Source snapshot · 12 October 2026

Prototype capabilities¶

Embedded gain and native Arduino processing subset¶

An allocation-free Rust stereo gain and caller-owned C ABI accompany a header-only C++11 stereo adapter/reference for Arduino cores without a Rust archive.

Limits: Immediate gain 0..4/default unity; Rust reference <=64 frames/eight events, C ABI block-start gain and <=128 samples. Native C++ stereo f32 timed parameters only, no arbitrary Rust DSP export. Matching C/Rust float ABI and pointer/exclusive lifetime obligations; explicit standalone panic policy. Arduino compile/link evidence only; no physical MCU/codec validation, audio-workload suitability or desktop gain parity.

Source: examples/embedded-gain/src/lib.rs, examples/embedded-gain/src/ffi.rs, examples/embedded-gain/include/RavetEmbeddedGain.h, embedded/arduino/src/RavetEmbedded.h, embedded/arduino/examples/OfflineGain/OfflineGain.ino.

Tests: examples/embedded-gain/tests/processing.rs, embedded/tests/bridge.c, embedded/tests/arduino.cpp, scripts/check-embedded.py.

Documentation: docs/embedded-projects.md, docs/decisions/0152-embedded-processing.md.

Extended block-start transport metadata¶

Optional portable details and checked bidirectional CLAP conversion preserve recording, active loop, pre-roll, signature, bar and tempo increment metadata.

Limits: Explicit details availability; CLAP cannot distinguish unknown/false status bits. Positive signature components, finite BPM/sample increment with tempo, bar with beats, active ordered loop bounds per known timeline. Native ingress ignores inactive loop fields; outgoing supplied inactive bounds reject. Sample/fixed-point rounding must preserve order. No extrapolation, DSP reset, mid-block updates or new DAW/device/deadline claim; offline macOS arm64 adapter evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/transport.rs, crates/ravet-host/src/transport.rs.

Tests: crates/ravet-clap/tests/transport.rs, crates/ravet-host/tests/transport.rs, examples/gain-clap/tests/bridge.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/decisions/0127-extended-block-transport.md.

Prepared acyclic processor routing¶

Owned portable f32/f64 nodes run in compiled topological order with channel mixing, parallel dry/wet routes, prepared latency compensation, bounded scratch and conservative tail declarations.

Limits: 128 nodes, 4096 connections, 65536 frames/path latency, 1024 input/output events per node, 64 MiB graph prepared audio/event storage. Later-node faults can leave preceding state advanced; explicit GraphStatus disables until reset. One selected native precision per graph; no implicit conversion, native discovery, GUI hosting or feedback cycles. Explicit filtered/generated event routes are a separate capability. Prepared whole-graph handoff is a separate capability.

Source: crates/ravet-graph/Cargo.toml, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-graph/tests/routing.rs, crates/ravet-graph/tests/precision.rs.

Documentation: docs/audio-graphs.md, docs/decisions/0029-prepared-audio-graphs.md, docs/decisions/0055-native-graph-precision.md.

Buffered f32 graph-worker device output¶

A prepared no-input graph retains its audio-owner session on an explicit worker and publishes retained whole-frame queue suffixes; a separate output processor silences/counts underflow with live atomic diagnostics.

Limits: No-input f32 fixed blocks, 0..1024 explicit events per direction and zero aux buses; 1..64 matching channels and 1..65536 frames. Worker scratch<=32MiB and consumer scratch<=16MiB outside graph/native caps, plus queue memory. Explicit thread/wake/priming/rate matching/stream stop/worker join/main retirement. No clock/resampling/automatic recovery/audio input/edit/asynchronous event scheduler or deadline guarantee; reset preserves pending/queued audio. Loaded public silent sine and UMC1820/macOS arm64 20-channel 96kHz 10-second output observation; no long-session/drift/fault/deadline or broader platform/device support.

Source: crates/ravet-device/src/graph_output.rs, crates/ravet-device/src/lib.rs, crates/ravet-audio-file/src/ring.rs, crates/ravet-graph/src/lib.rs.

Tests: crates/ravet-device/tests/graph_output.rs, tools/device-probe/src/bin/graph-output.rs.

Documentation: docs/audio-devices.md, docs/audio-graphs.md, docs/architecture.md, docs/plugin-hosting.md, docs/decisions/0117-buffered-graph-worker-output.md.

Queued audio input for native graph workers¶

Explicit matched input/output rings feed fixed f32 graph worker blocks, zero input shortages and preserve once-only input consumption through retained output publication.

Limits: 1..64 channels per direction, zero aux buses, fixed 1..65536 frames and graph 1024 event limit; combined worker scratch<=32MiB outside graph/native/queue caps. Outer malformed input/storage rejects before dequeue. Graph faults may consume input/advance histories, suppress faulty publication and retain error until reset without more drain; reset preserves queued/pending audio. Explicit rates/priming/wake/capture/stream stop/join/main retirement; no clock conversion/resampling/replay/physical capture/GUI/recovery/deadline claim. Loaded public native gain macOS arm64 offline evidence only.

Source: crates/ravet-device/src/graph_output.rs.

Tests: crates/ravet-device/tests/graph_input.rs, crates/ravet-device/tests/graph_output.rs, tools/device-probe/src/bin/graph-input.rs.

Documentation: docs/audio-devices.md, docs/plugin-hosting.md, docs/decisions/0124-buffered-graph-audio-input.md.

Buffered worker input-clock conversion¶

An explicit worker reuses prepared sinc/FIFO clock correction to publish graph-rate f32 input, retaining destination suffixes without repeated capture consumption or conversion.

Limits: Matched 1..64 queue channels, nominal integer 8000..192000 rates and existing sinc ratio/correction bounds; raw capacity 2..65536 power-of-two with matching clock capacity/interior target, fixed 1..65536 frames. Output block<=16MiB additional to converter/internal/source/destination queues. Priming/underflow zeros and independent counters retain existing policy. Explicit capture/rates/wake/graph/events/shutdown/join; no reset/resampling-timestamp/physical clock alignment/stability/deadline/hotplug/platform claim. Synthetic 96k-to-48k stereo and loaded native gain offline macOS arm64 evidence only.

Source: crates/ravet-device/src/clocked_input.rs, crates/ravet-device/src/clocked.rs.

Tests: crates/ravet-device/tests/clocked_input.rs, crates/ravet-device/tests/clocked.rs, tools/device-probe/src/bin/graph-input.rs.

Documentation: docs/audio-devices.md, docs/decisions/0125-buffered-clocked-input-worker.md.

Live prepared graph replacement in buffered workers¶

Already-prepared dynamic f32 graph engines share fixed worker input/output queues and consider live offers only after old audio suffixes publish, retaining main-owned retirement.

Limits: Exact prepared configuration, fixed graph 1024-event/worker32MiB limits; existing 1..4 handoff/retirement slots and separate per-graph/native memory budgets. Fresh renders return swap outcome, pending none; failed start/full retirement preserve old processing. Historical last_swap remains observable after processing faults. Fault latch/reset and once-only input/generated events remain. No reprepare/crossfade/tail drain/state migration/rate-layout-latency changes, GUI/event-generation/recovery scheduler or physical clock/device/deadline claim. Loaded two-instance public gain offline macOS arm64 evidence only.

Source: crates/ravet-device/src/graph_output.rs, crates/ravet-graph/src/dynamic.rs.

Tests: crates/ravet-device/tests/graph_dynamic.rs, crates/ravet-device/tests/graph_input.rs, crates/ravet-device/tests/graph_output.rs, tools/device-probe/src/bin/graph-live.rs.

Documentation: docs/audio-devices.md, docs/audio-graphs.md, docs/decisions/0126-buffered-live-graph-workers.md.

Native-precision CLAP main-bus effects and instruments¶

Prepared main-bus adapters map 0..64 inputs/1..64 outputs at native f32/f64 precision, global parameters, selected-port short MIDI and validated block-start transport.

Limits: 65536 frames/1024 events, up to 64 MiB f64 scratch; no aux, pointer-based SysEx, CLAP note-ID/wildcards or modulation; UMP packet routing is separate from processor semantic support; generated output is an explicit separate opt-in API. Old gain EffectBridge retains its narrower f32 effect policy. f64/multichannel verified by offline bridge fixtures; sine f32 actual-binary checks pass.

Source: crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/lib.rs.

Tests: crates/ravet-clap/tests/main_bus.rs, examples/sine-clap/tests/host.rs.

Documentation: docs/extended-processing.md, docs/decisions/0040-clap-main-bus-instrument.md.

Native CLAP auxiliary bus bridge¶

Native f32/f64 main and ordered auxiliary buses use independent compact input/output ports, complete input preflight and prepared sample/event storage.

Limits: Eight auxiliary buses, 64 channels per direction/bus, 65536 frames and 1024 input/output events each; combined samples/events cap 64 MiB. Exporters must advertise matching ports and precision. Existing gain/sine exports unchanged; separate sidechain reference records one REAPER mapping/render. General DAW auxiliary and other-format validation pending.

Source: crates/ravet-clap/src/multi_bus.rs, crates/ravet-clap/src/main_bus.rs.

Tests: crates/ravet-clap/tests/multi_bus.rs.

Documentation: docs/extended-processing.md, docs/decisions/0058-clap-auxiliary-buses.md.

Explicit bounded CLAP generated-event delivery¶

Native main-bus processing maps bounded physical parameter values/global gesture boundaries/modulation amounts and selected-port MIDI/normalized notes into core host events, with separate DSP/delivery status and explicit prefix rejection.

Limits: 1024 generated events; MIDI7 velocity quantization, reserved parameter ID/missing MIDI port rejects whole delivery. Host refusal discards suffix without audio rollback/retry. UMP packets map to CLAP MIDI2 with zero unused words; no pointer-based SysEx, CLAP note IDs/scoped modulation or other formats. Exporter modulation flags/DSP remain consumer policy. Prepared offline field/order/fault/heap fixtures pass; exported MIDI-output host evidence pending.

Source: crates/ravet-clap/src/output.rs, crates/ravet-clap/src/main_bus.rs.

Tests: crates/ravet-clap/tests/output.rs.

Documentation: docs/extended-processing.md, docs/decisions/0047-clap-output-events.md.

Explicit native CLAP performance ports in exported adapters¶

Selected native input/output ports preserve optional note IDs, unquantized f32 note velocity and all seven standard f64 expressions independently of raw MIDI/UMP routes.

Limits: Port indices 0..256; opt-in defaults retain MIDI output/native filtering. Exporter-owned CLAP dialect metadata/voice semantics. Concrete On channel/key; scoped Off/choke supported by the explicit native profile, while completion and scoped parameters use independent profiles. Unknown/unselected expression output/input filter; malformed selected input rejects pre-DSP with silence. Selected representable performance rejects at zero-frame process; flush input ignores performance, native performance output rejects whole delivery. Native IDs nonnegative i32; portable wider IDs reject before host prefix. Host refusal discards suffix without replay; rendered audio/DSP remain progressed. Offline adapter f32/f64/auxiliary evidence only, no new instrument/DAW/physical-device/deadline claim.

Source: crates/ravet-clap/src/notes.rs, crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/output.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/multi_bus.rs.

Tests: crates/ravet-clap/tests/notes.rs, crates/ravet-clap/tests/output.rs, crates/ravet-clap/tests/main_bus.rs, crates/ravet-clap/tests/multi_bus.rs.

Documentation: docs/extended-processing.md, docs/midi.md, docs/decisions/0135-exported-native-performance-ports.md.

Endpoint-scoped values and modulation in exported CLAP adapters¶

Distinct portable f64 scoped parameter events, independent native input/output selectors and explicit per-scope metadata flags preserve voice-target information without editing global state.

Limits: Finite full-f64 physical values/amounts, portable u32 IDs/native nonnegative i32; exact selected note input port 0..256, even all-wildcard targets remain port-scoped. Default input filters; malformed selected input rejects pre-DSP, raw exact all--1 alone is global. Whole generated missing routes/invalid IDs reject before prefix while successful audio/DSP remain progressed. Scoped parameter flush uses zero offsets, independently of performance flush policy. Empty cookies; exporter-owned range/voice precedence/base state/lifecycle. Metadata's eight scoped flags default false and enable no translation/DSP. Hosted metadata validation and instrument application separate; offline f32/f64/auxiliary adapter evidence only, no third-party/DAW/deadline claim.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/output.rs, crates/ravet-clap/src/parameters.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/multi_bus.rs, crates/ravet-graph/src/events.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-foundation/tests/scoped_parameters.rs, crates/ravet-clap/tests/scoped_parameters.rs, crates/ravet-clap/tests/parameters.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-graph/tests/events.rs.

Documentation: docs/parameters.md, docs/extended-processing.md, docs/decisions/0137-exported-scoped-parameters.md.

CLAP audio and event bridge¶

Clack-backed preallocated scratch storage adapts mono/stereo f32 effects and global parameter values to the portable processor.

Limits: At most 65,536 frames and 1,024 total input events; two sample copies per channel. Block-start transport is forwarded. No instruments, notes, modulation, f64, extra buses, or output events in this adapter.

