/stereo native f32/f64 gain effect only; external SDK 3.8.1/macOS arm64 exercised with 47 validator tests including native 64-bit processing. REAPER 7.82 macOS arm64 wet/bypass/state/automation/generic-window checks pass. REAPER precision for this update unobserved. No custom editor, generic instrument/bus/event mappings, production signing or other target runtime claims.

Source: examples/gain-vst3/CMakeLists.txt, examples/gain-vst3/src/gain.cpp, scripts/bundle-vst3.py.

Tests: tools/vst3-validation/contracts.cpp, examples/gain-native/src/lib.rs, scripts/bundle-vst3.py, tools/reaper-validation/native-formats.lua.

Documentation: docs/vst3.md, docs/decisions/0021-vst3-gain-native.md, docs/decisions/0067-vst3-native-f64.md.

Native AUv3 processor and parameter editor

A paired f32 native processor/state entry renders through AUAudioUnit with physical global parameters, timed changes/continuing ramps, host bypass, complete live state, transport and opt-in MIDI/UMP input, plus a native parameter editor and embedded extension fixture.

Limits: One main bus, up to 128 parameters/64 channels per direction, public mono/stereo Gain; bounded 1024 links and 1024 minus parameter-count flattened events. macOS arm64 and iOS simulator in-process evidence; no extension discovery/IPC, DAW, physical device, production signing or deadline claim. Auxiliary buses, generated output, factory presets, SysEx and instrument reference remain pending.

Source: native/apple/RavetAudioUnit.h, native/apple/RavetAudioUnit.mm, native/apple/RavetParameterViewController.mm, native/common/RavetNativeSession.hpp, examples/gain-auv3/CMakeLists.txt, examples/gain-auv3/Extension.mm, scripts/build-mobile.py.

Tests: tools/auv3-validation/contracts.mm.

Documentation: docs/mobile.md, docs/decisions/0153-auv3-mobile-native-adapters.md.

Apple mobile standalone effect host

An explicit AVAudioEngine/AVAudioSession owner hosts a native effect with microphone permission, preferred device settings, interruption/route/reset rebuilding, retained state and selected CoreMIDI input; the public iOS/iPadOS Gain app exposes native Audio/MIDI settings and consumer-selected deployment minimums.

Limits: iOS/iPadOS 17 arm64/device and arm64 simulator builds; iPhone simulator UI launch and in-process AU contracts only. Physical routing/interruptions/MIDI and extension IPC remain unvalidated; no production provisioning or deadline claim. Matched mono/stereo Gain; its MIDI profile is disabled. Background audio and persisted app sessions remain pending.

Source: native/apple/RavetMobileAudio.h, native/apple/RavetMobileAudio.mm, examples/gain-mobile/apple/main.mm, examples/gain-mobile/apple/Info.plist.in, scripts/build-mobile.py.

Tests: tools/auv3-validation/contracts.mm, scripts/tests/test_mobile.py.

Documentation: docs/mobile.md, docs/decisions/0153-auv3-mobile-native-adapters.md.

Android standalone audio and MIDI host

An explicit AAudio f32 effect owner provides prepared planar conversion/chunking, nonblocking capture reads with shortage silence/counters, atomic error handoff, stopped retirement and a bounded immediate MIDI queue; the public foreground app exposes permission/audio-focus and Audio/MIDI settings, with consumer-selected minimum API, compile/target SDK and build-tools.

Limits: Android API 26 arm64 native cross-build, warning-free Java and aligned development APK signature evidence; scripted AAudio-double lifecycle tests only, no Android execution/device/deadline claim. Equal input/output rates/channels, no clock drift conversion; Gain mono/stereo, immediate MIDI 1 input, explicit Start recovery, no SysEx/MIDI 2/background audio or persisted app sessions.

Source: native/android/RavetAAudio.hpp, native/common/RavetNativeSession.hpp, examples/gain-mobile/android/native.cpp, examples/gain-mobile/android/CMakeLists.txt, examples/gain-mobile/android/app/src/main/java/org/ravet/gain/MainActivity.java, scripts/build-mobile.py, .github/workflows/mobile.yml.

Tests: scripts/tests/test_mobile.py, tools/mobile-validation/contracts.cpp, tools/mobile-validation/include/aaudio/AAudio.h.

Documentation: docs/mobile.md, docs/decisions/0153-auv3-mobile-native-adapters.md.

Public AUv2 native performance instrument bundle

Public mono/stereo native performance AUv2 instrument adopts selected planar f32/f64 audio, timed MIDI and Level intent, coherent Level state, and checked stopped/offline/reset lifecycle over reusable AU helpers.

Limits: External Apple AudioUnit SDK, macOS arm64 local in-process evidence. Explicit packed float32/64 output ASBD and exact selected native table/entry provenance; f32 Level controls/state/text remain independent of audio precision. Stock intermediate32 Initialize precedes checked stop/deactivate/selected setup/activate/start, ready only after completion. Successful serialized offline mode changes reset voice history while retaining accepted queued timed MIDI/Level intent; failure clears readiness/pending intent and requires serialized uninitialize/initialize. Stopped32↔64 complete Level recall excludes voices/history; inherited stock Reset ignores supplied scope/element. SDK facade may normalize original ASBD size/reserved fields; no arbitrary SDK setup rollback, full wrapper fastmath/backend-fault injection, DAW/auval/device/deadline/other-platform support claim. Existing16voices,1024expanded events minus reserved state slot and1..65536prepared frames; positive opaque StartNote IDs permit1048575nonreused generations per component lifetime. No SysEx/MIDI2/pedal/pitch-bend/expression/program/editor or production distribution claim; external SDK sources remain outside RAVET and no global installation occurs.

Source: crates/ravet-native/include/RavetAuAudio.hpp, crates/ravet-native/include/RavetAuParameters.hpp, crates/ravet-native/include/RavetAuState.hpp, examples/performance-au/PerformanceAU.mm, examples/performance-au/CMakeLists.txt, examples/performance-au/Info.plist.in, scripts/bundle-au.py, scripts/au_bundle.py.

Tests: tools/au-validation/audio.cpp, tools/au-validation/native-parameters.cpp, tools/au-validation/performance.mm, tools/au-validation/performance64.mm, tools/au-validation/performance-precision.mm, tools/au-validation/native-precision-schema.cpp, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/performance-au.md, examples/performance-au/README.md, docs/decisions/0174-auv2-native-performance-instrument.md, docs/decisions/0203-auv2-performance-audio-precision.md.

AudioUnit v2 gain reference

An external SDK wrapper embeds the Rust-backed VST3 gain bundle in a local AUv2 component with normalized controls, stereo rendering, dry host bypass and gain preset recall.

Limits: macOS arm64 actual-bundle AudioComponent tests only; host bypass is preserved during preset recall. No custom editor, AUv3, DAW discovery, auval, sandbox runtime, production signing or deadline claim. SDKs remain external; no global installation.

Source: examples/gain-au/Info.plist.in, examples/gain-vst3/CMakeLists.txt, scripts/bundle-au.py, scripts/au_bundle.py.

Tests: tools/au-validation/contracts.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/audio-unit.md, docs/decisions/0022-auv2-reference.md.

Optional native AAX WebKit editor ownership

An opt-in native Gain editor uses checked initialized automation delegates, retained callback context and actual public SDK view ownership with separate editor packaging.

Limits: macOS and separately licensed external SDK only; default-off native Gain reference, stock/Performance option rejects. Exact selected native32/64 audio companion cache and native codec provenance retained; host audio remains f32. MAIN ownership; bounded finite positive initialized dimensions, original per-ID begin/value/end refusals and throws. Accepted touch retired once; refused end latches unresolved without replay. Entered callback may destroy GUI while independent context/model/host/container stays retained; reopening waits old context retirement. SDK Initialize/SetViewContainer queries require caller GUI liveness; final Release MAIN, public refcount/NSView liveness obligations. UI post is acceptance; model forwarding and actual Rust audio commitment tested separately. Default headless descriptor has no GUI advertisement. No generic program list, modifier automation menu, meters, accessibility, Pro Tools/PACE distribution, other-platform or deadline support.

Source: crates/ravet-native/include/RavetAaxEditorControls.hpp, crates/ravet-native/include/RavetAaxWebEditor.hpp, examples/gain-aax/GainNativeEditor.hpp, examples/gain-aax/GainNativeParameters.hpp, examples/gain-aax/native-editor.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/editor-controls.cpp, tools/aax-validation/editor.mm, tools/aax-validation/editor-registered.mm, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-native-editor.md, docs/decisions/0234-aax-native-editor-ownership.md, docs/aax-precision.md.