Source: crates/ravet-clap/src/lib.rs.

Tests: examples/gain-clap/tests/bridge.rs.

Documentation: docs/decisions/0002-clap-backend.md.

Reusable native f32/f64 planar processor adaptation¶

SDK-independent prepared main/auxiliary scratch, checked raw bus pointers, complete typed event preflight and copied-input output rendering adapt exclusively borrowed portable processors to consumer native shims.

Limits: One main plus eight ordered auxiliaries, up to 64 channels per direction/bus, frames<=65536 and events<=1024 per direction; owned sample/generated-event payload<=64 MiB. Foreign live/aligned ranges and serialized lifecycle remain caller obligations. All inputs copy before outputs, output overlaps reject; zero frames permit null arrays. Exact supplied portable transport with consumer format validation. Faults silence supported declared prefixes/discard generated delivery without history rollback. Audio/reset panic poisons until fresh stopped preparation; normal heap evidence only, exceptional handlers may allocate. Consumer processor support, schemas/state C codecs, format-specific event/transport mappings, SDK registration/editor/delivery and native deadline remain separate; public Gain C ABI uses both precision paths.

Source: crates/ravet-native/Cargo.toml, crates/ravet-native/src/lib.rs, crates/ravet-native/src/raw.rs, crates/ravet-native/include/RavetNativeAudio.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/processing.rs, examples/gain-native/src/lib.rs, examples/gain-native/src/precision64_tests.rs.

Documentation: docs/native-processing.md, docs/architecture.md, docs/vst3.md, docs/decisions/0142-native-planar-adapter.md.

Consumer-selected native processor lifecycle entry¶

A reusable opaque owner and immutable exported v1 table compose prepared f32/f64 multibus processing, complete native events/transport, lifecycle and latency/tail queries for consumer-selected processors; Gain exposes the entry alongside its existing ABI.

Limits: Default+Send processors, exact table/handle/precision and loaded-library lifetime; exclusive serialized ownership and stopped control lifecycle/query calls. Fixed canonical preparation, native adapter bounds plus separately bounded decoded input events; full prepared native output capacity required before DSP. Foreign ranges/nonoverlap remain caller obligations, faults silence supported raw prefixes and expose no events without DSP rollback. Panics poison until fresh preparation; exception/consumer paths carry no deadline promise. No generic schema/state/metadata/editor, SDK registration or additional DAW/platform support claim.

Source: crates/ravet-native/src/entry.rs, crates/ravet-native/include/RavetNativeProcessor.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/entry.rs, tools/native-validation/processor_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/decisions/0145-native-processor-entry.md.

Bounded native global schemas and complete state¶

An optional paired native facade table exposes stable-ID f32 schema metadata, UTF-8 roles/ranges, pure mapping, revalidated complete snapshots and atomic decoded-state recall; Gain's thin facades retain canonical and explicit legacy codec behavior.

Limits: Up to 1024 global f32 parameters; UTF-8 names<=255/unit<=63 bytes without NUL; immutable schemas/roles. Exact paired processor handle/precision/library and exclusive stopped state ownership; no live publication. Canonical Foundation little-endian records, explicit consumer legacy decoder<=8208 bytes; consumer restore must reject atomically. Metadata roles do not implicitly filter events. Foreign ranges/consumer callbacks remain obligations; panics poison until fresh preparation. No scoped granularity/f64 persistence, formatting/groups/programs/editor, generic SDK registration or additional DAW/platform/deadline claim.

Source: crates/ravet-native/src/parameters.rs, crates/ravet-native/include/RavetNativeParameters.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/parameters.rs, tools/native-validation/parameter_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/parameters.md, docs/decisions/0146-native-parameter-state-companion.md.

Explicit native live global state publication¶

An opt-in paired native table provides independent coherent publication objects, controller complete-state decoding, prepared audio apply and conditional reflection that preserves newer restores and ongoing smoothing.

Limits: 64-bit atomics; <=1024 global f32 values and <=8208 state bytes, cached immutable schema. Explicit no-allocation/deallocation/blocking/I/O audio hooks and atomic consumer restore; exact type/precision/library pairing and exclusive prepared DSP owner. Control-only creation/byte codecs/destruction; retire after all callers stop. Single attempts return Busy/Stale, coalescing/retry/scheduling owned by consumer. Identity/generation cannot wrap in relevant lifetimes. Panics poison DSP until fresh preparation; arbitrary callbacks/foreign ranges remain obligations. No scoped/f64 persistence, automatic SDK registration/notifications/session scheduling or additional DAW/platform/deadline claim.

Source: crates/ravet-native/src/state_publication.rs, crates/ravet-native/include/RavetNativeState.h, crates/ravet-native/src/entry.rs, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/state_publication.rs, tools/native-validation/state_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/decisions/0147-native-live-state-publication.md.

Explicit trusted VST3 catalogue ownership¶

Default-disabled caller-linked Rust provider ABI and thread-restricted module owner compose an external-SDK native loader and immutable whole factory/class catalogue.

Limits: Explicit unsafe provider/module trust and executable lifetime; main-thread load/query/retirement, no factory/handle escape. UTF8 paths1..4096bytes withoutNUL; classes1..256 unique nonzero opaque IDs, positivecardinality, exact terminated UTF8/pairedUTF16 metadata and native statuses. Highest available interface failure rejects whole catalogue. Heap host context outlives module; one live owner per exact factory identity, up to256 reserved, no lock held across foreign calls. SDK NotImplemented context result accepted explicitly without delivery claim; consuming clear failures retire once, other rejection recovers owner. Cargo builds ABI only, external SDK/native linking explicit and macOS native recipe only. Public native Gain/Performance repeated load/retirement, all three CTest executables, relinked Rust main-thread owner/provider probe and shared Rust gates pass. Pointer-valid unsuccessful or throwing interface outputs released before status checks; caught native C++ exceptions map to InternalError. Authored nine-case context/reference/module-exit fixture passes through the public CMake target with public SDK interfaces, separate from actual module loader evidence. Catalogue-v1 has no instance/audio API; separate ABI-v2 record covers scoped component/controller/f32 processing and explicit non-discardable retention. No sandbox/crash/RSS/deadline/third-party/DAW/other-platform runtime claim.

Source: crates/ravet-host/src/vst3.rs, crates/ravet-host/Cargo.toml, crates/ravet-host/native/vst3/RavetVst3Provider.h, crates/ravet-host/native/vst3/RavetVst3Catalogue.hpp, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/CMakeLists.txt.

Tests: crates/ravet-host/src/vst3_tests.rs, crates/ravet-host/native/vst3/catalogue-tests.cpp, crates/ravet-host/native/vst3/provider-tests.cpp, crates/ravet-host/native/vst3/context-tests.cpp.

Documentation: docs/vst3-hosting.md, docs/plugin-hosting.md, docs/decisions/0210-trusted-vst3-catalogues.md.

Scoped trusted VST3 instances and main f32 audio¶

An independent caller-linked ABI-v2 table retains native component/controller ownership and lends one non-escaping audio capability from main-owned Rust instances.

Limits: Explicit unsafe table/code/module trust and original main control ownership; default-disabled existing vst3-catalogue feature, no implicit SDK discovery or Cargo native link. Library/child !Send/!Sync, borrowed parent and sole Send/!Sync/non-Clone HRTB audio scope; joined worker return/unwind/forget ends on main; unexpected failed end poisons and retains native ownership. Bounded256parents/classes/children; known canonical aliases reject before load, non-discardable pin before first create even failure/throw, consuming ProcessPinned facade close and same-core v2reopen; v1 ABI unchanged and excludes pinned core. Provider executable/host code must also remain process-lifetime; no static pin destruction. Finite0<rate<=768000Hz,1..65536prepared frames, main mono/stereo f32 and no-input or matching inputs; bounded16bus metadata per direction, event buses inactive, mandatory controller handler/reverse successful cleanup, explicit coalesced restart read without reconciliation. Whole caller shape/capacity/alignment/overflow/reserved/protected-range/output-overlap preflight; input scratch before output permits raw cross-alias, known native process faults silence valid prefixes and fault-close, tails retained. Staged native CMake9/9, actual Gain/Performance10000mono/stereo loops/profile, independent measured0regularCppnew/delete and0Rustalloc/dealloc, eight negative compilation contracts, public-path Rust5unit groups and10doctests/warning lint/Rustdoc pass locally; public focused110Rust tests/doctests plus9native CTest and actual complete Rust/native consumer pass; combined workspace validation follows source adoption. Stopped state is a separate companion; no live restore. No event/parameter/transport/editor/graph/f64/aux/latency-tail reconciliation, arbitrary third-party compatibility, sandbox/crash/RSS/deadline/DAW/other-platform runtime claim.

Source: crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/RavetVst3Provider.h, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/RavetVst3CoreRegistry.hpp.

Tests: crates/ravet-host/src/vst3/instance_tests.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/abi-tests.c, crates/ravet-host/native/vst3/core-registry-tests.cpp, crates/ravet-host/native/vst3/process-pin-tests.cpp, crates/ravet-host/native/vst3/instance-protocol-tests.cpp, crates/ravet-host/native/vst3/instance-block-fault-tests.cpp, crates/ravet-host/native/vst3/instance-v2-actual-tests.cpp, tools/vst3-validation/instance-owner.rs, tools/vst3-validation/check-instance-owner.py.

Documentation: docs/vst3-instances.md, docs/vst3-hosting.md, docs/decisions/0215-scoped-vst3-instances.md.

Owned VST3 controller parameters and timed input¶

An exact-table-paired companion owns stopped controller metadata/control and delivers bounded immutable sample-timed parameter queues through the scoped audio owner.

Limits: Default-disabled vst3-catalogue and explicit caller-linked external SDK; tested64bit macOS only. Main/exclusive stopped controller; all mutable module CONTROL waits for every AUDIO scope joined, already-prepared distinct children can borrow scopes. Existing provider/state ABIs unchanged; companion72/record1568/report24/point16. At most1024 copied unique parameters, bounded UTF16/UTF8 text/recognized flags, opaque units and explicit bypass/program flags without banks. Controller edits do not deliver DSP; failed foreign or malformed edit invalidates preparation without rollback, explicit refresh/reprepare. Whole2048points/64writableIDs/global-order/per-ID-strict-offset/finite-normalized/shape/known-storage preflight before DSP/output effects, zero-frame offset0. Per-core16pools/64MiB, each16fixed slots/64queues/2048points, permanent host refs; retained individual queues prevent slot reuse. AUDIO immutable admitted-thread-only data then freeze, sticky queue faults distinct from returned status/throws. Host-only detached payload reclaimed CONTROL; foreign release never final-free. Observed retention pins exact reserved core before facade retirement; ProcessPinned/same-core reopen/provider-code process lifetime/no automatic unpin. Successful state restore needs explicit refresh/parameterprepare; native preparation fault requires fresh child. Local SDK fixtures/fast-math/actual Gain timed smoothing-bypass and Performance serialized Level/safe Rust state recall/10000variable blocks profile/heap observations only. No active controller callbacks, output automation/events/transport/editor/f64/aux/graph/arbitrary third-party/DAW/other-platform/deadline or whole-plugin RSS claim.

Source: crates/ravet-host/src/vst3/parameters.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/RavetVst3Parameters.h, crates/ravet-host/native/vst3/BoundedParameterChanges.hpp, crates/ravet-host/native/vst3/ParameterCatalogue.hpp, crates/ravet-host/native/vst3/ParameterPoolKeepers.hpp, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/BoundedStateStream.hpp, crates/ravet-host/native/vst3/provider.cpp.

Tests: crates/ravet-host/src/vst3/parameter_tests.rs, crates/ravet-host/native/vst3/parameter-abi-tests.c, crates/ravet-host/native/vst3/parameter-changes-tests.cpp, crates/ravet-host/native/vst3/parameter-catalogue-tests.cpp, crates/ravet-host/native/vst3/parameter-pool-tests.cpp, crates/ravet-host/native/vst3/parameter-transaction-tests.cpp, crates/ravet-host/native/vst3/parameter-actual-tests.cpp, tools/vst3-validation/parameter-owner.rs, tools/vst3-validation/check-parameter-owner.py.

Documentation: docs/vst3-parameters.md, docs/vst3-instances.md, docs/vst3-state.md, docs/decisions/0233-owned-vst3-parameters.md.

Owned stopped VST3 component/controller state¶

An exact-table-paired companion captures owned opaque component/controller snapshots and applies bounded stopped state with explicit partial-failure poisoning and retained-stream lifetime.

Limits: Default-disabled vst3-catalogue and explicit caller-linked external SDK; main/exclusive stopped non-faulted child borrowing parent. Catalogue-v1/provider-v2 layouts unchanged; state companion32/record32/report24 on tested64bit macOS. Each explicit capture/source stream1..8MiB, keepers16/64MiB per core; whole range/shape/presence/UID preflight and capture publication, independent controller-component reader. Controller absent/NotImplemented/successful empty distinct. Opaque bytes do not authenticate version/schema/code. Success requires explicit reprepare; failed foreign compound restore or swallowed stream fault poisons processing without rollback but permits joined retirement/new-child recovery. Original returned SDK status/throw/stream diagnostic distinct; malformed restore reports fail closed. Frozen owned SDK streams retain host references; foreign release cannot cause final payload free, CONTROL reclaims. Retained streams force existing reserved-slot process pin even on failed/thrown getter, same-core v2 reopen and provider executable process lifetime; no unpin/static exit destruction. Controlled SDK-interface and actual Gain/Performance safe Rust capture/restore/render/controller rejection/recovery evidence only. No live restore, implicit restart/bus/parameter reconciliation, arbitrary third-party/DAW/editor/event/graph/other-platform or heap/RSS/deadline claim.

Source: crates/ravet-host/src/vst3/state.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/native/vst3/RavetVst3State.h, crates/ravet-host/native/vst3/RavetVst3State.hpp, crates/ravet-host/native/vst3/BoundedStateStream.hpp, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/RavetVst3CoreRegistry.hpp.

Tests: crates/ravet-host/src/vst3/state_tests.rs, crates/ravet-host/native/vst3/state-abi-tests.c, crates/ravet-host/native/vst3/state-stream-tests.cpp, crates/ravet-host/native/vst3/state-transaction-tests.cpp, crates/ravet-host/native/vst3/state-module-retention-tests.cpp, tools/vst3-validation/state-owner.rs, tools/vst3-validation/check-state-owner.py.

Documentation: docs/vst3-state.md, docs/vst3-instances.md, docs/decisions/0227-owned-vst3-state-transactions.md.

Prepared hosted VST3 events and block context¶

An exact-paired stopped catalogue and main-f32 audio companion copies selected buses/MIDI assignments, owns all input event payloads and publishes complete verified event/parameter output batches with independent native failure facts.

Limits: Trusted caller-linked native provider and plug-ins; 16 event buses/direction, 1..16 selected channels, 2048 events and 65536 payload bytes/direction, 64 output queues/2048 points. Main f32 mono/stereo effect or instrument only. 64MiB native event-pool keeper cap; observed six concurrently prepared children on the measured arm64 layout, about10.1MB event storage each plus parameter storage, separate from16 retained batches/child. Revised Rust wire tests and native fixtures are locally qualified; actual Gain mono/stereo and Performance SDK-image consumers pass through that revised owner against fresh W241 modules/canonical W227-243 archives. Core-owned controller-handler keepers, complete sibling numeric ownership protection and CONTROL exception provenance (R4) pass 98 native fixture commands and 31 CTest profiles. No DAW/platform/deadline support inference. Late native faults require stopped child retirement/recreation. Native f64/auxiliary buses and Graph ownership are the separate hosted-vst3-graph-banks record; editors are the separate hosted-vst3-editor-ownership record.

Documentation: docs/vst3-processing.md, docs/vst3-instances.md, docs/vst3-parameters.md, docs/decisions/0246-hosted-vst3-events-context.md.

Hosted VST3 native 32/64 aux buses and owned Graph banks¶

Default-disabled vst3-hosted-audio companion negotiates explicit main/aux bus profiles in native f32/f64, processes complete rich lanes through the scoped capability, and owns hosted children as canonical Graph processors retained by a bounded MAIN retirement registry.

Limits: Explicit unsafe exact-origin table/code/module trust; default-disabled vst3-hosted-audio feature (enables vst3-catalogue), no Cargo SDK link. Every advertised bus (<=16 per direction, <=1 main) needs an explicit active/inactive request; no defaultActive inference, fallback precision or layout substitution; <=64 packed active channels per direction, rate 0<r<=768000, frames 1..65536. Native refusals keep original stage/tresult; local refusal preserves the prior profile. f64 never narrowed. Graph bank consumes Library<'static>, 1..128 children, all prepared before the first lease begins, leases begin last with reverse unwind; MAIN registry 64 banks, nonwrapping generations, deliberately leaked, platform main thread on Apple. Node drop moves its bundle to a one-slot return ring; control drop only orphans; reclaim ends all leases before stop/retirement and never guesses a lease ended; forgotten nodes, refused returns and failed ends retain the bank. Rich lanes 1..4 batches/node, 64MiB per-bank budget, exact sequence/frames. Without a declared translation, framework events refuse; explicit translation is the separate hosted-vst3-graph-framework-events record. Checked reset refuses with RebuildRequired; fresh bank required. Evidence: mock-provider Rust unit/bank scenarios, 126 native fixture commands normal/fast-math, 61 CTest incl. actual W241 Gain/Performance, actual caller-linked Rust consumer debug/release (Gain mono/stereo f32/f64, Performance f32/f64, Graph Performance->Gain banks, orphaned control, 10000 blocks zero Rust allocations). Rust allocations only; foreign SDK/C++ heap, crash isolation, deadlines, DAW, third-party plug-ins and other platforms not claimed. Actual auxiliary-bus and all-nine-event-kind evidence uses the RAVET reference VST3 modules (vst3-reference-modules record); Graph-bank child editors and controller edit gestures are the hosted-vst3-graph-bank-editors-edit-gestures record (scoped-instance editors are the hosted-vst3-editor-ownership record).

Tests: crates/ravet-host/src/vst3/hosted_audio/tests.rs, crates/ravet-host/src/vst3/hosted_audio/graph/tests.rs, crates/ravet-host/native/vst3/hosted-audio-abi-tests.c, crates/ravet-host/native/vst3/hosted-audio-profile-tests.cpp, crates/ravet-host/native/vst3/hosted-audio-range-tests.cpp, crates/ravet-host/native/vst3/hosted-audio-scratch-instance-tests.cpp, crates/ravet-host/native/vst3/hosted-audio-instance-tests.cpp, crates/ravet-host/native/vst3/hosted-audio-provider-tests.cpp, crates/ravet-graph/tests/checked_reset.rs, crates/ravet-native-dsp/tests/checked_reset.rs, crates/ravet-clap/tests/checked_reset.rs, crates/ravet-embedded/tests/checked_reset.rs, crates/ravet-native/tests/checked_reset.rs.

Documentation: docs/vst3-hosting.md, docs/vst3-processing.md, docs/decisions/0268-hosted-vst3-graph-banks.md.

Framework events in hosted VST3 Graph nodes¶

Opt-in per-node translation of ordinary RAVET parameter values, notes, note expression, poly pressure and block-start transport into hosted VST3 Graph-bank children, through declared parameter routes and scales, a selected note bus with an explicit note-ID policy, refuse/ignore policies and an explicit merge order with rich lanes.

Limits: Declared on MAIN with Vst3GraphBankBuilder::translate and checked against the refreshed catalogue before any lease begins; nodes without a translation still refuse framework events. Parameters: <=2048 declared routes (unique graph and native IDs, writable non-hidden native IDs), Normalized or declared Linear{minimum,maximum} scale, no inferred ID equality or plug-in mapping query, checked against a catalogue snapshot at build (no revalidation after a plug-in restart); exact-offset normalized points, no sorting or merging; same-ID same-offset Refuse (default) or opt-in LastWins (counted as ignored); <=64 distinct native IDs per block; bounded per-point admission (trailing equal-offset run and incremental 64-ID set); unmapped IDs Refuse or Ignore. Notes: one selected event input bus, Unidentified (-1) or RequireIdentified policy, NoteWithId 0..=i32::MAX, channel within the bus, velocity copied, tuning/length/ppqPosition/flags zero. Expressions (declared, not queried): volume /4, pan, tuning /240+0.5, vibrato, expression, brightness by note ID only (no channel/key); pressure as poly pressure with concrete channel/key, f32 narrowing. Transport: optional ProcessContext with flags exactly for present fields; playing and sample position required once anything is known; discontinuity, pre-roll, tempo increment, bar number and sample loops not represented. MIDI/UMP/modulation/gesture/scoped/choke/completion and undeclared capabilities follow Refuse or Ignore; ignored events are counted. Queued lanes: Refuse, FrameworkFirst or LaneFirst merge; two contexts refuse. <=2048 events and points per block, merged storage within the same limits, counted in the 64 MiB per-bank lane budget; AUDIO translation allocates, locks and frees nothing. Every refusal (including overflow) occurs before the plug-in runs, silences the block and returns ProcessStatus::Silence: neither the node nor an enclosing Graph latches, and GraphStatus does not carry the refusal. The reason is a distinct framework::Refusal, counted (refused), kept in a 16-record ring drained on MAIN (further details dropped, still counted), marked in diagnostics and, in queued mode, returned with the lane batch as Error::Framework. Native faults, admission refusals and events sent to untranslated nodes still fault and latch. No AUDIO panic path in translation. No IMidiMapping, output-event translation, note-ID synthesis or ppqPosition derivation. Evidence: Rust translator and mock-provider bank scenarios (exact offsets, every mapping and refusal with its exact reason, Graph-level refusal over seven blocks, 10000-cycle zero-allocation checks) and an actual caller-linked consumer over freshly built RAVET Gain and Performance VST3 bundles (f32/f64 nodes and a broadcast Graph chain against closed-form references, a refusing Gain node inside a Graph that continues with unity output and a later gain change, 10000 Graph blocks with zero Rust allocations), plus the VST3 native CMake/CTest suite. Local macOS arm64 only; Rust allocations only; no DAW, third-party plug-in, foreign-heap, deadline or other-platform claim.

Source: crates/ravet-host/src/vst3/hosted_audio/graph/framework.rs, crates/ravet-host/src/vst3/hosted_audio/graph.rs, crates/ravet-host/src/vst3/hosted_audio.rs, crates/ravet-host/src/vst3/processing.rs.

Tests: crates/ravet-host/src/vst3/hosted_audio/graph/framework/tests.rs, crates/ravet-host/src/vst3/hosted_audio/graph/translation_tests.rs, crates/ravet-host/src/vst3/hosted_audio/graph/tests.rs, crates/ravet-host/src/vst3/hosted_audio/mock.rs.

Documentation: docs/vst3-hosting.md, docs/audio-graphs.md, docs/decisions/0273-hosted-vst3-graph-framework-events.md.

Hosted VST3 editor ownership (macOS NSView)¶

Default-disabled vst3-editor companion creates a controller IPlugView on the main thread, attaches it to a caller-owned NSView, negotiates bounded sizes, handles IPlugFrame resize requests with explicit reentry policy, and releases the view before controller, component and module retirement.

Limits: macOS NSView only; explicit unsafe exact-origin table/code/module trust and unsafe caller-owned parent lifetime; default-disabled vst3-editor feature (enables vst3-catalogue), no Cargo SDK link. Accepted limitation for scoped instances: the Rust Editor exclusively borrows its Instance, so Rust-side scoped audio/prepare/start/stop/state calls need the editor closed (an editor open while AUDIO runs is the Graph-bank child editor of hosted-vst3-graph-bank-editors-edit-gestures). mem::forget leaks the native editor, child and module (memory-safe). One editor per child; child destroy LIFECYCLE and module close CHILDREN while open. Owner replies carry an authoritative attached state (refusals included). Extents 1..16384; host resize needs canResize kResultTrue, checkSizeConstraint kResultTrue (== kResultOk; kResultFalse/kNotImplemented refuse, no fallback) with bounded rect and onSize kResultOk; recorded size re-queried by getSize. resizeView acknowledged during attached/setContentScaleFactor is applied later (after the call when attached, else at next attach) or counted as discarded; refused during other host view calls, off-main, foreign view, out of range, while detached, faulted or after teardown; idle requests apply onSize under the module busy flag and publish a one-slot consumer request cleared by detach, teardown and host resize. Content scale 0.25..8 optional, normally unsupported on macOS. No Rust callbacks or pointer escape. Evidence: injected SDK view fixture and substituted-loader provider fixture (normal/fast-math), C11 layout, Rust mock-provider tests, and the actual RAVET Gain VST3 editor in a hidden offscreen NSWindow (three cycles, one with concurrent audio through the native table); Performance/default Gain report unavailable. Edit gestures stay kNotImplemented for scoped instances (adopted only by gesture-enabled Graph-bank children). No DAW, third-party editor, visual, keyboard/focus, accessibility or other-platform claim.

Source: crates/ravet-host/src/vst3/editor.rs, crates/ravet-host/src/vst3/instances.rs, crates/ravet-host/Cargo.toml, crates/ravet-host/native/vst3/RavetVst3Editor.h, crates/ravet-host/native/vst3/RavetVst3EditorOwner.hpp, crates/ravet-host/native/vst3/RavetVst3Instance.hpp, crates/ravet-host/native/vst3/provider.cpp, crates/ravet-host/native/vst3/CMakeLists.txt.

Tests: crates/ravet-host/src/vst3/editor/tests.rs, crates/ravet-host/native/vst3/editor-abi-tests.c, crates/ravet-host/native/vst3/editor-owner-tests.cpp, crates/ravet-host/native/vst3/editor-provider-tests.cpp, crates/ravet-host/native/vst3/editor-view-fixture.hpp, crates/ravet-host/native/vst3/editor-window-tests.mm, crates/ravet-host/native/vst3/editor-visible-probe.mm.