AAX gain reference build

Authored public AAX SDK model/algorithm over shared Rust gain DSP defaults to checked mono/stereo native lifecycle and complete global state; an explicit stock wrapper profile preserves its separate schema/control regression.

Limits: Local macOS arm64 entry-point/SDK probes and registered Gain parameter/algorithm fixtures at1024frames. Default native owner validates first ordinary realtime mono/stereo and complete native global state including bypass. Explicit stock profile preserves rejected/silent initial mono then positive mono/stereo after public reprepare. Native chunk is a deliberate local prototype change, without released-session compatibility. Optional native editor and internal native32/64 DSP have separate scoped records. No Pro Tools acceptance, production PACE signing, AudioSuite or broad support. Installed signing tool alone is insufficient; SDK agreements and identifiers require release review.

Source: examples/gain-aax/description.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-aax.py, examples/gain-aax/GainNativeParameters.hpp, examples/gain-aax/native-registration.cpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/check-bundle.py, tools/aax-validation/registered.cpp, tools/aax-validation/parameters.cpp, tools/vst3-validation/contracts.cpp, scripts/tests/test_aax_bundle.py, tools/aax-validation/registered-native.cpp, tools/aax-validation/processor.cpp, tools/aax-validation/model.cpp.

Documentation: docs/aax.md, docs/decisions/0023-native-format-references.md, docs/decisions/0213-aax-checked-native-lifecycle.md, docs/aax-precision.md.

Opt-in Gain AAX meter reference

The explicit gain-meters local bundle registers six native peak/RMS taps through public SDK AddMeters/descriptions and distinct mono/stereo owned factory IDs while retaining canonical Gain32/64 schema/state/transport/smoothing/bypass DSP.

Limits: macOS arm64 external licensed SDKs; unchanged host-f32 audio/control/state, distinct product/native/effect identities, no editor/stock variant. Authored empty external bootstrap exposes zero unrelated VST3 classes. Each native32/64 local package4 native validators plus actual module startup/exports/version/AddMeters/Initialize→process analytic and late snapshot/native fault receipts; generic fixtures additionally depend on frozen R4/W241 raw native exports pending public adoption. Pipeline Python16 and default Gain32/Performance4/stock14 regressions locally qualified; actual Pro Tools/system installation/PACE production signing/distribution/deadline and other architecture/platform unqualified.

Source: examples/gain-meters-aax/GainMeterParameters.hpp, examples/gain-meters-aax/native-registration.cpp, examples/gain-meters-aax/bootstrap.cpp, examples/gain-meters-aax/description.cpp, examples/gain-meters-aax/CMakeLists.txt, scripts/aax_bundle.py, scripts/bundle-aax.py, tools/aax-validation/check-bundle.py.

Tests: tools/aax-validation/registered-meters.cpp, tools/aax-validation/meters.cpp, tools/aax-validation/meter-composition.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-meters.md, examples/gain-meters-aax/README.md, docs/decisions/0262-aax-native-metering.md.

LV2 gain reference

Mono/stereo public Gain descriptors use the native f32 processor, cached schema controls and coherent portable LV2 state extension with actual-library lifecycle/audio/state validation.

Limits: External LV2 headers and native 64-bit publication required. Block-start physical control ports; no Atom/MIDI/UI/f64/auxiliary/DAW/Linux-runtime claim. State requires optional host URID map; restore is serialized, save may fail on contention, and no hard real-time feature is advertised.

Source: examples/gain-lv2/gain.cpp, examples/gain-lv2/CMakeLists.txt, examples/gain-lv2/manifest.ttl, examples/gain-lv2/gain.ttl, scripts/bundle-lv2.py, crates/ravet-native/include/RavetLv2Processor.hpp.

Tests: tools/lv2-validation/contracts.cpp, tools/lv2-validation/state.cpp.

Documentation: docs/lv2.md, docs/decisions/0023-native-format-references.md.

Bounded LV2 Atom MIDI note input

An external-SDK adapter preflights a complete ordered Atom sequence before mapping MIDI1 short notes with normalized velocity and channel/key release scopes into caller-owned native events.

Limits: Live aligned foreign sequence storage; frame-time/default units, 64 KiB body/1024 raw events. Zero-velocity note-on releases; defined other short MIDI and bounded unknown Atoms are ignored after validation. No invented per-note identities, running status, SysEx, expressions, MIDI2, Atom output or DAW/Linux/deadline claim.

Source: crates/ravet-native/include/RavetLv2NoteInput.hpp, crates/ravet-native/include/RavetLv2Processor.hpp.

Tests: tools/lv2-validation/performance.cpp.

Documentation: docs/lv2.md, docs/decisions/0170-lv2-midi-performance-instrument.md.

Public LV2 MIDI performance instrument bundle

A public zero-input mono/stereo f32 LV2 instrument connects bounded Atom MIDI notes, generic Level control and canonical complete state to the native performance archive; an explicit bundler packages metadata/module/notices and validates the selected binary.

Limits: Required cached URID map, 1024 merged notes/control/restore events and 65536 prepared frames. Transactional failure preserves voice history/pending recall. No f64, expressions/pedals/pitch, custom UI, Atom output, DAW/Linux-runtime/device or deadline claim; local macOS ARM actual-module evidence only. No host installation or production signing.

Source: examples/performance-lv2/performance.cpp, examples/performance-lv2/manifest.ttl, examples/performance-lv2/performance.ttl, examples/gain-lv2/CMakeLists.txt, scripts/bundle-lv2.py, scripts/lv2_bundle.py.

Tests: tools/lv2-validation/performance.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: examples/performance-lv2/README.md, docs/lv2.md, docs/decisions/0170-lv2-midi-performance-instrument.md.

Reusable LV2 native processing and complete state

The public Gain and Performance LV2 factories consume prepared native schema metadata and coherent complete state with exact originating core/shared-schema admission before resource creators.

Limits: External LV2 SDK, native f32 main profile,1..64 channels/1..1024 writable block-start physical controls/65536 frames bounded by template; state needs cached URID mapping, no threadSafeRestore/hardRT advertisement and contended save may fail after one attempt; unchanged constructor/port/lifecycle, serialized restore and concurrent publication save. Exact cache-schema processor pointer and exact cache/state shared schema pointer; callback-equivalent copied cores/separate copied schemas reject creator0. Queries once on CONTROL; violating metadata exception refuses before acquisition, other native ABI calls remain nonthrowing. Existing ABI supplies no stronger top-level cache/state table-address oracle; coherent views retaining actual origins remain valid. Maintained origin gate required by Gain/Performance bundler profiles with meaningful late-gate failure propagation. Isolated CMake7/7 and actual Gain3/Performance5 packaged validators plus Python4; fresh public/reference/shared acceptance tracked separately. No auxiliary/f64/generated-output/custom-UI/DAW/Linux-runtime/deadline claim.

Source: crates/ravet-native/include/RavetLv2Processor.hpp, examples/gain-lv2/gain.cpp, examples/performance-lv2/performance.cpp, examples/gain-lv2/CMakeLists.txt, scripts/lv2_bundle.py.

Tests: tools/lv2-validation/origin.cpp, tools/lv2-validation/state.cpp, tools/lv2-validation/contracts.cpp, tools/lv2-validation/performance.cpp, tools/lv2-validation/processor-transport.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: docs/lv2.md, docs/decisions/0167-lv2-native-schema-state.md, docs/decisions/0261-lv2-exact-origin-admission.md.

Native precision sidechain CLAP reference

A stateless stereo fixed-threshold gate exports main input/output plus an input-only mono auxiliary detector in native f32/f64; its distinct validate-sidechain executable checks the actual public bundle.

Limits: Threshold 0.1, no parameters/state/custom editor; nonfinite detector closes gate. Two prepared precision bridges, selected common size per callback. Linked/built ABI and validator plus isolated REAPER 7.82 auxiliary render pass within recorded scope; host precision was not measured. General host/device/deadline support remains pending.

Source: examples/sidechain-clap/Cargo.toml, examples/sidechain-clap/src/lib.rs, scripts/bundle-clap.py.

Tests: examples/sidechain-clap/tests/host.rs, examples/sidechain-clap/tests/support/mod.rs, examples/sidechain-clap/examples/validate.rs, tools/reaper-validation/sidechain.lua, tools/reaper-validation/check-sidechain-render.py, scripts/tests/test_sidechain_render.py.

Documentation: docs/sidechain-clap.md, docs/decisions/0058-clap-auxiliary-buses.md.