Documentation: docs/vst3-hosting.md, docs/decisions/0271-hosted-vst3-editor-ownership.md.

Graph-bank child editors and controller edit gestures (macOS NSView)¶

A Graph-bank child can open its MAIN-thread NSView editor while the bank processes AUDIO on a worker, and an opt-in edit-gesture companion delivers paired controller beginEdit/performEdit/endEdit to the processor at offset 0 of the next dispatched block (the edit wins over a same-id block point) and to the host as ordered events with framework gesture/value identity, under an explicit restartComponent policy.

Limits: macOS NSView only, local arm64 evidence; default-disabled features (edit gestures need vst3-hosted-audio, bank editors also vst3-editor); additive exact-origin RavetVst3EditGestureProviderV1 (40 bytes); unsafe table/module trust and unsafe caller-owned NSView lifetime. Opt-in per child; other handlers keep kNotImplemented edits and original restart coalescing. Capture on the platform main thread only into a 256-record ring with gap-free sequences; unknown/read-only/hidden ids and non-finite or out-of-range values return kInvalidArgument; full ring, off-main and post-retirement calls return kResultFalse; all counted. Pairing: at most 64 open gestures, each reserving its end slot, so an accepted begin's end is never refused; duplicate begins and orphan ends are refused (unpaired) and never recorded; editor close records a flagged synthesised end per open gesture; gestures open at retirement are not closed, and a consumer-side panic or Abi pump error can drop records; kNoParamId is refused. restartComponent accepts only kParamValuesChanged, kLatencyChanged and kParamTitlesChanged (kResultOk means recorded, not applied); any other defined flag refuses the whole call; latency changes are published as rebuild_required and the node keeps its cached latency; the writable-id snapshot is not refreshed. pump_edits moves records only while both the AUDIO value ring (1..256) and the host queue (1..4096) have room and refuses after the node returns; values apply at offset 0 of the next successfully dispatched block, coalesce per id (last wins), replace a block point for the same id at offset 0 (edit wins, counted overridden), defer beyond 64 ids/2048 points, and stay pending across refused blocks and failed dispatches; block granularity only. No Rust allocation, lock or free on AUDIO (Rust heap evidence only); worst-case coalescing 65,536 comparisons per block. Bank editors: one per child; bank reclamation is deferred (ReclaimReport::editors) while any editor is open and never closes a caller's editor; native child destroy LIFECYCLE while open; refused drop-time destroy or mem::forget keeps the bank retained (memory-safe). Concurrent editor and AUDIO depend on the plug-in's own controller/processor thread safety (VST3 permits it); only RAVET's split-component Gain was exercised. Evidence: C11 layout, substituted-loader gesture fixture (normal/fast-math), Rust mock-provider bank scenarios, ThreadSanitizer runs of the native fixtures and the existing editor window test (RAVET C++ only; the Graph-bank window test cannot be linked with TSan), and the actual RAVET Gain editor (RAVET_GAIN_EDITOR=ON) attached to a bank child in a hidden offscreen NSWindow, never ordered front, for three cycles with edits injected into its script-message bridge, bit-exact delivery at the first block after pump_edits and zero Rust AUDIO allocations. No DAW, third-party or single-component plug-in, WebKit JavaScript or input-event, visual, accessibility, deadline, race-freedom or other-platform claim.

Tests: crates/ravet-host/src/vst3/hosted_audio/graph/edit_tests.rs, crates/ravet-host/src/vst3/hosted_audio/mock.rs, crates/ravet-host/native/vst3/edit-gesture-abi-tests.c, crates/ravet-host/native/vst3/edit-gesture-provider-tests.cpp, crates/ravet-host/native/vst3/editor-bank-window-tests.mm, crates/ravet-host/examples/vst3-editor-bank.rs.

Documentation: docs/vst3-hosting.md, docs/decisions/0276-graph-bank-editors-and-edit-gestures.md, docs/decisions/0271-hosted-vst3-editor-ownership.md.

RAVET reference VST3 modules for hosted-VST3 tests¶

Keyed Sidechain (stereo main plus mono/stereo auxiliary key, output main*key) and Event Probe (all nine SDK input event kinds and parameter points rendered as exact-offset impulses with FNV-1a payload hashes, echoed output events, an echoed-event count CC and a digest parameter) are built from portable Foundation processors and tested as actual loaded modules through the native provider, a direct SDK robustness harness and the Rust vst3-hosted-audio Graph bank.

Limits: Test references only: no state, editor, presets, bypass, latency or public plug-in product. Local macOS arm64; CMake refuses non-Apple hosts; external SDK; ad-hoc signature in the build tree with plug-in link/user path pinned off and a no-install CTest; never installed. One mono or stereo auxiliary input (5.1 refused); silence-flagged inputs read as zero. Event Probe per block: <=2048 events, <=4096-events Marker points, 65536+4096+16 bytes payload storage; other buses and unknown kinds ignored; other malformed input refuses the block silently with the digest unchanged, except that a host refusing output posts sees kResultFalse after the digest advanced. Same-offset records are summed (left code sums ambiguous); f32 exact while <=16 records share an offset, f64 always. Evidence: SDK validator, signature and no-install CTest per bundle; direct C ABI tests for every entry point; native provider normal and fast-math-harness tests (native32/64, aux stereo/mono active and inactive, 5.1 refusal, all nine kinds, 2000 variable and zero-frame blocks); direct SDK robustness harness (capacity, payload, offset, bus, unknown-kind, null-pointer, empty-block and sequencing cases, twin-instance digest checks); Rust Graph bank f32/f64 (600 blocks). Zero Rust heap operations inside the loaded modules (test-only allocation-probe counter, every process call), zero C++ new/delete on the provider AUDIO worker, zero host-side Rust heap in Graph::process and in ABI process/reset. Direct malloc by C++ wrappers/SDK not counted. No DAW, third-party host, other-platform or deadline claim.

Source: examples/vst3-reference-native/src/lib.rs, examples/vst3-reference-native/src/abi.rs, examples/vst3-reference-native/src/allocation_probe.rs, examples/vst3-reference-native/include/RavetVst3Reference.h, examples/vst3-reference-native/Cargo.toml, examples/vst3-reference/src/sidechain.cpp, examples/vst3-reference/src/event_probe.cpp, examples/vst3-reference/CMakeLists.txt, crates/ravet-host/native/vst3/CMakeLists.txt.

Tests: examples/vst3-reference-native/src/tests.rs, examples/vst3-reference-native/src/abi/tests.rs, crates/ravet-host/native/vst3/reference-module-tests.cpp, crates/ravet-host/native/vst3/reference-robustness-tests.cpp, crates/ravet-host/examples/vst3-reference-bank.rs, crates/ravet-host/native/vst3/reference-bank-main.c.

Documentation: docs/vst3-reference-modules.md, docs/vst3-hosting.md, docs/decisions/0274-reference-vst3-modules.md.

Optional asynchronous AUv3 host ownership and joined main-bus audio¶

Default-disabled ravet-host au-hosting feature over a caller-linked authored macOS provider: explicit bounded registry catalogue, AUAudioUnit asynchronous instantiation with nonblocking main poll, observed-load-mode admission, stopped mono/stereo f32 main-bus preparation and joined scoped rendering through the public cached renderBlock.

Limits: macOS 12+ arm64 local evidence only; the caller links the native provider (no Cargo native link or build script). Explicit trusted native execution; catalogue 1..256, 16 process pending requests (cancelled requests hold capacity until real completion), 256 instances/reservations. Main-only !Send/!Sync owners and one Send/!Sync/non-Clone HRTB audio scope; joined return/unwind/forget end on main; failed end poisons and retains native ownership. Required load mode is checked against observed isLoadedInProcess; NSError domain/signed64 code stays separate from OSStatus and host status. One main output bus, zero or one matching input bus, mono/stereo planar f32, 0<rate<=768000Hz, 1..65536 frames; whole preflight, input capture before render, failures silence admitted prefixes and fault-close, tails retained, no retry or rollback. In-process evidence only: a test-process-registered public Gain and an injected SDK fault fixture; zero ordinary C++ new and zero Rust allocator requests over 2000 prepared calls each (Objective-C, Apple framework and libc allocation not counted). Actual out-of-process (IPC) rendering is unvalidated: a reviewed ad-hoc signed, non-/Applications registration was never discoverable. No parameters/state/programs/editors/events/transport/aux/f64/latency/graph integration, iOS, auval, DAW, third-party compatibility, IPC crash isolation, RSS, production signing or deadline claim.

Source: crates/ravet-host/src/au.rs, crates/ravet-host/native/au/RavetAuHost.h, crates/ravet-host/native/au/provider.mm, crates/ravet-host/native/au/CMakeLists.txt, crates/ravet-host/Cargo.toml.

Tests: crates/ravet-host/src/au_tests.rs, crates/ravet-host/native/au/gain-tests.mm, crates/ravet-host/native/au/failure-tests.mm, tools/au-host-validation/host-owner.rs, tools/au-host-validation/fixture.mm, tools/au-host-validation/check-au-host.py.

Documentation: docs/au-hosting.md, docs/decisions/0269-auv3-asynchronous-host-ownership.md.

Prepared native AAX main and auxiliary audio buses¶

Fixed planar host-f32 mapping and stopped native layout/SDK profile composition adopt an actual Rust main/detector/monitor processor through initialized registered AAX callbacks.

Limits: One main plus8aux buses,64 total pointer channels per direction,1..1024frames; explicit static input slices or one connected dynamic sidechain, source-order compact outputs. Main None/mono/stereo SDK stems and live exact caller metadata capacities; no inferred inactive routing. Whole range/alias/protected-metadata map precedes MIDI/transport/state/dequeue/DSP; input/output sample alias uses authoritative native scratch. Known setup faults preserve readiness/profile; invoked backend failure retains original code/failsclosed. Default effect/instrument Context layouts remain; common guards protect outer/context/frame/owner fields, explicit effect multibus adds field4. Instrument+Multibus excluded pending separate registration. Supported silence covers union of safe prefixes and retains outside storage. Public nativeGain26/Performance4/stock14 CMake plus actual module/export/registered algorithms, Rust5/warning lint/docs and Python8 pass; combined workspace gate follows adoption. Explicit internal native32/64 selection is separate from host-f32 buses. No host-native64 buffers/auxiliary generated output/dynamic bus registration/publicauxplug-in/ProTools/signing/otherplatform/deadline claim.

Source: crates/ravet-native/include/RavetAaxAudio.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/bus-audio.cpp, tools/aax-validation/multibus.cpp, tools/aax-validation/processor.cpp, tools/aax-validation/model.cpp, tools/aax-validation/registered-native.cpp, tools/aax-validation/registered-instrument.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-bus-mapping.md, docs/aax.md, docs/decisions/0222-aax-prepared-native-bus-mapping.md, docs/aax-precision.md.

Prepared raw short MIDI AAX effect and auxiliary mapping¶

Opted-in native main and multibus effects combine complete short MIDI, queued scalar/state intent, native transport and both prepared auxiliary directions under one AUDIO admission token.

Limits: Host planar f32, exact selected native32/internal64; input-only raw Context appends to preserved legacy prefixes, raw+generated compile refusal. At most1024 packets/frames and whole effective controls+MIDI capacity; complete node/header/packet and directional metadata/audio preflight before getter/state/dequeue/DSP. Raw scalar/restore SPSC publication remains accepted during getter/native DSP; stopped lifecycle/telemetry/timing require stop/join and serialized CONTROL. Both auxiliary source orders and valid in-place mapping are qualified. Dynamic candidates explicitly carry exact optional telemetry; Delay8 retains old history while pending, matching ACK/reconciliation allows zero-history Delay16 adoption, CONTROL retirement. Refusal/mismatch/native fault remain explicit; output narrowing occurs after authoritative DSP with no rollback. Local initialized SDK/module32/64 normal/fast evidence and maximum ordinary C++ heap counters, no Pro Tools/ACF host chain/signing/other-platform/deadline claim; SysEx/MIDI2/source ports/raw output remain outside scope.

Source: crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp.

Tests: tools/aax-validation/raw-routing.cpp, tools/aax-validation/registered-raw-routing.cpp, tools/aax-validation/RawRoutingFaultTables.hpp, tools/aax-validation/midi-telemetry.cpp, tools/aax-validation/check-rejected-profile.py.

Documentation: docs/aax-raw-routing.md, docs/decisions/0254-aax-raw-effects-auxiliary.md.

Explicit AAX generated short-MIDI output¶

Opt-in fixed-capacity native AAX owners preflight generated short messages and register SDK output nodes, with exact partial-delivery facts and guarded process admission.