MIDI sine CLAP instrument reference

The portable 16-voice sine reference exports stereo audio without input, timed MIDI notes/controllers, stable level, atomic state recall, generic host controls and infinite held-note tail; validate-sine checks its public bundle with a distinct executable name.

Limits: Stereo f32/MIDI dialect only; no custom editor, CLAP note-ID/modulation, SysEx/UMP, auxiliary audio or f64 export. Persists level only; notes/controller/RPN performance state transient. macOS arm64 ABI/validator and REAPER 7.82 synthetic MIDI/audio/state/automation pass with silent hardware sends; other targets/DAWs pending. Development signing only.

Source: examples/sine-clap/Cargo.toml, examples/sine-clap/src/lib.rs, scripts/bundle-clap.py.

Tests: examples/sine-clap/tests/host.rs, examples/sine-clap/tests/support/mod.rs, examples/sine-clap/src/lib.rs, examples/sine-clap/examples/validate.rs, tools/reaper-validation/sine-instrument.lua.

Documentation: docs/sine-clap.md, docs/decisions/0040-clap-main-bus-instrument.md.

Public native identified-performance reference

A separate public 16-voice f32/f64 archive consumes generic native processor/schema/cache/audio-state and optional live-publication tables with distinct entry symbols, canonical global level state and bounded original-target completion.

Limits: Mono/stereo no-input buses without auxiliaries,65536 frames/1024 input and output events; optional notifications and portable sine policy. State saves level only, not voices/history. Live publication requires native64-bit atomics; caller owns separate state/render scheduling. No SDK factory/controller advertisement/editor/DAW/device/deadline/other-platform claim.

Source: examples/performance-native/Cargo.toml, examples/performance-native/src/lib.rs, examples/performance-native/include/RavetPerformance.h.

Tests: tools/native-validation/performance.cpp, crates/ravet-instrument/tests/performance_sine.rs.

Documentation: examples/performance-native/README.md, docs/native-processing.md, docs/decisions/0165-public-native-performance-reference.md.

Raw MIDI native32/64 sine reference

Distinct raw-MIDI native exports share the portable sine render kernel, preserve acknowledged Level independently of program requests, and expose transient exact raw/voice/request telemetry.

Limits: 16 voices, no-input mono/stereo, native32/64; Level ID1/default0.2 only, RAVETMS/version1 complete state. Program application explicitly disabled, request/ordinary voice/RPN/MPE behavior retained; no per-channel patches/host program menu.23 stopped telemetry fields are transient, not state. Actual f64 output exceeds f32 resolution, f32 matches existing scalar output. Pressure/timbre do not modulate sine, no deadline/SDK routing inferred.

Source: examples/performance-native/src/midi.rs, examples/performance-native/include/RavetMidiSine.h, crates/ravet-instrument/src/synthesis.rs.

Tests: examples/performance-native/src/midi.rs, tools/aax-validation/short-midi.cpp.

Documentation: examples/performance-native/README.md, docs/midi.md, docs/aax-short-midi.md, docs/decisions/0247-aax-short-midi-input.md.

Public VST3 performance instrument

A separate 16-voice public VST3 reference adopts native f32/f64 no-input rendering, timed identified notes, five audible note-expression declarations, canonical transactional level recall and explicit profile-aware local bundle packaging/validation.

Limits: External SDK, native 64-bit lock-free atomics and mono/stereo profile required. One shared 1024-event budget includes recall/tuning expansion; unsupported selected payloads reject. Brightness/pressure are stored without timbre changes. No generated completion bus, custom editor, programs, MIDI CC mapping or broader platform/device/deadline claim. Local SDK validation is separate from DAW evidence.

Source: examples/performance-vst3/src/performance.cpp, scripts/bundle-vst3.py, scripts/vst3_bundle.py, examples/gain-vst3/CMakeLists.txt, examples/performance-native/src/lib.rs.

Tests: scripts/tests/test_vst3_bundle.py, tools/vst3-validation/performance_instrument.cpp, tools/reaper-validation/performance-instrument.lua, tools/reaper-validation/check-performance-render.py, tools/reaper-validation/test_checks.py.

Documentation: docs/decisions/0176-public-vst3-profile-bundling.md, examples/performance-vst3/README.md, docs/vst3.md, docs/host-validation.md, docs/decisions/0166-vst3-performance-instrument.md.

Native ABI for shared reference DSP

A Rust static library exposes exclusively owned gain lifecycle, prepared scratch processing and pure complete/legacy state codecs to native reference format wrappers.

Limits: Public gain reference only, separate 1..2 f32/f64 handles, 65,536 frames and 1,024 f32 parameter events. Shared native adapter uses at most 1 MiB f32/2 MiB f64 copied-input/output audio scratch plus events; processing panic poisons until fresh preparation. Foreign pointers/ranges and serialized ownership are caller obligations. Normal Rust callback heap behavior tested; native allocations/deadlines are outside that evidence.

Source: examples/gain-native/Cargo.toml, examples/gain-native/src/lib.rs, examples/gain-native/include/RavetGain.h, tools/native-validation/CMakeLists.txt.

Tests: examples/gain-native/src/lib.rs, examples/gain-native/src/precision64_tests.rs, tools/native-validation/gain64.cpp, tools/vst3-validation/contracts.cpp.

Documentation: docs/vst3.md, docs/decisions/0021-vst3-gain-native.md, docs/decisions/0066-native-f64-gain-abi.md.

Gain session save and restore

CLAP saves a complete 32-byte version-two gain/bypass record, migrates 20-byte version-one gain records, and restores both values coherently at process, flush, or reset boundaries.

Limits: Gain plus boolean bypass only; restore snaps smoothing, then host automation proceeds normally. Requires 64-bit atomics and fewer than 2^31 control publications across callbacks or outstanding edits. REAPER 7.82/macOS arm64 gain/bypass session recall exercised; no preset discovery or broader session compatibility claim.

Source: examples/gain/src/state.rs, examples/gain-clap/src/lib.rs, examples/gain-clap/src/shared_gain.rs.

Tests: examples/gain/tests/state.rs, examples/gain-clap/src/shared_gain.rs, examples/gain-clap/tests/host.rs, examples/gain-clap/tests/state.rs.

Documentation: docs/session-state.md, docs/decisions/0003-gain-session-state.md, docs/WORK_STATUS.md.

Embedded editor and controls

The macOS CLAP gain editor embeds a compiled-in WebKit page with gain slider/numeric control, bypass, stereo peak/RMS meters, host automation updates and visible edit errors.

Limits: Embedded Cocoa only, default 480x390 logical size, resizable through 1200x900, default optional native-editor feature. One live gain gesture at a time, bounded updates with reserved end capacity. REAPER 7.82/macOS arm64 controls/meters and FX-chain resize exercised. No plug-in-owned floating windows or general widget toolkit; floating host-wrapper corner resize unverified.

Source: crates/ravet-surface/src/lib.rs, examples/gain-clap/src/gui.rs, examples/gain-clap/editor/index.html, tools/editor-smoke/src/main.rs, tools/editor-smoke/src/probe.mm.

Tests: examples/gain-clap/src/gui.rs, tools/editor-smoke/src/main.rs.

Documentation: docs/native-editor.md, docs/decisions/0013-cargo-native-gain-editor.md.

Optional macOS VST3 gain editor

A compiled local gain/bypass page consumes Rust-owned WebView and schema-validated UI codecs; SDK controller callbacks deliver normalized gestures with host refresh, rejected-edit rollback and retryable rejected ends.

Limits: Default-disabled --native-editor, macOS Cocoa NSView only, host UI thread/window/run loop. 65536-byte edit/snapshot JSON; size 360x300..1200x900. Gain/bypass/status and optional host-delivered peak/RMS/diagnostic meters; host queue forwarding required. Actual-bundle synthetic Cocoa/SDK evidence, no REAPER/focus/assistive-tech/other-format/platform claim. Forced destruction cannot guarantee a rejecting host accepts gesture end.

Source: examples/gain-vst3/src/gain.cpp, examples/gain-vst3/editor/index.html, examples/gain-native/src/editor.rs, examples/gain-native/include/RavetGainEditor.h, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py.

Tests: examples/gain-native/src/editor.rs, tools/vst3-validation/editor.cpp, tools/vst3-validation/contracts.cpp.

Documentation: docs/vst3.md, docs/native-editor.md, docs/decisions/0077-vst3-gain-editor.md.

Optional AUv2 Cocoa gain editor

Editor-enabled nested VST3 supplies the actual component Cocoa UI protocol through the external SDK wrapper, with gain/bypass gestures, notifying host/preset refresh and rendered-audio verification.