Limits: Caller-owned external public SDK; default output capacity0/context identities unchanged, explicit main-only host-f32 generated instrument profile with selected native32/64 DSP with input field3/output4, no auxiliary generated output or host-native64 buffers. Fixed stage<=1024 packets/frames; canonical bounded ordered subset includes channel notes/pressure/pitch/bank/program, no arbitrary CC/system/SysEx/UMP/note-ID erasure. Whole input/map/control/native-output-capacity preflight before native apply/dequeue; admission CAS before SDK input getter through Post rejects nested/concurrent calls before mutation. CONTROL availability reads lock-free admission only, not AUDIO staging/diagnostics; ordinary SPSC producer contract remains separate and stopped lifecycle/diagnostic access required. Late encoding/refusal/throw cannot roll back native history/dequeued intent or previous SDK posts. Delivery consumed before first attempt, no replay; hasStatus iff a call returned and retains last actual returned SDK status even after later throw. Native status, local failure and SDK attempted/returned/posted counts distinct; native fault fails closed, delivery fault preserves native preparation. Actual initialized registered Rust NoteRouting consumer and normal/fast native/default-reference/heap/concurrent-control receipts only. No packaged generated reference consumer, Pro Tools/PACE/physical MIDI/arbitrary routes/voice-identity/host-deadline/other-platform claim.

Source: crates/ravet-native/include/RavetAaxMidiOutput.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/midi-output.cpp, tools/aax-validation/generated-model.cpp, tools/aax-validation/processor.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-generated-midi.md, docs/aax.md, docs/decisions/0226-aax-generated-short-midi-output.md, docs/aax-precision.md.

Native silent note-routing reference¶

A separate exported native32/64 note producer scales Level and preserves bounded canonical note routing with explicit exact channel/key release lowering and complete state.

Limits: Existing bus-routing-native package, main no-input mono/stereo silent f32/f64, Level only/default1, RAVETNTE/version1/24-byte codec, distinct exact typed audio/cache/state origins. No voices/synthesis/bypass/auxiliary output events/physical clock. Prepared output capacity must be supplied even when actual burst0/1; transient saturating u64 frame counter resets on prepare/reset and survives recall. Explicit no-ID channel/key scoped release becomes Off; IDs and wildcard scopes reject rather than losing identity. Direct zero-On stays On, SDK zero-On input lowers release; positive encoder velocity minimum1 and nearest half-up. Actual Rust/native and initialized generated AAX model evidence, AAX adopts32 only; no separately packaged output-enabled plug-in/Pro Tools/physical host/deadline claim.

Source: examples/bus-routing-native/src/note.rs, examples/bus-routing-native/src/lib.rs, examples/bus-routing-native/include/RavetNoteRouting.h.

Tests: examples/bus-routing-native/src/note.rs, tools/aax-validation/generated-model.cpp, tools/aax-validation/midi-output.cpp.

Documentation: docs/aax-generated-midi.md, docs/decisions/0226-aax-generated-short-midi-output.md.

Portable native main, detector and monitor routing reference¶

Paired f32/f64 native processor/schema/cache/audio-state/codec/telemetry exports provide mono/stereo main gain/bypass and mono detector-to-mono/stereo auxiliary monitor processing.

Limits: Matching mono/stereo main plus exactlyone mono input-only detector andone mono/stereo output-only monitor in either source order; no arbitrary graph or instrument voices/generated events. Gain1=0..4/default1,Bypass2=0/1/default0;32byteRAVETBUS/version1 complete global state. Unsanitized sample pass-through and timed physical controls. Transient exact saturatingu64frame telemetry resets on prepare/reset and survives complete parameter recall; finite value0/hints0..1 plus exact samples sidecar, no clock/persisted state/automatic host publication. Five public Rust tests/warning lint/docs and actual eight-profile registered SDK/native composition pass; AAX selects32only. Public nativeGain26/Performance4/stock14 and packaging gates pass; combined workspace acceptance follows source adoption, no device/DAW/platform/deadline claim.

Source: examples/bus-routing-native/Cargo.toml, examples/bus-routing-native/src/lib.rs, examples/bus-routing-native/include/RavetBusRouting.h.

Tests: examples/bus-routing-native/src/lib.rs, tools/aax-validation/multibus.cpp.

Documentation: docs/aax-bus-mapping.md, docs/decisions/0222-aax-prepared-native-bus-mapping.md.

Native32/64 raw routing and delay consumers¶

Distinct RawBusRouting and RawDelayRouting exports share authoritative routing/FIFO kernels, observe exact canonical raw MIDI and consume complete two-global state, native transport and stopped telemetry.

Limits: Mono/stereo main alone or detector-input/monitor-output auxiliary pair in either source order; fixed Delay8/16 main. Gain/Level and Bypass affect existing kernels; raw wire has no implicit parameter binding. Exact selected32/64 core/schema/cache/audio/state/telemetry exports; RAVETRBS/RAVETRDL version1, two globals,10 transient telemetry fields. All123 defined statuses including standalone canonical F7, zero-frame offset0 events/controls without frame advancement; meaningful native64 resolution, late malformed/capacity/history and legacy strict-policy evidence. No SysEx inference, source-port metadata, arbitrary bus arrangements or deadline claim.

Source: examples/bus-routing-native/src/lib.rs, examples/bus-routing-native/src/raw.rs, examples/bus-routing-native/src/delay.rs, examples/bus-routing-native/include/RavetRawRouting.h.

Tests: examples/bus-routing-native/src/raw.rs, tools/aax-validation/raw-routing.cpp, tools/aax-validation/registered-raw-routing.cpp.

Documentation: docs/aax-raw-routing.md, docs/decisions/0254-aax-raw-effects-auxiliary.md.

Local raw main/auxiliary/timing AAX reference bundle¶

Six owned initialized AAX factories demonstrate reusable main, both auxiliary orders and raw+dynamic-latency consumption in separately selectable native32/internal64 local bundles.

Limits: org.ravet.rawrouting mono/stereo/main/aux/timed exact identities, one LocalInput node/mask0xffff, detector sidechain plus monitor auxiliary registration in prepared source order. Authored zero-class external-wrapper bootstrap, owned callbacks only; no stock algorithm mapping. Separate raw-routing/raw-routing64 bundles with notices, required exports/version, strictly verified local ad-hoc signature and actual normal/fast registered validators. Production CMake5 tests each includes maintained raw-generated refusal. Native-only/headless selection; no editor/AudioSuite/installation/production signing/Pro Tools/other-platform support. Generic reusable capability and local consumer remain separate from broader original format completion criteria.

Source: examples/raw-routing-aax/CMakeLists.txt, examples/raw-routing-aax/RawRoutingParameters.hpp, examples/raw-routing-aax/bootstrap.cpp, examples/raw-routing-aax/description.cpp, examples/raw-routing-aax/native-registration.cpp, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/registered-raw-routing.cpp, tools/aax-validation/RawRoutingRegistrationFixture.hpp, tools/aax-validation/check-bundle.py, scripts/tests/test_aax_bundle.py.

Documentation: examples/raw-routing-aax/README.md, docs/aax-raw-routing.md, docs/decisions/0254-aax-raw-effects-auxiliary.md.

Native AAX parameter schema and control adoption¶

External-SDK C++17 immutable native parameter metadata, staged SDK object ownership and exact-identity registered Gain control adoption.

Limits: Control-only f32 parameter scalar semantics with default32/explicit64 metadata provenance; this stock profile has host-f32 audio. The separately authored native owner can select internal native64 DSP. Exact p-uppercase-hex native IDs, bounded UTF8 text and cached physical display, read-only owned setter enforcement, actual SDK manager allocation recovery and retained shared display lifetime. Registration forwards original SDK statuses with exact mono/stereo effect identity; stock aggregate last-variant status may mask earlier refusal. SDK setter/notification sideeffects have no rollback. Actual registered factory/algorithm validates1024-frame Gain/bypass after explicit offline/realtime reprepare; ordinary initial stock mono remains rejected/silent while stereo renders. Uninitialize rejects stale callbacks before object retirement and fresh initialization readopts. Helper normal/fast-math and100000 allocation-counted cycles, actual module/CMake3validators and4Python packaging checks pass locally. This remains the explicit stock schema/control regression; the separate authored native-processing record now covers default checked initial mono/stereo lifecycle and complete global state. Programs/aux/MIDI/transport/instrument/editor/latency/tail and real ProTools/AudioSuite/PACE/deadline/other-platform evidence remain separate.

Source: crates/ravet-native/include/RavetAaxParameters.hpp, crates/ravet-native/include/RavetAaxFactoryRegistration.hpp, examples/gain-aax/GainParameters.hpp, examples/gain-aax/registration.cpp, examples/gain-aax/native-parameters.cmake, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/parameters.cpp, tools/aax-validation/registered.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax.md, docs/decisions/0209-aax-native-schema-control.md, docs/aax-precision.md.

Checked owned native AAX processing and global state¶

An authored external-SDK AAX_CEffectParameters model owns exact native processor/schema/state companions, checked initial main-bus preparation, bounded block-start control intent and complete native chunks; the default public Gain factories consume it.

Limits: Main planar host-f32 matched mono/stereo, 1..1024 frames and writable global parameters only; native table/cache/codec precision and callback provenance must match exactly. Up to1024 parameters/8208 state bytes; power-of-two SPSC slots2..1024, default32/capacity31. CONTROL serializes SDK, codec and stopped lifecycle; one AUDIO consumer owns prepared DSP, stop/join before retirement. Known whole buffer/control/state faults preflight before queue/DSP mutation; supported rejected outputs silence prefixes and preserve tails. Provider failures fail-close readiness; exact stopped native lifecycle status is distinct from atomic latest AUDIO status retained through the void SDK algorithm. Accepted intent and complete queued-before-render state survive reset/reprepare; local RvS1 including bypass changes the prototype stock chunk, with no released-session/legacy compatibility claim. SDK foreign notifications/partial exceptional mutations have no rollback; some public void SDK wrappers erase delegate statuses. Trusted live pointer/table/library ranges remain caller obligations, no isolation/global allocation bound. Actual registered factory→SDK Initialize→ordinary first realtime mono/stereo1024, complete state, status, retirement/fresh initialization pass in the normal local macOS arm64 package; 18 native and14 preserved-stock CMake contracts, both actual bundle probes and8 Python packaging tests pass. Normal/fast-math helper/model fixtures and10000 allocation-counted C++ prepared cycles are separate from actual module/whole-SDK and existing Rust allocation evidence. Separate records cover explicit short-note instrument, transport, auxiliary buses, timing, generated output, optional editor and internal native32/64 selection. The default Gain remains main-only/headless; no default programs/AudioSuite mapping, Pro Tools/PACE production signing/other-platform/deadline claim.

Source: crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, crates/ravet-native/include/RavetAaxParameters.hpp, examples/gain-aax/GainNativeParameters.hpp, examples/gain-aax/native-registration.cpp, examples/gain-aax/native-owner.cmake, examples/gain-vst3/CMakeLists.txt, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/processor.cpp, tools/aax-validation/model.cpp, tools/aax-validation/registered-native.cpp, tools/aax-validation/ControllerHost.hpp, tools/aax-validation/FaultTables.hpp, tools/aax-validation/check-bundle.py, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax.md, docs/decisions/0213-aax-checked-native-lifecycle.md, docs/aax-precision.md.

Explicit native precision behind AAX float audio¶

An external-SDK owner explicitly selects exact native32/64 processor/cache/state companions; the prepared64 bridge captures host-f32 inputs, runs the authoritative native DSP once and validates whole output narrowing before host samples or generated MIDI publication.

Limits: AAX host buffers remain planar f32; default32 direct path, f32 parameter/state scalars and public Context/descriptor/parameter identities preserved. Selected64 owners/models must be heap-resident for fixed 1 MiB CONTROL-created sample scratch; at most 9 buses/64 total channels per direction/1024 frames. Whole map/MIDI/effective-queue/transport/input capture preflights before native state/history; cross input/output alias safe, partial output overlap rejected. Exact finite IEEE widening, quiet NaNs/Inf/signed zero and software nearest-even finite narrowing/gradual underflow independent of fenv/fast-math; no blanket finite audio filter. Finite rounded output overflow is after DSP/queue consumption: whole supported output silence/tails, no partial audio/generated publication, readiness poison and no history rollback. Untimed stopped complete prepare may recover accepted intent; timed sticky faults retain Faulted through CONTROL old-slot retirement and require a fresh host-reconciled instance. Original state/process returned codes, attempt/return/consumption/transfer flags and local conversion/exception faults separate; lock-free last actually returned native DSP code retained through void algorithm, later local failure or throw. Native ABI remains nonthrowing; defensive C++ fixture containment does not authorize C/Rust unwinding. Explicit --internal-precision32/64 for native Gain/Performance/optional Gain editor, separate64 paths, stock64 early rejection. Canonical actual Rust Gain/BusRouting/Performance/NoteRouting/Delay8/16 and initialized SDK/editor composition, analytic phase/history, late fault/status, maximum prepared zero ordinary-C++ allocation and actual selected64 local package probes pass. Selected64 Gain48/editor 51/Performance 4 and default32 Gain 32/editor 35/Performance 4/stock 14 CMake plus actual packaged module contracts and 12 Python pipeline tests pass with canonical public Rust archives; public adoption/joint qualification remain separately tracked. Exclusive AUDIO, existing SPSC/control/stopped lifecycle and live foreign table/context/range/refcount ownership remain caller obligations. No host-native64 buffers, full short-MIDI/SysEx/UMP input, auxiliary generated output, production signing/Pro Tools/other-platform/foreign-global allocation or deadline claim.