Limits: Default-disabled --native-editor, macOS main-thread AppKit/run loop and live AudioUnit ownership. Shared size 360x300..1200x900; exercised setFrame path, setFrameSize forwarding unvalidated. Host changes use AUParameterSet and bulk preset all-parameter notification. Meter transfer uses SDK timer/run loop; host bypass/stopped rendering retain readings. No DAW/auval/focus/assistive-tech/sandbox/other-architecture claim.

Source: scripts/bundle-au.py, examples/gain-vst3/CMakeLists.txt, examples/gain-vst3/src/gain.cpp, examples/gain-native/src/editor.rs.

Tests: tools/au-validation/editor.mm, tools/au-validation/contracts.mm, tools/editor-smoke/src/probe.mm.

Documentation: docs/audio-unit.md, docs/decisions/0078-auv2-gain-editor.md.

Sample-timed sine factory program recall

The public sine reference consumes three complete factory level programs via master-channel MIDI requests, preserving voices and reflecting CLAP state with deferred value refresh.

Limits: Bank 0/programs 0..2 levels 0.2/0.05/1, one global level; chosen master even before MPE negotiation. Unknown addresses/channels preserve values. No program identity persistence, host program/preset menus, General MIDI bank or new DAW program evidence. Hosts service coalesced callback; optional HostParams value rescan occurs on main thread.

Source: crates/ravet-instrument/src/synthesis.rs, examples/sine-clap/src/lib.rs.

Tests: crates/ravet-instrument/tests/synthesis.rs, examples/sine-clap/tests/support/mod.rs, crates/ravet-host/tests/sine_programs.rs.

Documentation: docs/midi.md, docs/sine-clap.md, docs/decisions/0081-sine-program-recall.md.

Native gain complete program metadata

A narrow public C header exposes immutable count and atomic complete control/address/name metadata for native gain SDK consumers.

Limits: Reference ABI only, live aligned caller output pointers, 128-byte complete NUL/zero-padded UTF8 names, fixed three programmes. Rejection preserves outputs; normal reads heap-free. No live DSP/current identity, generic ABI/host registration/DAW claim or exceptional deadline guarantee.

Source: examples/gain-native/src/programs.rs, examples/gain-native/src/lib.rs, examples/gain-native/include/RavetGainPrograms.h.

Tests: examples/gain-native/src/programs.rs, tools/native-validation/programs.cpp, tools/native-validation/CMakeLists.txt.

Documentation: docs/parameters.md, docs/vst3.md, docs/decisions/0083-native-gain-programs.md.

Optional VST3 factory program mapping

An explicit build maps Rust gain programs to one SDK root/list/selector, complete host value refresh and sample-timed expanded processor control events.

Limits: Default-disabled --factory-programs, macOS arm64/SDK 3.8.1 validated only. ID3 nonautomatable selector, no persisted current identity. Host delivers complete values after optional notification; rollback is local. Raw/expanded events <=1024 (512 program-only), existing smoothing/bypass. No DAW/other-format/menu UI/MIDI/deadline claim.

Source: examples/gain-vst3/src/gain.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, examples/gain-native/src/programs.rs.

Tests: tools/vst3-validation/programs.cpp, tools/vst3-validation/contracts.cpp, tools/vst3-validation/editor.cpp.

Documentation: docs/vst3.md, docs/decisions/0084-vst3-factory-programs.md.

Optional AUv2 factory program mapping

An explicit component build maps three complete gain programs to AU factory presets and block-start selector recall with coherent host bypass.

Limits: Default-disabled --factory-programs; macOS arm64 in-process reference only. ID3 finite normalized nearest/ties-up, offset zero only. Explicit factory bypass recall differs from saved-state host-bypass preservation; custom negative preset metadata accepted. AUBase effect dispatch/document restore only, no instrument/ProcessBufferLists, DAW/auval/other architecture or persisted program identity claim.

Source: examples/gain-au/programs.mm, examples/gain-vst3/CMakeLists.txt, scripts/bundle-au.py.

Tests: tools/au-validation/programs.mm, tools/au-validation/contracts.mm, tools/au-validation/editor.mm.

Documentation: docs/audio-unit.md, docs/decisions/0085-auv2-factory-programs.md.

Interactive example device and MIDI ownership

Native synth/effect/MPE windows use knobs, a layered piano widget, default Audio/MIDI settings, coherent meters/voices, selected channel routing and multiple MIDI inputs; MIDI 2.0 provides an interactive codec inspector.

Limits: macOS live-ui feature, f32 streams with up to 64 channels and output rates 8..192 kHz; 512-frame prepared sub-blocks, 16 fixed patch commands, up to 16 MIDI inputs with 256 packets each and 64 polling attempts/block. Arrival-time MIDI/edits are block-quantized; queue loss clears voices. All four tabs uniformly scale a fixed 900x780 canvas with locked 900:780 content aspect; native viewport, component dimensions/positions and bounds checked at 720x624, 900x780, 1080x936 and constrained wide/tall requests. Explicit device selection/start; stop before changes, no automatic recovery, timestamp mapping or broad device/deadline support claim. Audio/MIDI preferences restore without automatic start; a main Start/Stop control reuses current selections.

Source: examples/tutorials/src/ui/mod.rs, examples/tutorials/src/ui/audio.rs, examples/tutorials/editor/index.html.

Tests: examples/tutorials/src/ui/audio.rs, examples/tutorials/src/ui/mod.rs.

Documentation: docs/examples.md, docs/native-editor.md, docs/decisions/0132-standalone-settings-and-knobs.md.

RAVET Foundry project creation and builds

A RAVET-native wizard and shared Rust CLI create independent offline, standalone and effect/instrument plug-in workspaces, reopen versioned TOML settings, preserve consumer source during conflict-checked regeneration and run explicit background builds/local bundles with native directory pickers.

Limits: Local checkout paths, offline/application/plug-in templates, immutable package/kind/processing role, bounded settings/messages/logs and one worker. Seven whitelisted directory fields, <=4096-byte paths, native modal choosers with transient sequenced selection and unchanged cancellation; macOS chooser/bridge evidence, Windows/Linux execution pending. Effect CLAP/VST3/AUv2/AUv3/AAX/LV2 and instrument CLAP/VST3/AUv2/LV2 reference adapters; external SDKs and native CMake3.25. Standalone/custom effect editor use macOS Rust window bindings. Windows x64 MSVC and Linux GTK3/WebKitGTK4.1/X11 native Foundry launchers/source-build guides supplied; target runtime validation pending. Per-file replacement, no group crash atomicity or protection against external writers; closing cancels direct child only. No MPE/component/module/platform chooser, instrument AAX/AUv3 exporters, cross/universal builds, global installation, production signing or platform/DAW/deadline claim.

Source: tools/foundry/Cargo.toml, tools/foundry/src/lib.rs, tools/foundry/src/project.rs, tools/foundry/src/templates.rs, tools/foundry/src/native_templates.rs, tools/foundry/src/exports.rs, tools/foundry/native/plugin.cmake, media/ravet_LOGO.svg, tools/foundry/src/controller.rs, tools/foundry/src/directories.rs, tools/foundry/src/picker.rs, tools/foundry/build.rs, tools/foundry/native/DirectoryPicker.mm, tools/foundry/native/DirectoryPicker.cpp, tools/foundry/native/DirectoryPicker.h, tools/foundry/src/ffi.rs, tools/foundry/src/main.rs, tools/foundry/web/index.html, tools/foundry/native/main.cpp, tools/foundry/CMakeLists.txt.

Tests: tools/foundry/tests/projects.rs, tools/foundry/src/main.rs, scripts/check-foundry.py.

Documentation: docs/foundry.md, docs/project-starters.md, docs/decisions/0194-foundry-project-management.md.

CLAP bundling and smoke host

A Python bundler creates a local optimized or debug artifact; a native development host loads it and checks automation, ports, flush, lifecycle, and active state recall.

Limits: macOS bundling uses an ad hoc signature. Windows/Linux packaging paths are untested. No automatic installation or production signing. Load trusted RAVET bundles only.

Source: scripts/bundle-clap.py, tools/clap-smoke/src/lib.rs, tools/clap-smoke/src/main.rs.

Tests: examples/gain-clap/tests/host.rs.

Documentation: docs/getting-started.md, docs/decisions/0002-clap-backend.md.

Disposable REAPER validation harness

Public ReaScript checks host discovery, parameter state, editor window creation, automation playback and saved-session recall; Python generates synthetic stereo audio and verifies actual DAW-rendered output. The native meter prototype requires a public marker and empty project before mutations.

Limits: Requires an empty disposable REAPER session and resource directory. Startup/evaluation/audio dialogs may need owner interaction. REAPER 7.82/macOS arm64 actual session/automation, PCM stem renders and GUI gain recording pass. Render source must be verified explicitly in the host dialog. FX-chain zoom/restore inspected; floating-wrapper corner resizing unverified. Native VST3 meter forwarding and editor window handle pass in REAPER 7.82/macOS arm64; visual/assistive-tech behavior remains unvalidated. No production host support or deadline claim.

Source: tools/reaper-validation/validate.lua, tools/reaper-validation/ui-check.lua, tools/reaper-validation/prepare.py, tools/reaper-validation/check-renders.py, tools/reaper-validation/native-meters.lua.

Tests: tools/reaper-validation/test_checks.py, tools/reaper-validation/validate.lua, tools/reaper-validation/ui-check.lua.

Documentation: docs/host-validation.md, docs/WORK_STATUS.md.

Runtime contract workflow configuration

A three-platform GitHub workflow configures workspace formatting/tests/lints/Rustdoc and a separate macOS built-CLAP ABI smoke job with two Cargo workers.

Limits: Workflow parsed locally and constituent macOS commands exercised; remote matrix execution pending. No Linux/Windows runtime, DAW/device/GUI/deadline, licensed-SDK, production signing or publication claim.

Source: .github/workflows/runtime.yml.

Tests: .github/workflows/runtime.yml, tools/clap-smoke/src/lib.rs.

Documentation: docs/runtime-validation.md, docs/WORK_STATUS.md.

Explicit bounded local-video worker frames

A separate macOS reader opens selected local video, reports first-track oriented metadata and extracts independently timestamped complete owned RGBA frames through a private AVFoundation boundary.

Limits: Thread-confined UI/worker API, UTF8 paths <=4096 bytes, regular files <=2 GiB, duration (0,24h], oriented dimensions 1..4096 and returned pixels <=64 MiB. Native decode allocations/I/O/time are not globally bounded. Codec/container/color conversion follow OS; requested zero timestamp tolerance may reject between-frame positions. No whole-file integrity, automatic playback/audio/AV sync/network URL/DRM/GPU view/device/other-platform/deadline claim.

Source: crates/ravet-media/Cargo.toml, crates/ravet-media/build.rs, crates/ravet-media/src/lib.rs, crates/ravet-media/src/macos.rs, crates/ravet-media/native/Video.mm.

Tests: crates/ravet-media/tests/video.rs, crates/ravet-media/tests/fixtures/README.md.

Documentation: docs/local-video.md, docs/decisions/0178-bounded-local-video-worker.md.

Explicit bounded Metal offscreen rectangles

A separate macOS renderer prepares a native Metal pipeline and draws ordered portable filled rectangles with source-over blending into independent owned RGBA readback images.

Limits: Thread-confined UI/worker API, dimensions 1..4096, at most4096 raw rectangles, returned pixels <=64 MiB and conservative clear/covered-pixel work <=67,108,864. Coordinates clip then quantize to f32; no antialiasing or gamma/color-space transform. Native transient resources/driver work and creation/submission/wait/readback/destruction are not globally memory/time bounded. System-selected Metal GPU required, no software fallback. No window/presentation/path/text/image/rounded corners/other-platform/deadline claim.

Source: crates/ravet-metal/Cargo.toml, crates/ravet-metal/build.rs, crates/ravet-metal/src/lib.rs, crates/ravet-metal/src/macos.rs, crates/ravet-metal/native/Metal.mm.

Tests: crates/ravet-metal/tests/metal.rs.

Documentation: docs/metal-drawing.md, docs/decisions/0179-metal-offscreen-rectangles.md.

Reusable AUv2 native schema, control, text and state preflight

Apple-SDK C++17 helpers own an immutable native schema cache and isolated complete-state validator, providing full UInt32 IDs/CF metadata, canonical normalized-f32 setter preflight, complete physical text conversion and exact native-stream/AU dictionary preflight before SDK mutation; the public performance component consumes both.

Limits: 1..1024 global descriptors, default32 or explicit32/64 matching native companion tables; audio precision never changes normalized0..1 AU f32 controls or complete physical f32 state/text. Offsets below65536, <=128 ASCII physical parse units and native state<=8208bytes. CF metadata/text and validator lifecycle require serialized control ownership and can allocate; scalar preflight owns no SDK scheduling/notifications, rendering or host-bypass policy. Exact originating tables/library must outlive helpers. No backend rollback, groups/choice labels, f64 control, DAW/auval/device/sandbox/deadline/other platform support claim; macOS arm64 actual module/component evidence only.

Source: crates/ravet-native/include/RavetAuParameters.hpp, crates/ravet-native/include/RavetAuState.hpp, examples/performance-au/PerformanceAU.mm, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/native-parameters.cpp, tools/au-validation/native-precision-schema.cpp, tools/au-validation/performance.mm, tools/au-validation/performance-precision.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/native-processing.md, docs/performance-au.md, docs/decisions/0182-auv2-native-schema-control-state.md, docs/decisions/0203-auv2-performance-audio-precision.md.

Explicit bounded Metal bitmap scenes

Immutable validated owned premultiplied RGBA8 assets and borrowed ordered rectangle/image commands provide clipped nearest-sampled source-over GPU composition, independent readback adoption and explicit local-video frame upload.

Limits: MacOS thread-confined UI/worker renderer; assets1..4096 dimensions/exact bytes/RGB<=alpha, raw commands<=prepared4096, distinct referenced objects<=16 and total distinct upload bytes<=64MiB, even clipped; clear/covered work<=67108864. Geometry/UV f32 quantization, nearest edge-clamped numeric components, no implicit gamma/color conversion. Fresh native textures per call; driver transient memory/time unbounded. No implicit reader/window/clock/tint/path/text/high-quality resampling/other-platform/deadline claim.

Source: crates/ravet-metal/src/bitmap.rs, crates/ravet-metal/src/scene.rs, crates/ravet-metal/src/macos.rs, crates/ravet-metal/native/Metal.mm, crates/ravet-metal/native/Scene.inc, crates/ravet-metal/build.rs.

Tests: crates/ravet-metal/tests/images.rs, crates/ravet-metal/tests/metal.rs.

Documentation: docs/metal-drawing.md, docs/decisions/0183-metal-bitmap-scenes.md.

Prepared AUv2 native planar audio bus mapping

An Apple-SDK C++17 mapper validates explicit native main/auxiliary layouts and complete compact AU planar f32 AudioBufferLists before publishing caller-owned fixed native pointer arrays; rejected configuration/mapping retains prior state, and the performance component consumes it for prepared/caller preflight.

Limits: 1..9 logical bus pairs,0..64 channels per direction with nonempty active pairs,1..65536 prepared frames. Exact compact direction counts/planar shapes, byte capacity, alignment/address and disjoint output prefixes required; input/output aliases allowed. Live foreign memory/disjoint metadata remain caller obligations. No DSP preparation/ownership, format negotiation, automatic silence/registration/routing, AU f64, DAW/auval/device/sandbox/deadline claim. Local macOS arm64 native/helper/component evidence; counted C++ heap alone does not prove all backend/SDK/Rust allocation.

Source: crates/ravet-native/include/RavetAuAudio.hpp, examples/performance-au/PerformanceAU.mm, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/audio.cpp, tools/au-validation/performance.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/performance-au.md, docs/decisions/0185-auv2-prepared-native-audio-buses.md.

Validated AUv2 block-start host transport

An external Apple-SDK C++17 collector validates independently available host callback tuples before publishing a canonical read-only native transport snapshot; the public performance AU adopts its explicit VST3 projection before parameter transfer and DSP.

Limits: Serialized AudioUnitRender only, live coherent host callbacks/user data required. Float64 sample precision inherited, exact integral range [-2^63,+2^63), u16 signatures, strict Booleans and ordered finite active beat loops. DETAILS unknown/default placeholders require callbacks sidecar; only State2 supplies recording, neither callback supplies pre-roll/sample loops/native bar pairs. Projection omits partial transport lacking playing/samples and native discontinuity/availability. AUBase timestamp cache includes failures; recovery uses new timestamp. Performance DSP ignores transport. Local macOS arm64 helper/native/component evidence only; no DAW/auval/device/sandbox/architecture/deadline or production claim.

Source: crates/ravet-native/include/RavetAuTransport.hpp, crates/ravet-native/include/RavetAuVst3Transport.hpp, examples/performance-au/PerformanceAU.mm, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/transport.cpp, tools/au-validation/performance.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/performance-au.md, docs/decisions/0188-auv2-block-start-transport.md.