Source: crates/ravet-native/include/RavetAaxPrecision.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, crates/ravet-native/include/RavetAaxWebEditor.hpp, examples/gain-aax/GainNativeParameters.hpp, examples/gain-aax/GainNativeEditor.hpp, examples/performance-aax/PerformanceParameters.hpp, examples/gain-aax/native-precision.cmake, examples/gain-vst3/CMakeLists.txt, examples/performance-aax/CMakeLists.txt, scripts/aax_bundle.py, scripts/bundle-aax.py.

Documentation: docs/aax-precision.md, docs/aax.md, docs/aax-bus-mapping.md, docs/aax-generated-midi.md, docs/aax-timing.md, docs/aax-native-editor.md, docs/decisions/0240-aax-native-precision.md.

Bounded native AAX short-note instrument adoption¶

An external-SDK whole-stream short-note collector and explicit native AAX instrument owner validate timed MIDI before state/queue/DSP transfer; the public Performance instrument consumes them through actual registered SDK factories.

Limits: Input None, mono/stereo main planar f32, frames<=1024, raw packets<=1024 and combined effective trailing global controls+notes<=1024. Positive NoteOn velocity exact widened f32 byte/127; velocityzero scoped channel+key Off, no invented identity. Defined short non-notes validate then omit; running status/undefined statuses/SysEx including SDK fragments/zero or long payload reject. Boolean immediate never overrides ordered relative timestamps. No fabricated bypass; actual originating audio-state cache/codec provenance required. Whole map/MIDI/capacity precedes applyState/dequeue, controls0 precede same-frame notes. Null node/stream malformed, valid empty stream renders; zero frames with queued intent/notes reject. Known late faults retain voice history/accepted Level and silence supported prefixes/tails, protect borrowed metadata; original provider AUDIO status/fail-closed lifecycle retained. CONTROL serializes proxy/codec/lifecycle, exclusive AUDIO and stop/join retirement; trusted foreign node/context/storage capacities and bounded stack remain caller obligations. Local strict normal/fast helpers/model, actual registered factory/Initialize/MIDI algorithm and4 CMake contracts plus8 Python packaging tests pass;10000 maximum collector and2000 prepared instrument cycles count no C++ heap, separate from Rust/whole-SDK allocation/fast-math/deadline evidence. Separate explicit transport adoption has its own record. No aux/f64/UMP/SysEx/controllers/expression/programs/generated output/latency-tail/editor/AudioSuite/Pro Tools/PACE/other-platform/released-session claim.

Source: crates/ravet-native/include/RavetAaxNoteInput.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/performance-aax/PerformanceParameters.hpp, examples/performance-aax/native-registration.cpp, examples/performance-aax/CMakeLists.txt, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/note-input.cpp, tools/aax-validation/instrument-model.cpp, tools/aax-validation/registered-instrument.cpp, tools/aax-validation/check-bundle.py, scripts/tests/test_aax_bundle.py.

Documentation: docs/performance-aax.md, docs/aax.md, docs/decisions/0218-aax-native-short-note-instrument.md.

Prepared AAX complete short MIDI input¶

Explicit raw instrument policy preflights every defined complete MIDI1 short message into canonical native events, with whole combined command capacity and AUDIO admission before SDK getters.

Limits: At most1024 packets/frames; raw-only zero-frame offset0 events/queued controls apply without phase/sample advance, existing default empty-only policy retained; source order and exact1..3-byte payloads. Standalone F7 only means canonical EndOfExclusive; no SysEx inference, running status or UMP. Explicit input-only instrument Context; Gain/Performance note defaults unchanged. Raw serialized SPSC scalar/restore/request controls remain accepted during AUDIO; stopped lifecycle still requires stop/join. Raw+generated is a compile-time refusal. Last returned native status and admitted-block flags distinguish Preflight/Busy/Exception; initial numeric1 has no has-returned bit and lifecycle does not reset it. Distinct getter/DSP publication and C++ TSan1000-publication evidence; Rust uninstrumented. Production Clang21 raw+transport model/owner/collector partial static-frame estimates about169KiB, not runtime stack/upper bound, other builds/small stacks unqualified. Late preflight faults preserve state/dequeue/history; internal64 output overflow retains its separate nonrollback contract. Actual registered mono/stereo macOS native32/64 references, no Pro Tools/other-platform/deadline claim.

Source: crates/ravet-native/include/RavetAaxNoteInput.hpp, crates/ravet-native/include/RavetAaxShortMidiInput.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp.

Tests: tools/aax-validation/short-midi.cpp, tools/aax-validation/registered-midi.cpp, tools/aax-validation/midi-telemetry.cpp, tools/aax-validation/check-rejected-profile.py, tools/aax-validation/reject-raw-generated.cpp.

Documentation: docs/aax-short-midi.md, docs/decisions/0247-aax-short-midi-input.md.

Optional native AAX stopped telemetry composition¶

AAX native owners compose exact core/precision telemetry caches after whole CONTROL preflight and expose explicit stopped snapshots with output-range protection.

Limits: 1024-field ceiling; caller stop/join ownership; admission checks detect already entered callbacks but do not exclude later AUDIO admission. Actual short/long capacity and known model/owner output aliases qualified. No automatic publication, host/UI reflection or telemetry session codec. Timing candidates do not inherit companions. Invalid metadata/copied origin rejects before schema/resource mutation; null/violating throw acquisition balances owned schema/client caches. Native ABI remains nonthrowing. Actual32/64 local component evidence, no DAW/deadline support.

Source: crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp.

Tests: tools/aax-validation/midi-telemetry.cpp, tools/aax-validation/registered-midi.cpp.

Documentation: docs/aax-short-midi.md, docs/native-client-acquisition.md, docs/decisions/0247-aax-short-midi-input.md.

Native Performance AAX instrument reference¶

Distinct public mono/stereo AAX factories register a sixteen-voice no-input host-f32 Performance instrument with explicit internal native32/64 selection with timed short MIDI notes, complete accepted Level intent and explicit local bundle packaging.

Limits: Software-generator category, LocalInput MIDI mask0xffff, no host bypass/multi-mono/AudioSuite; Level ID1 range0..1 default0.2, complete native RvS1 productRAVETPS/version1/24bytes. Voices/performance transient, no completion output requested. New reference IDs remain distinct from Gain and are not commercial allocation/session compatibility. Explicit --plugin performance requires native profile; default Gain/native and explicit stock paths preserved. Self-contained local macOS arm64 package uses external SDKs/notices/ad-hoc signing; actual factory→SDK Initialize(None input)→timed analytic audio, Level state, malformed input/silence/tails, independent late-fault voice-phase oracle and retirement pass locally. No general Pro Tools/production PACE/other-platform/deadline support or aux/host-native64-buffers/controller-expression/UMP/SysEx/program/generated MIDI/latency-tail/editor/AudioSuite claim. Explicit transport adoption is recorded separately.

Source: examples/performance-aax/PerformanceParameters.hpp, examples/performance-aax/native-registration.cpp, examples/performance-aax/description.cpp, examples/performance-aax/CMakeLists.txt, examples/performance-native/src/lib.rs, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/registered-instrument.cpp, tools/aax-validation/instrument-model.cpp, tools/aax-validation/note-input.cpp, tools/aax-validation/check-bundle.py, scripts/tests/test_aax_bundle.py.

Documentation: docs/performance-aax.md, docs/aax.md, docs/decisions/0218-aax-native-short-note-instrument.md, docs/aax-precision.md.

Local AAX-only raw MIDI sine bundle¶

Separate mono/stereo owned AAX factories consume raw MIDI with complete Level state, initialized transport and optional stopped telemetry in native32 or internal64 behind hostf32.

Limits: Distinct org.ravet.midisine.mono/stereo identities, LocalInput mask0xffff; no bypass/editor/AudioSuite. Only owned AAX callback creation is supported; proprietary ACF host registration chain remains unvalidated. Required external-wrapper bootstrap exposes zero VST3 classes and actual startup/descriptor/class-count/registered Process/shutdown is tested. Separate local midi/midi64 bundles include notices/strictly verified ad-hoc signature/export-version/actual-component validation plus maintained raw-generated compile refusal; shared ordinary Performance exports are present, no exclusive export-set claim; no installation, production signing or Pro Tools/other-platform/deadline claim. Stock/editor selections reject before commands.

Source: examples/midi-aax/CMakeLists.txt, examples/midi-aax/MidiParameters.hpp, examples/midi-aax/bootstrap.cpp, examples/midi-aax/description.cpp, examples/midi-aax/native-registration.cpp, scripts/aax_bundle.py, scripts/bundle-aax.py.

Tests: tools/aax-validation/registered-midi.cpp, tools/aax-validation/check-bundle.py, tools/aax-validation/check-rejected-profile.py, tools/aax-validation/reject-raw-generated.cpp, scripts/tests/test_aax_bundle.py.

Documentation: examples/midi-aax/README.md, docs/aax-short-midi.md, docs/decisions/0247-aax-short-midi-input.md.

Checked AAX initial and acknowledged dynamic timing¶

An optional two-core prepared owner validates initial native/host latency and adopts a complete matching-state replacement only after eligible host acknowledgement.

Limits: External separately licensed SDK; local initialized SDK/module fixtures only. Default disabled, mono/stereo main host-f32 with selected internal native32/64 DSP, no instrument/aux/transport/generated-output combination. CONTROL prepares exact matching schema/state/audio-cache origin before host request; caller reconciles a fresh eligible 24-bit acknowledgement and exact getter before AUDIO. Getter/request success alone is not acknowledgement; bounded nonwrapping notices. Whole callback preflight precedes adoption; current globals, queued complete recall and trailing controls retain their order. Replacement FIFO starts zero, no history migration/crossfade. Original request/getter/native refusal and exceptions remain distinct; possibly changed compensation fails closed without old-delay fallback. Sticky timing faults survive old-slot retirement and reject same-owner prepare/reset/reinitialization before foreign calls; recovery requires a new owner with known matching host compensation/profile. CONTROL retirement waits final old access; native tail diagnostic only. Atomic availability does not replace joined lifecycle obligations. No Pro Tools, PACE signing, arbitrary scheduling, other-platform, hardware or deadline support.

Source: crates/ravet-native/include/RavetAaxTiming.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/timing-model.cpp, tools/aax-validation/TimingControllerHost.hpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-timing.md, docs/decisions/0230-aax-prepared-timing.md, docs/aax-precision.md.

Initialized native AAX transport capture¶

An external-SDK output-last collector borrows initialized versioned transport proxies, preserves independent getter availability and raw positions, and forwards checked native transport before pending state or DSP.

Limits: Explicit CaptureTransport=false reusable default; native Gain and Performance opt in, stock unchanged. At most one playing/tempo/meter/ticks/divisor/configured-loop query per callback; sample location only after known playing=true. Original returned SDK statuses, attempted/returned/available masks and local fault/getter remain distinct. Positive finite tempo, meter1..65535, positive u32 tick divisor and ordered raw active loop; full signed-i64 samples/ticks/endpoints exact sidecars, explicitly rounded f64 PPQ with collapsed loop rejection. Independent getter errors remove their fields; successful malformed/throw projection rejects whole output before applyState/dequeue/DSP, retains old capture and pending intent/history, silences supported prefixes/tails. Map/MIDI/capacity preflight precedes collection; stopped joined diagnostics describe latest collection attempt, atomic process status separate. Unknown recording/discontinuity/preroll DETAILS flags remain zero/default; configured looping is not guaranteed execution or Loop Record, no host tuple coherence. Helpers fixed stack/storage with10000 zero C++ new/delete capture cycles, actual Rust transport validation and initialized SDK proxy/native Gain smoothing/Performance voice-phase fault oracles pass locally; normal public native Gain22/Performance4/stock14 contracts, all three bundle export/version/registered algorithm probes and8Python packaging tests pass locally. Trusted typed SDK output writes, lifetime/thread/ranges/foreign allocation/blocking remain caller obligations; no timeline selection/timecode/bar/reset/extrapolation/latency compensation, production PACE/Pro Tools/other-platform/whole-SDK fast-math/global-memory/deadline claim.

Source: crates/ravet-native/include/RavetAaxTransport.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp, examples/gain-aax/GainNativeParameters.hpp, examples/performance-aax/PerformanceParameters.hpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/transport.cpp, tools/aax-validation/transport-model.cpp, tools/aax-validation/TransportControllerHost.hpp, tools/aax-validation/registered-native.cpp, tools/aax-validation/registered-instrument.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-transport.md, docs/aax.md, docs/performance-aax.md, docs/decisions/0219-aax-native-transport-capture.md.

Prepared native AAX host meter publication¶

Reusable external-SDK preparation/registration and the native AAX owner/model compose explicit exact-origin telemetry bindings with complete host tap preflight and staged whole snapshot publication.

Limits: Opt-in1..64 host-f32 taps/1..1024 native telemetry fields; zero preserves legacy Contexts/defaults. CONTROL fully copies metadata and retires one unavoidable temporary cache before other resources; exact core/sample/companion origin, retained descriptor strings/IDs and compliant nonthrowing SDK/native ABI required. UnitClamp or deterministic IEEE FiniteFloat projection, no inferred dB/decay/clipped flag. Whole known owner/context/frame/node/pointer-array/audio ranges before getters/history; caller foreign extent/lifetime/stop-join remain explicit. Post-DSP snapshot/projection refusal preserves old taps and successful audio without native history rollback; original returned DSP/state/snapshot/SDK codes separate from unreturned exceptions and numeric1 sentinel. Meter-only/raw SPSC controls preserved, inherited timing/generated restrictions retained. Explicit compatible candidate telemetry and original metadata diagnostics before ACK-controlled dynamic adoption/CONTROL retirement. Isolated32/64 actual SDK Gain/instrument/raw/aux/timing and normal/fast maximum64-tap10000 ordinary-C++heap-free cycles; dependency/public/shared acceptance pending, no Rust/host allocation/deadline guarantee. Metered generated-output/editor composition remains syntax-only/no distributed reference. No Pro Tools/production signing/distribution/other platform claim.

Source: crates/ravet-native/include/RavetAaxMeters.hpp, crates/ravet-native/include/RavetAaxMeterRegistration.hpp, crates/ravet-native/include/RavetAaxProcessor.hpp, crates/ravet-native/include/RavetAaxEffectParameters.hpp.

Tests: tools/aax-validation/meters.cpp, tools/aax-validation/meter-composition.cpp, tools/aax-validation/registered-meters.cpp, tools/aax-validation/MeterControllerHost.hpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-meters.md, docs/decisions/0262-aax-native-metering.md.

Reusable VST3 controller schema registration¶

An optional external-SDK C++17 helper preflights complete bounded native global metadata, registers root-unit SDK parameters and delegates control mapping to native linear/log/discrete ranges.

Limits: Control-only <=1024 descriptors; external VST3 SDK and exact retained native table/library. Reject reserved UINT32_MAX IDs, duplicate/conflicting IDs, invalid boolean bypass and titles >127 UTF16 units; complete UTF8 conversion without clipping. Global physical f32 and SDK numeric formatting precision, no custom choice labels/groups. Metadata preflight rejection preserves container; SDK allocation/insertion exceptions have no transaction guarantee. No audio automation/state/factory/editor/notification/scheduling or additional host/platform/deadline claim; executed contracts recorded separately.

Source: crates/ravet-native/include/RavetVst3Parameters.hpp, examples/gain-vst3/src/gain.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/schema.cpp, tools/vst3-validation/contracts.cpp.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0148-vst3-native-schema-registration.md.

Control-cached native global parameter mapping¶

An immutable control-prepared schema cache provides concurrent provider-free metadata/range reads and atomic bounded normalized-to-physical tagged event conversion; a separate paired native table retains existing ABI layouts.

Limits: <=1024 descriptors/events/output capacity and <=65536 frames; global normalized/physical f32, f64 normalized intent explicitly narrowed. Cached binary ID lookup, all u32 IDs, native UTF8 255/63 limits; roles do not implicitly filter. Create/drop/providers on control, retire after all borrowers stop and retain exact table/cache/precision/library/static schema. Cached callbacks no heap/locks/I/O/DSP/providers; failed outputs unchanged. Unknown IDs/out-of-range/nonfinite/timing/capacity reject whole conversion, consumer explicitly routes/filters. No scoped modulation/f64 parameter persistence, automatic host queues/SDK registration/notifications/scheduling or additional platform/DAW/deadline claim.

Source: crates/ravet-native/src/parameter_cache.rs, crates/ravet-native/include/RavetCachedParameters.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/parameter_cache.rs, tools/native-validation/cached_parameters.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/decisions/0151-native-cached-parameter-mapping.md.

Explicit native audio-owner complete state¶

An optional cache-paired companion applies fully validated physical global state and captures reordered complete snapshots on exclusively prepared native processors without control codecs or providers.

Limits: At most 1024 physical f32 fields/capacity; exact processor/cache/table/precision/library pairing and live aligned disjoint ranges are caller duties. Hooks require atomic failed restore and no heap actions, blocking or I/O. Panic shares DSP poison until fresh stopped prepare. Direct callbacks require no 64-bit atomics; live publication remains independently gated. No automatic generations/publication/scheduling/notifications/retry, consumer panic rollback, scoped/modulation/voice state, SDK factories or DAW/deadline claim. Repeated recall may restart smoothing; mixing protocols is explicit consumer policy.

Source: crates/ravet-native/src/audio_state.rs, crates/ravet-native/src/parameters.rs, crates/ravet-native/include/RavetNativeAudioState.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/audio_state.rs, tools/native-validation/audio_state_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/parameters.md, docs/decisions/0155-native-direct-audio-state.md.

Explicit prepared native telemetry¶

A separate consumer-selected native companion caches stable-ID readout metadata and revalidates complete physical f64 observations with exact u64 windows on exclusively prepared processors; Gain exposes its existing 12 meter fields.

Limits: At most 1024 descriptors/capacity with UTF-8 names255/units63, finite ordered display hints and known nonfinite-input flag. Raw finite f64 values preserve extremes/subnormals/signed zero and may exceed display hints. Exact cache/processor/table/precision/library and live aligned disjoint foreign ranges are caller obligations. Hook obeys no heap/blocking/I/O; snapshot panic shares DSP poison until fresh stopped prepare. No atomics required, implicit cross-thread observation/publication/UI-host scheduling, persistence/automation/events/clear, consumer panic rollback or DAW/deadline claim. Measurement/window/reset/retention and SDK display policy belong to consumers.

Source: crates/ravet-native/src/telemetry.rs, crates/ravet-native/include/RavetNativeTelemetry.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/telemetry.rs, tools/native-validation/telemetry_entry.cpp, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/parameters.md, docs/decisions/0156-native-prepared-telemetry.md.

Reusable native C++ client and SDK reference adoption¶

An SDK-independent C++17 owner composes native lifecycle, optional explicit state and telemetry caches; the Gain VST3 processor consumes it with tagged events and retained controller/program/editor protocols.

Limits: Exact v1 shapes/required callbacks/precision/counts/originating core addresses; control acquisition/preparation/retirement, exclusive DSP callbacks and shared cached metadata. Selected state and telemetry companions require the exact supplied core pointer; byte-identical copied core tables reject before any resource creator. Violating CONTROL acquisition/query exceptions balance already acquired resources; native ABI/destruction remain nonthrowing obligations, with no arbitrary foreign-code authentication. Exact types/library and live aligned disjoint ranges remain caller duties. No copy/move, fallback, hidden state/mailbox/codecs, automatic publication/scheduling/retry, generic SDK factories/editor/buses, performance/scoped/transport/generated-event mapping or DAW/deadline/platform/signing claim. Native callback poison/result/silence semantics and consumer 31-bit generation/measurement/display policies remain explicit.

Source: crates/ravet-native/include/RavetNativeClient.hpp, examples/gain-vst3/src/gain.cpp.

Tests: tools/native-validation/client.cpp, tools/vst3-validation/contracts.cpp, tools/vst3-validation/editor.cpp, tools/vst3-validation/programs.cpp.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0157-native-cpp-client.md.

Exact native client origin and balanced acquisition¶

C++ native client admits exact originating state/telemetry core tables with whole CONTROL preflight and balanced partial acquisition.

Limits: C++ behavior change rejects callback-equivalent copied core tables; trusted library/table lifetimes and nonthrowing native ABI remain caller obligations. CONTROL acquisition exception cleanup is defensive only. Existing Gain32/64 actual archive normal/fast tests are local, not DAW/device/deadline validation. Public rebuild/format qualification pending.

Source: crates/ravet-native/include/RavetNativeClient.hpp.

Tests: tools/native-validation/client-companions.cpp, tools/native-validation/client-companions.cmake.

Documentation: docs/native-client-acquisition.md, docs/decisions/0250-native-client-acquisition.md.

Explicit VST3 block-start transport mapping¶

An external-SDK C++17 helper requests/maps canonical available sample/musical positions, tempo, signature and playback/details into native transport; Gain forwards it before pending state or processing.

Limits: Null means unknown. Finite positive SDK rate/tempo, finite advertised music/cycles, positive u16 signatures; exact i64/f64 and used signed zero preserved. Active ordered cycle bounds require known musical position for native v1; inactive/positionless bounds omitted with loop state retained. Bar start without exact bar number, system/continuous time, SMPTE/frame rate, clock/chord, increments/sample loops/discontinuity/pre-roll are unmapped. Unknown/unavailable/unmapped fields ignored; no invented availability/reset/extrapolation/rounding, transport-driven Gain DSP, DAW timeline/deadline/platform/signing claim. Live aligned context/output/library remain caller duties; normal framework mapping has no callbacks/heap/locks/I/O.

Source: crates/ravet-native/include/RavetVst3Transport.hpp, crates/ravet-native/include/RavetNativeScalars.hpp, examples/gain-vst3/src/gain.cpp.

Tests: tools/vst3-validation/transport.cpp, tools/vst3-validation/contracts.cpp, crates/ravet-native/tests/transport.rs.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0158-vst3-block-start-transport.md.

Explicit VST3 native performance input¶

An external-SDK C++17 helper maps selected-bus notes, poly pressure and six standard note expressions into canonical native records after complete bounded event-list validation.

Limits: At most1024 raw/expanded events and65536 frames; ordered offsets/ties/zero-frame rules, single getter reads,56KiB bounded stack scratch. SDK int32 IDs preserve all bits except absent-1; unquantized f32 velocity, cents to semitone tuning expansion, normalized volume4/tuning240(x-.5), exact other f64 expression values. Unknown expressions reject by default or explicitly filter after scalar/ID validation; other selected SDK types reject. Nonselected payloads filter after header/timing/order validation. Optional length/ppq/flags unrepresented; no voice matching, SDK instrument export/controller advertisement, output event delivery, SysEx/text/int expressions or DAW/deadline/platform claim. Visitor refusal retains its prior effects; stage privately before DSP/state/host publication.

Source: crates/ravet-native/include/RavetVst3PerformanceInput.hpp, crates/ravet-native/include/RavetNativeScalars.hpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/performance_input.cpp, crates/ravet-native/tests/events.rs.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0160-vst3-performance-input.md.

Explicit VST3 native performance output¶

An external-SDK C++17 helper maps representable canonical native notes and expressions into selected-bus SDK output, preflighting the complete stream and reporting exact host-prefix refusal.

Limits: At most1024 records/65536 frames; bounded1024-SDK-event stack scratch, ordered offsets/ties/zero-frame rules. Concrete/scoped-concrete Off and pressure require exact widened f32; standard expressions require ID-only scope, all int32 identity bits except reserved-1. Volume/4 is exact or rejects subnormal rounding/underflow; tuning/240+.5 is explicit floating unit arithmetic with possible rounding. No wildcard/precision loss, choke/end masquerade, implicit MIDI/UMP/SysEx/parameters/text/int conversion or inferred ppq/flags/length. Whole invalid output rejects before host calls; refusal retains accepted prefix/DSP and discards suffix without rollback/replay/retry. Gain has no performance output and does not adopt helper; no SDK instrument/DAW/deadline/platform claim.

Source: crates/ravet-native/include/RavetVst3PerformanceOutput.hpp, crates/ravet-native/include/RavetNativeScalars.hpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/performance_output.cpp, crates/ravet-native/tests/events.rs.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0161-vst3-performance-output.md.

Prepared VST3 native audio bus mapping¶

An external-SDK C++17 fixed profile maps logical native main/auxiliary buses into independent compact SDK directions at native f32/f64, with complete shape/range/output-overlap preflight and bounded fault silence; Gain adopts it.

Limits: Native config1..9 nonempty buses,0..64 channels per direction/576 total,1..65536 frames and up to 1024 events; failed control configure retains prior profile and does not prepare DSP. Fixed profile rejects host count/channel/precision mismatch; zero-frame fully omitted or exact metadata accepted, sample arrays ignored. Positive frames require all pointers even when silence flagged. Inputs may alias outputs across buses; output active ranges must be disjoint, aligned and nonoverflowing. Bounded sorted output ranges; no heap/locks/I/O in normal mapping. Foreign live metadata/array/sample ownership and writable metadata exclusions remain caller duty. Fault cleanup touches supported exact output shapes/frame/precision only, skips invalid sample pointers, retains tails and sets exact cleared flags. Generic SDK bus registration/speaker arrangements/factory/DAW/deadline/platform evidence remains separate; Gain retains mono/stereo effect layouts.

Source: crates/ravet-native/include/RavetVst3Audio.hpp, examples/gain-vst3/src/gain.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/audio.cpp, tools/vst3-validation/contracts.cpp, crates/ravet-native/tests/processing.rs.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0162-vst3-native-audio-buses.md.