Prepared LV2 block-start time:Position transport

An external-SDK C++17 collector validates bounded exact-encoding Position objects before publishing direct native transport; the opt-in reusable instrument profile forwards block-start context only after full MIDI/control/time preflight, and the public Performance bundle consumes it.

Limits: 14 distinct nonzero stopped-cached URIDs; live8-byte aligned Sequence body8..65536,1024 ordered raw events and128 unique keys per Position. Long frame,Double beat,Float BPM/speed/numerator,Int denominator exact profile; finite/integral u16 signatures, speed only0/1. At most1offset0Position, laterPositions validate then omit without extrapolation/carry. Missing fields unknown/null; signature DETAILS recording/loop/pre-roll false flags unknown/default, no per-flag availability. Unknown properties/bodies opaque bounded, no recursive validation. No effect Atom port/genericbus factory, timeline output/discontinuity/loops/bar inference. Local macOS arm64; no Linux runtime/DAW/device/deadline/metadata-validator/production claim.

Source: crates/ravet-native/include/RavetLv2Transport.hpp, crates/ravet-native/include/RavetLv2Processor.hpp, examples/performance-lv2/performance.cpp, examples/performance-lv2/performance.ttl, examples/gain-lv2/CMakeLists.txt, scripts/lv2_bundle.py.

Tests: tools/lv2-validation/transport.cpp, tools/lv2-validation/processor-transport.cpp, tools/lv2-validation/performance.cpp, tools/lv2-validation/contracts.cpp, tools/lv2-validation/state.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: docs/lv2.md, examples/performance-lv2/README.md, docs/decisions/0191-lv2-block-start-time-position.md.

Bounded AUv2 native MIDI output delivery

A reusable SDK-independent canonical short-MIDI converter and fixed CoreMIDI packet owner stage complete native output before one AU host callback, with exact refusal receipts, stable borrowed bytes and stale/reentrant delivery guards; an actual synthetic AudioComponent proves consumer adoption.

Limits: At most1024 ordered native records and65536frames; exact canonical MIDI1 short bytes and ordinary nonidentity NoteOn/Off only. Velocity nearest/ties-up MIDI7, positiveOn minimum1, zeroOn wire0 with receiver Off convention. Identity/scoped/completion/choke/expression/parameter/UMP/SysEx unsupported. Failed stage preserves diagnostic packet bytes/count but invalidates readiness; every delivery consumes readiness, host acceptance unknown on refusal and no retry/history rollback. Exclusive live ownership/foreign ranges/host nonthrowing callbacks required; no callback deadline/allocation guarantee. Local AudioToolbox setters normalize original facade size/elements and may bypass owned SDK lifecycle validation. Public Performance remains no-output; synthetic component is fixture-only. Local macOS arm64 offline; no DAW/device/routing/production factory/other architecture support.

Source: crates/ravet-native/include/RavetNativeMidiOutput.hpp, crates/ravet-native/include/RavetAuMidiOutput.hpp, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/midi-output.cpp, tools/au-validation/midi-output-component.mm, tools/au-validation/performance.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/decisions/0197-auv2-native-midi-output.md.

Prepared AUv2 native f64 mapping and complete formats

Explicit float/double prepared main/aux pointer mappings and complete stopped native/ASBD profiles validate exact sample precision, whole directional formats and output ranges before publication; an actual fixed-f64 synthetic AudioComponent proves native64 rendering and stopped complete Level recall.

Limits: f32 existing names preserved; explicit f64 aliases, no sample conversion/inference. Native1..9buses,1..64channels per nonempty direction,65536frames; compact independent directional AU indices,576output range scratch. Matching structural native table/header/function precision and exact finite equal-rate native packed float ASBD bits/bytes/channels/flags/reserved preflight; rejects retain prior helper config/formats/maps. Foreign origin/lifetime/range ownership remains caller duty. SDK registration/allocation/notification rollback not provided; stock SDK original ASBD size/reserved/padding normalization and unchanged active no-op remain explicit. Actual synthetic fixed64 mono/stereo no-input reference/complete f32 Level only; no AU parameter UI/cross-precision migration/aux host registration. The distributed Performance AU separately adopts explicit32/64 through its checked lifecycle; this helper alone provides no SDK registration. Local macOS arm64 offline, no DAW/device/production factory/other architecture/backend-allocation/deadline claim.

Source: crates/ravet-native/include/RavetAuAudio.hpp, crates/ravet-native/include/RavetAuAudioFormat.hpp, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/audio.cpp, tools/au-validation/audio64.cpp, tools/au-validation/precision-component.mm, tools/au-validation/performance.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/decisions/0199-auv2-native-f64-formats.md.

Measured standalone content size and grid workspace consumption

The existing main-thread standalone owner exposes actual logical content extent and a complete resizable HTML workspace consumes Rust grid output while preserving default Audio/MIDI settings.

Limits: macOS12+ Cocoa/WebKit/Xcode only; content_size reads finite positive native bounds or None without resizing/callbacks. Native aspect fitting/rounding can differ from requests; user-resize minima do not guarantee programmatic clamping; sample after pump. Existing !Send/!Sync/parent editor borrow/drop unchanged. Fixed five-panel consumer selects explicit two/three-column grid; latest-only geometry waits for viewport within1point and resize retries without bridge redelivery; box presentation>=26points, invalid snapshots rejected, TooSmall retains previous presentation. Standard settings enabled by default; no devices opened and unavailable inventory explicit; hidden native fixture settings process-local. Two actual owned hidden windows/12measured viewport transitions plus default popup/invalid-request/teardown checks, four actual Chromium Rust-derived grid sizes/undersized retention, seven transport groups and trusted text/checkbox input/focus/selection retained across resize pass; no other platform,AX/screenreader,hardware,DAW or deadline certification.

Source: crates/ravet-webview/src/standalone.rs, crates/ravet-webview/native/StandaloneWindow.mm, examples/tutorials/src/bin/layout_workspace.rs, examples/tutorials/src/layout_workspace/geometry.rs, examples/tutorials/src/layout_workspace/index.html.

Tests: crates/ravet-surface/tests/grid.rs, examples/tutorials/src/bin/layout_workspace.rs.

Documentation: docs/grid-layout.md, docs/native-editor.md, examples/tutorials/README.md, docs/decisions/0220-explicit-grid-measured-window.md.

Explicit stopped native output processor recovery

Failure-owned preparation and an additive f32 CPAL output owner return the exclusive original processor after explicit asynchronous callback retirement, allowing matching buffered-file stopped seek and explicit reopening.

Limits: No new dependency; tool conversion forwarding default-disabled. Existing 1..64 output-channel and 1..65,536 scratch-frame f32 profile; scratch preflight/fallible allocation before foreign prepare, failed-prepare inactive contract. Legacy consuming APIs preserved. One dedicated control retirement worker per opened owner; callback captures unique guarded shared-cell owners plus primitives only. Narrow audited UnsafeCell/Sync boundary: unique FnMut data borrow, error callback separate atomics, worker never accesses renderer until BOTH Acquire retirement flags and stable sole strong ownership prove callback borrows and Arc fields gone; no Weak/public clones. Normal framework capture Drop performs no allocation/deallocation/lock/wait or processor deactivation, including receiver early drop and asynchronous backend disposal. CPAL/OS callback closure allocation/storage/locks/destruction and panic runtime remain distinct backend/exceptional limits. Pending control poll does not wait; explicit wait joins control without deadline/cancellation. Original preparation/spawn/backend errors retain Immediate/Pending ownership, no hidden retry. Caught worker poll panic returns WorkerFault with exclusive owner after retirement; foreign deactivation panic may lose recovery and cannot manufacture success. Processing panic disables DSP permanently; recovered owner does not guarantee valid history. Option-owned consuming extraction deactivates once, requires explicit reprepare/reopen and no live mutable renderer escape. Actual converted BufferedPlaybackOutput retains unique consumer for matching stopped seeks; local silent CoreAudio20ch/96000Hz recovery/reopen plus257-frame zeroWAV44100Hz/Sinc16 retained590 drain, failed/successful seek17 and exact573 remaining drain pass. Underflows3562/7145 observed separately; no live mailbox, clock/drift, arbitrary endpoint recovery, broad physical-device/platform support or callback/teardown deadline claim.

Source: crates/ravet-device/src/lib.rs, crates/ravet-device/src/reclaimable.rs, crates/ravet-device/Cargo.toml, tools/device-probe/src/bin/reclaimable-output.rs, tools/device-probe/Cargo.toml.

Tests: crates/ravet-device/src/reclaimable_tests.rs, crates/ravet-device/tests/buffered_file_output.rs, tools/device-probe/src/bin/reclaimable-output.rs.

Documentation: docs/audio-devices.md, docs/decisions/0216-reclaimable-native-output.md.

Output-clock buffered file and captured-input processing

An explicit f32 processor owner combines unique buffered file PCM with existing output-clock-converted capture, forwards file transport by bounded segments and preserves committed history and original downstream faults.

Limits: Existing optional resampled-playback; no new dependencies/defaults. Outer capture/output1..64, file+capture child inputs<=64, file-first/capture-second ordering, queue/child/output rate equal, zero events/output events/auxiliary buses and f32 only. Prepared arrays<=32MiB plus existing source/converter/FIFO/reader/ring/allocator storage, callback bound<=prepared file maximum. Actual PreparedClockedDuplex sinc/FIFO/priming/underflow/reset/recovery unchanged; no file queue drift estimator or inferred timestamp origin/start alignment. At most two child calls separate consumed file prefix from paused/underrun/EOF zeros; capture/DSP continue. Child transport carries queue output-frame positions, unavailable abovei64MAX, not decoder or device coordinates; fresh prepare/stopped jump discontinuity, zero blocks preserve state, no beat/tempo inference. Typed counters/relaxed monitor separate source consumption, file underrun/EOF/worker status, logical accepted device frames including poisoned silence and child calls/faults; not audible completion or coherent clock/latency. Original child ProcessError retained while outer post-consumption faults use BackendFailure, full block silenced and no further source/child work until reset/reprepare; prior source/child history cannot roll back. Reset pauses retaining cursor/queue; prepare does not consume/reset file. Source Failed drains prefix without EOF and original error remains on worker shutdown. Direct stopped Option-owner extraction deactivates once without read/seek/drain/join; caller-managed session hooks preserved, foreign lifecycle panics exceptional. Native clocked closure remains inaccessible, no live seek/ownership migration; recovery factory restores fresh source/DSP explicitly. Synthetic ±500ppm canonical consumer, stereo grouping, real PCM worker failure and heap receipts only. No new physical device/clock alignment/drift/recovery/long-session latency/deadline claim.

Source: crates/ravet-device/src/buffered_file_duplex.rs, crates/ravet-device/src/clocked.rs.

Tests: crates/ravet-device/tests/buffered_file_duplex.rs, crates/ravet-device/tests/clocked.rs, crates/ravet-device/tests/clocked_input.rs.

Documentation: docs/audio-devices.md, docs/audio-files.md, docs/decisions/0228-output-clock-file-capture-processing.md.

Explicit integer-rate sinc scheduling for bounded-memory long file streams

Caller-selected exact integer-rate input/output scheduling extends converted read-ahead beyond the floating profile's source ceiling, with checked finite output duration, original-error ownership and stopped same-version replay.

Limits: No new dependency. Signal constructor accepts positive u32 rates, ratio 1/16..16 and even 16..256 taps; bounded signed relative numerator independent of duration, f64 used only for coefficient/table interpolation. Existing fixed/variable floating arithmetic and APIs remain; integer mode allows zero ppm only and reset restores exact initial phase. Explicit PlaybackConversion::IntegerSinc is an added exhaustive enum variant; consumers must handle it. Equal rates still filter, fractional delay (taps-1)/2 and explicit finite padding/retained-tail policy remain, no hidden copy/trim. New mode can differ in PCM at phase boundaries; no spectral guarantee beyond scoped fixtures. Complete-file sample/clip memory limits remain. Integer read-ahead source bounds are caller usize with independent reader/container/sample caps; checked u128 retained count must fit configured u64 budget and be <=u64::MAX-65536 for largest automatic callback terminal render headroom. An oversized unused budget alone need not reject. Existing Copy/Sinc source ceiling remains 16,777,216 frames. Worker rate 1..768000/channels 1..64/batches 1..4096/arrays 32MiB and separately prepared ring limits remain. Determinable bounds reject before reader/factory I/O; committed cursor/prefix/error ownership preserved. Stopped fresh-reader replay remains O(target), bounded memory, same-version caller obligation and no cancellation/deadline; failed candidate preserves old generation/queue/phase/suffix/cursor, factory side effects not rolled back. Actual prepared output integration preserves unique consumer and explicit stopped reprepare/reopen semantics. No arbitrary-u64 terminal playback, indexed codec seek, RF64/long compressed-reader, live clock/drift, broad physical support or callback deadline claim.

Source: crates/ravet-signal/src/resampling.rs, crates/ravet-audio-file/src/file_playback.rs, crates/ravet-audio-file/src/converted.rs.

Tests: crates/ravet-signal/tests/integer_resampling.rs, crates/ravet-signal/tests/integer_quality.rs, crates/ravet-audio-file/tests/long_converted.rs, crates/ravet-audio-file/tests/long_wave.rs, crates/ravet-device/tests/file_output.rs, crates/ravet-device/tests/buffered_file_output.rs.

Documentation: docs/signal-processing.md, docs/audio-files.md, docs/decisions/0221-explicit-integer-rate-file-scheduling.md.

Indexed finite-history integer PCM playback

An explicit known-duration integer-sinc pump rebuilds stopped WAV/AIFF output seeks from a bounded original history window, preserving old playback on candidate failure and separating source work from skipped coordinates.

Limits: Optional resampled-playback; no new dependencies or defaults. IndexedPlaybackReader built-ins are WAV/AIFF Read+Seek only, known stable duration, exact original-frame positioning; no compressed implementation. IntegerSinc-only separate pump; legacy floating/live/replay/empty semantics and counters unchanged. Immutable u128 schedule coordinate and finite chronological history priming preserve coefficients/delay and invalid atomic state. Candidate validates <=taps original frames plus at most one bounded EOF probe; custom short readers use <=taps positive calls, primary full-read PCM uses ceil(window/batch). Metadata factory/backend work and latency separate. Direct failure returns original error and optional advanced candidate reader, old queue/phase/suffix/cursor/generation preserved; generic worker seek releases failed candidate on control. Rich counters separate window validation, actual cursor commits (including errors), source/padding submission after prime and absolute/per-generation output; skipped prefixes not decoded or submitted. Exact retained endpoint validates final window/EOF without priming nonexistent output; known empty supported only in new indexed pump. Temporary scratch <=66KiB plus each state's <=32MiB arrays; old/candidate coexist, reader/ring/allocator separate. Existing rate/channel/batch/container/usize and configured bounds remain, retained output <=u64::MAX-65536. Same-version content caller obligation; skipped regions not authenticated. Actual offline worker/PreparedOutput unique-consumer recovery/reprepare/pause/EOF and heap-free rendering evidence only. No compressed indexing, RF64, live callback seek/wait, clock/drift, filesystem deadline or broad physical support claim.

Source: crates/ravet-signal/src/resampling.rs, crates/ravet-audio-file/src/file_playback.rs, crates/ravet-audio-file/src/indexed.rs, crates/ravet-audio-file/src/converted.rs.

Tests: crates/ravet-signal/tests/integer_priming.rs, crates/ravet-audio-file/tests/indexed.rs, crates/ravet-audio-file/tests/indexed_failures.rs, crates/ravet-audio-file/tests/indexed_long_wave.rs, crates/ravet-device/tests/indexed_buffered_output.rs.

Documentation: docs/audio-files.md, docs/signal-processing.md, docs/decisions/0224-indexed-integer-pcm-seeking.md.

Bounded native LV2 short MIDI output

An external-SDK fixed-storage stager and opt-in native LV2 processor profile admit full configured Atom Chunk capacity before state/DSP, stage canonical short MIDI and publish one complete timed Sequence.

Limits: f32 main instrument-input profile; output capacity1..1024 with zero retaining default Gain/Performance ports/calls; explicit prepared maximum frames1..65536. CONTROL cached URIDs and heap-resident owner scratch, actual caller extent/alignment/lifetime and stopped/joined lifecycle/restore/diagnostic exclusion. Full known Atom/control/table/owner/audio alias admission and safe16-byte empty only when independently admitted; no stale replay. Atomic AUDIO reentry refusal before active mutation; no general lifecycle scheduler/threadSafeRestore. Original returned state/native codes and latest actually returned process status separate from nonreturned exception/local errors. Whole input/control/time preflight before dequeue/history; post-DSP malformed output/reflect refusal has no history rollback. Canonical exact native origins depend on separately reviewed LV2 origin correction. Target-only normal/fast stager/authoritative history/refusal/throw/reentry fixtures, max1024 and10000 ordinary-C++heap-free cycles; Root source/dependency review and fresh actual Rust/C++ native/module/package replay accepted; public workspace and actual-host qualification remain separate. No generic raw input/SysEx/UMP/MIDI2/generated expression/identity, extra output ports/nativef64/aux host routing/editor/DAW/deadline or all-allocator/stack-peak proof.

Source: crates/ravet-native/include/RavetLv2MidiOutput.hpp, crates/ravet-native/include/RavetLv2Processor.hpp.

Tests: tools/lv2-validation/output.cpp, tools/lv2-validation/processor-output.cpp, tools/lv2-validation/routing.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: docs/lv2-output.md, docs/lv2.md, docs/decisions/0265-lv2-native-generated-output.md.

Packaged LV2 NoteRouting native reference

The explicit local note-routing LV2 profile consumes canonical Rust NoteRouting native tables, with mono/stereo silent audio, complete Level recall, timed note output and block-start transport.

Limits: macOS arm64 local qualification; external LV2 headers, hostf32 audio, Level ID1/default1,24-byte state; channel/key-only scoped release is explicit reference policy. Maximum1024 frames/combined changed-controls+notes/generated events; host Chunk total24592/body24584 required even empty runs and reset every call. Actual independent module MIDI/timing/order/padding/max/capacity/alias/backing-tail/zero-frame/recall and2000 ordinary-C++heap-free/map-free calls; maintained CMake12 incl default Gain/Performance and all6 packaged mandatory validators/signature, Python6 refusal propagation. Pipeline explicitly substitutes recorded canonical Rust archives rather than claiming a fresh Cargo build. Separate root current-source Cargo builds all three native references, twelve native profiles and maintained NoteRouting packaging with actual Cargo, six mandatory validators and strict ad-hoc verification pass; public workspace and real LV2 host/otherplatform acceptance remain separate; no installation or production distribution claim.

Source: examples/note-routing-lv2/routing.cpp, examples/note-routing-lv2/manifest.ttl, examples/note-routing-lv2/routing.ttl, examples/gain-lv2/CMakeLists.txt, scripts/lv2_bundle.py, scripts/bundle-lv2.py.

Tests: tools/lv2-validation/routing.cpp, tools/lv2-validation/processor-output.cpp, tools/lv2-validation/output.cpp, tools/lv2-validation/origin.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: examples/note-routing-lv2/README.md, docs/lv2-output.md, docs/decisions/0265-lv2-native-generated-output.md.

Planned capabilities

Production distribution and compatibility

Establish supported platform, architecture, toolchain, and DAW matrices, release packaging, and project templates.

Limits: Packages are unpublished; MSRV and support matrices are unset. Commercial agreement and release dependency notices remain pending.

Documentation: docs/WORK_STATUS.md, LICENSING.md, docs/decisions/0006-distribution-policy.md.

Standalone device playback

Run the portable processor through a separate audio-device adapter.

Limits: The gain executable remains offline. Explicit CPAL output/input/FIFO duplex adapters exist separately; a complete user-facing standalone application, hotplug and MIDI integration remain pending.

Documentation: docs/WORK_STATUS.md, PROJECT_HANDOFF.md.

Additional formats and advanced tooling

Extend formats, mobile/UI, graph, DSP/codec and application facilities beyond the current scoped implementations.

Limits: Planned work; no usable additional integrations are claimed. SDK access and target-platform validation remain necessary.

Documentation: PROJECT_HANDOFF.md.

Excluded capabilities

VST2 support

VST2 is explicitly outside the project's scope.

Limits: Do not add adapters, bindings, compatibility layers, exports, templates, or validation targets.

Documentation: PROJECT_HANDOFF.md.

Proprietary consumer product publication

Proprietary consumer implementations, assets, fixtures, and wrappers stay in separate private projects and are excluded from public RAVET publication.

Limits: Stable ID retained from the earlier private product placeholder. Review Git history as well as the working tree before public publication.

Source: scripts/check-publication.py.

Tests: scripts/tests/test_publication.py.

Documentation: docs/publication.md, CONTRIBUTING.md.

Workspace packages

Generated from workspace member manifests. Descriptions identify package roles; feature records above determine implementation status.

Package Description Manifest
ravet Rust Audio Visual Engineering Toolkit crates/ravet/Cargo.toml
ravet-audio-file Bounded WAV/AIFF and optional compressed audio streams with prepared handoff crates/ravet-audio-file/Cargo.toml
ravet-bus-routing-native Public native main, detector and auxiliary routing reference examples/bus-routing-native/Cargo.toml
ravet-clap Provisional CLAP bridge for portable RAVET effects crates/ravet-clap/Cargo.toml
ravet-clap-smoke Development host that loads and exercises a built RAVET CLAP bundle tools/clap-smoke/Cargo.toml
ravet-core-midi Explicit macOS CoreMIDI UMP ports and bounded callback handoff crates/ravet-core-midi/Cargo.toml
ravet-data Bounded control-thread XML and legacy data compatibility primitives crates/ravet-data/Cargo.toml
ravet-device Explicit standalone audio device adapter for RAVET crates/ravet-device/Cargo.toml
ravet-device-probe Explicit standalone and offline audio device/graph validation for RAVET tools/device-probe/Cargo.toml
ravet-editor-smoke Native macOS main-loop host probe for the RAVET Gain CLAP editor tools/editor-smoke/Cargo.toml
ravet-embedded Fixed-capacity no_std audio adaptation for embedded RAVET consumers crates/ravet-embedded/Cargo.toml
ravet-embedded-gain Allocation-free stereo gain reference for embedded Rust and C consumers examples/embedded-gain/Cargo.toml
ravet-examples Interactive subtractive synth, effect, MPE and MIDI 2.0 examples examples/tutorials/Cargo.toml
ravet-foundation Portable processor contracts and shared audio types for RAVET crates/ravet-foundation/Cargo.toml
ravet-foundry RAVET project creation, configuration and build application tools/foundry/Cargo.toml
ravet-gain Portable gain reference processor and offline harness for RAVET examples/gain/Cargo.toml
ravet-gain-clap CLAP export of the RAVET gain reference processor examples/gain-clap/Cargo.toml
ravet-gain-native Narrow native ABI for the portable RAVET gain reference examples/gain-native/Cargo.toml
ravet-graph Explicit prepared acyclic audio routing and processor scheduling crates/ravet-graph/Cargo.toml
ravet-host Explicit CLAP hosting and optional VST3/AUv3 native ownership crates/ravet-host/Cargo.toml
ravet-instrument Portable bounded MIDI/native performance voices, RPN negotiation and reference sine synthesis crates/ravet-instrument/Cargo.toml
ravet-media Explicit bounded local-video worker services for RAVET crates/ravet-media/Cargo.toml
ravet-metal Explicit bounded macOS Metal offscreen drawing for RAVET crates/ravet-metal/Cargo.toml
ravet-midi-device Explicit MIDI device connections and bounded packet handoff for RAVET crates/ravet-midi-device/Cargo.toml
ravet-native Native processor, event, transport and schema/state adaptation for RAVET crates/ravet-native/Cargo.toml
ravet-native-dsp Explicit native floating policy, packed values and prepared vector operations crates/ravet-native-dsp/Cargo.toml
ravet-osc Explicit bounded OSC packet codecs and worker-thread UDP transport crates/ravet-osc/Cargo.toml
ravet-performance-native Public native f32/f64 identified-performance sine reference examples/performance-native/Cargo.toml
ravet-preset Explicit bounded preset-file libraries for RAVET observable state crates/ravet-preset/Cargo.toml
ravet-runtime Explicit control-thread files, HTTP, owned tasks and timers for RAVET crates/ravet-runtime/Cargo.toml
ravet-runtime-ffi Narrow native ABI for Rust RAVET control-thread runtime services crates/ravet-runtime-ffi/Cargo.toml
ravet-sidechain-clap Native f32/f64 CLAP sidechain bus validation reference examples/sidechain-clap/Cargo.toml
ravet-signal Audio processing building blocks for RAVET crates/ravet-signal/Cargo.toml
ravet-sine-clap CLAP MIDI instrument export of the portable sine synthesis reference examples/sine-clap/Cargo.toml
ravet-state Explicit control-thread observable trees, transactions, undo and preset records crates/ravet-state/Cargo.toml
ravet-surface Editors, controls, and visualisation for RAVET crates/ravet-surface/Cargo.toml
ravet-vst3-reference-native Portable keyed-sidechain and event-probe references behind the RAVET reference VST3 modules examples/vst3-reference-native/Cargo.toml
ravet-webview Main-thread macOS Cocoa/WebKit binding for RAVET editors crates/ravet-webview/Cargo.toml