Prepared VST3 cached global parameter input¶

Optional external-SDK helpers use precision-matched native caches and validate/copy all raw global queue points before a prepared visitor; Gain uses them for mapped automation with retained program expansion and stable merging.

Limits: Control creation/retirement, exact table/cache/library and borrowed host lifetime; <=1024 targets/queues/total points and <=65536 frames, <=16KiB raw scratch. Reserved/duplicate targets reject; explicit readonly/routing policy, global normalized f64 intent narrows to f32. Single point read, full raw/unknown value/timing/capacity validation before visitor, referenced-memory IEEE checks for fast-math. Visitor failure may retain private scratch effects; publish state/output/DSP only after success. No framework heap/providers/locks/I/O on cached/validation paths; host/visitor obligations remain. No continuous curve interpolation, gestures/scoped/performance/transport, generic factory/output/scheduling or additional host/platform/deadline claim.

Source: crates/ravet-native/include/RavetVst3ParameterInput.hpp, crates/ravet-native/include/RavetNativeScalars.hpp, examples/gain-vst3/src/gain.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, scripts/bundle-aax.py.

Tests: tools/vst3-validation/parameter_input.cpp, tools/vst3-validation/contracts.cpp, tools/vst3-validation/programs.cpp.

Documentation: docs/native-processing.md, docs/vst3.md, docs/decisions/0154-vst3-cached-parameter-input.md.

Complete C-layout native event conversion¶

Version-one native records preserve every portable event kind with full identities/scoped f64 values, canonical fields and atomic bounded conversion into prepared storage; Gain shares the legacy global parameter decoder.

Limits: In-process native layout only, not wire/preset serialization or SDK registration. At most 1024 events; exact widened f32 scalars required for global controls/velocities. Consumers own endpoint routes, foreign ranges, storage, delivery/refusal, state and voice lifetime. No new DAW or deadline support claim.

Source: crates/ravet-native/src/event.rs, crates/ravet-native/include/RavetNativeEvent.h, examples/gain-native/src/lib.rs.

Tests: crates/ravet-native/tests/events.rs, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp, examples/gain-native/src/lib.rs.

Documentation: docs/native-processing.md, docs/decisions/0143-native-event-records.md.

Exact C-layout native transport snapshots¶

Independent native availability/flags preserve exact block-start positions, tempo and extended transport while validating semantic dependencies and canonical fields without allocation.

Limits: In-process v1 record only; no wire serialization, fixed-point conversion, extrapolation or automatic reset. Finite beat/bar values and positive finite tempo, increment requires tempo, bar requires beats, active ordered loop bounds require their timeline, nonzero u16 signatures. Consumers decode before DSP and own foreign rejection/silence and SDK mapping. Direct typed adapter pass-through stays unchanged. No additional DAW/platform/deadline claim.

Source: crates/ravet-native/src/transport.rs, crates/ravet-native/include/RavetNativeTransport.h.

Tests: crates/ravet-native/tests/transport.rs, tools/native-validation/native_records.c, tools/native-validation/native_records.cpp.

Documentation: docs/native-processing.md, docs/decisions/0144-native-transport-records.md.

Explicit CLAP discovery and trusted catalogues¶

Bounded explicit non-loading candidate scans and trusted native entry loading provide owned byte-preserving plugin metadata and live-instance library retention through Clack.

Limits: 32 directories/4096 entries/1024 candidates, 1024 plugins and bounded descriptor strings/features. No recursion/system scan, sandbox, signing check, crash timeout, automatic host callbacks/device/GUI or other formats. Native upstream Clack gain and RAVET gain/sine catalogue/state/three-block f32 lifecycles pass locally; broad compatibility pending.

Source: crates/ravet-host/Cargo.toml, crates/ravet-host/src/lib.rs, crates/ravet-host/examples/inspect.rs.

Tests: crates/ravet-host/tests/catalogue.rs, crates/ravet-host/src/lib.rs, crates/ravet-host/examples/inspect.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0046-explicit-clap-hosting.md.

Guarded trusted CLAP editor hosting¶

A main-thread instance-borrowing guard owns negotiated editor creation, embedded parent attachment, bounded resizing, idempotent show/hide and guaranteed paired destruction.

Limits: Embedded sizes 1..16384 per dimension; native parent attachment/transient lifetime is an explicit unsafe caller contract. No parent window creation/pump, host GUI request scheduling, focus/scale policy or device integration. Local Cocoa RAVET/upstream EGUI child/lifecycle fixtures pass; visual hide/accessibility, floating/other OS APIs and broad compatibility unvalidated.

Source: crates/ravet-host/src/editor.rs, tools/editor-smoke/examples/hosted.rs.

Tests: crates/ravet-host/tests/catalogue.rs, tools/editor-smoke/examples/hosted.rs, crates/ravet-host/tests/linked_sine.rs.

Documentation: docs/plugin-hosting.md, docs/decisions/0048-guarded-plugin-editors.md.

Explicit global parameter gesture boundaries¶

Typed stable-ID begin/end events cross parameter graph filters and complete worker queues, map to generated CLAP output and optionally map from hosted native graph output.

Limits: Raw boundaries only; no scalar state change, pairing/ownership/cancellation/recording policy. Hosted output requires explicit writable parameter mapping and opt-in; disabled/unmapped filters, read-only/offset/order/capacity rejects with nonrollback block failure. Zero-frame parameter flush permits offset zero. Shared graph 1024 and native slot limits; no native input translation, GUI scheduler, other-format or host automation-recording claim. Loaded public f32/f64 fixture macOS arm64 evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/output.rs, crates/ravet-graph/src/events.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-clap/tests/output.rs, crates/ravet-host/tests/graph_gestures.rs, crates/ravet-graph/tests/events.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-device/tests/graph_output.rs, crates/ravet-host/examples/gesture-fixture.rs, crates/ravet-host/examples/hosted-graph.rs.

Documentation: docs/parameters.md, docs/plugin-hosting.md, docs/decisions/0121-parameter-gesture-events.md.

Explicit CLAP parameter gesture input¶

Opt-in native begin/end translation and mapped hosted native input preserve raw boundaries alongside parameter values without automatic state edits or pairing.

Limits: Default ingress ignores native boundaries; default hosted input rejects portable boundaries. Explicit hosted writable input map required before activation; disabled/unknown input rejects before native mutation. Shared prepared capacities and process timing; flush ingress offsets normalize to zero, portable empty blocks require zero. No ownership/pairing/recording/GUI policy or new third-party/DAW/deadline claim; synthetic offline translator and linked native f32/f64 evidence only.

Source: crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/multi_bus.rs, crates/ravet-host/src/graph_parameters.rs, crates/ravet-host/src/graph_node.rs.

Tests: crates/ravet-clap/tests/gestures.rs, crates/ravet-host/tests/graph_gestures.rs, crates/ravet-host/examples/support/parameter_fixture.rs.

Documentation: docs/parameters.md, docs/plugin-hosting.md, docs/decisions/0130-parameter-gesture-input.md.

Explicit global parameter modulation signals¶

Finite signed physical modulation amounts remain separate from base values across graph filters/worker queues, opt-in CLAP input translation and generated global CLAP output.

Limits: Finite f32 physical amounts; no automatic base-value change, combination/clipping/smoothing/reset/persistence or per-note scope. CLAP input defaults to ignored modulation, explicitly enabled global amounts must narrow to finite f32; scoped events ignore, invalid whole input rejects before DSP, flush offsets normalize to zero. Output preserves representability preflight/host prefix refusal. No synthesized native metadata flags, reference plug-in support, native hosting/other-format/host/device/deadline claim. Existing graph/queue/bridge bounds apply.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/output.rs, crates/ravet-graph/src/events.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-foundation/tests/contracts.rs, crates/ravet-clap/tests/modulation.rs, crates/ravet-clap/tests/output.rs, crates/ravet-graph/tests/events.rs, crates/ravet-device/tests/graph_events.rs.

Documentation: docs/parameters.md, docs/extended-processing.md, docs/decisions/0122-global-parameter-modulation.md.

Mapped native global modulation in hosted nodes¶

Independent builder input/output opt-ins map finite global physical modulation through cached writable native modulatable identities, with reusable explicit CLAP metadata registration.

Limits: Explicit direction mappings, default disabled; 4096 native shared slots versus graph 1024 cap. Input finite f32 widens to f64 and unsupported targets reject before native mutation. Enabled global output requires writable modulatable metadata and finite f32 narrowing; disabled/unmapped/scoped filters, selected data/order/offset/capacity faults clear block with nonrollback BackendFailure. Scalar base range/step checks stay separate; zero-frame flush supported. No cookies/rescan/modulation matrix/per-note/other-format/crash isolation or host/device/deadline claim. Public synthetic f32/f64 macOS arm64 evidence only.

Source: crates/ravet-host/src/graph_node.rs, crates/ravet-host/src/graph_parameters.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-clap/src/parameters.rs.

Tests: crates/ravet-host/tests/graph_modulation.rs, crates/ravet-host/examples/support/modulation_probe.rs, crates/ravet-host/examples/hosted-modulation.rs, crates/ravet-host/examples/modulation-fixture.rs, crates/ravet-clap/tests/parameters.rs.

Documentation: docs/parameters.md, docs/plugin-hosting.md, docs/decisions/0123-hosted-global-modulation.md.

Mapped scoped values and modulation in hosted CLAP graphs¶

Explicit mapped native graph directions validate cached scope metadata and preserve full f64 parameter values/modulation, selected input-port voice scope and zero-time flush separately from global state.

Limits: Selected CLAP note input endpoint plus explicit maps/nonzero shared capacities; writable input/output scoped metadata. Most-specific supplied ID/key/channel/port requires its corresponding automation/modulation flag, independently of global flags. Portable u32/native nonnegative i32; finite f64 values within native range/steps, signed finite modulation independent of base bounds/steps. Disabled/invalid input rejects whole prefix pre-native. Unknown IDs/unselected or wildcard ports filter; selected output metadata/scalar/timing/capacity faults discard complete portable output without native rollback. Raw exact all--1 alone is global; empty input cookies/owned private storage. Metadata changes require retirement/reprepare. No voice allocation/state migration/GUI/recording or third-party/DAW/deadline claim; linked offline f32/f64 fixture evidence only.

Source: crates/ravet-host/src/graph_parameter_scope.rs, crates/ravet-host/src/graph_parameters.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-host/src/graph_node.rs.

Tests: crates/ravet-host/src/graph_parameter_scope.rs, crates/ravet-host/tests/graph_scoped_parameters.rs, crates/ravet-host/examples/support/parameter_fixture.rs.

Documentation: docs/plugin-hosting.md, docs/parameters.md, docs/decisions/0138-hosted-scoped-parameters.md.

Explicit note identities in hosted CLAP graphs¶

Portable identified On/Off events and opt-in selected native CLAP routes preserve concrete note IDs, timing and velocity without inferred voice policy.

Limits: Portable u32 identities; native0..i32::MAX with explicitly selected CLAP note ports per enabled direction. Default input rejects, output filters specific IDs; wildcard native notes retain legacy events. Invalid input rejects whole prefix pre-native; selected raw native IDs<-1 reject rather than normalize. No identity-loss MIDI/MPE/UMP/generated-MIDI conversion, voice allocation/lifetime, choke/end/per-note parameter or new third-party/DAW/deadline claim. Offline portable/queue/unit and linked f32/f64 fixture evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-device/src/graph_events.rs, crates/ravet-clap/src/output.rs.

Tests: crates/ravet-foundation/tests/note_identity.rs, crates/ravet-graph/tests/events.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/tests/graph_notes.rs, crates/ravet-clap/tests/output.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/decisions/0132-native-note-identities.md.

Scoped standard note expressions in hosted CLAP graphs¶

Portable wildcard channel/key/ID targets and opt-in selected native routes preserve seven standard expression kinds with full f64 values.

Limits: Finite standard ranges; portable volume0..4, CLAP strictly positive0<x<=4 rejects mute rather than clamp. Portable u32 IDs/native nonnegative i32; exact selected CLAP port per enabled direction. Default input rejects, output filters expressions. Disabled/invalid input rejects whole prefix before native mutation; unknown types/other or wildcard ports filter; selected malformed output faults without native rollback. Default generated MIDI output rejects whole expression streams before delivery. No voice application/allocator, lifecycle/per-note parameters, loss to MIDI/MPE/UMP or third-party/DAW/deadline claim; offline linked f32/f64 ABI evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-host/src/graph_note_expression.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-device/src/graph_events.rs, crates/ravet-clap/src/output.rs.

Tests: crates/ravet-foundation/tests/note_expression.rs, crates/ravet-host/src/graph_note_expression.rs, crates/ravet-host/tests/graph_expression.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-graph/tests/events.rs, crates/ravet-clap/tests/output.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/decisions/0134-scoped-note-expressions.md.

Scoped note release and choke¶

Portable wildcard targets carry key release velocity and scalar-free choke through graph queues and selected hosted/exported native CLAP routes.

Limits: Finite Off velocity 0..1, portable u32 IDs/native nonnegative i32; receiver-owned voice matching/release/termination. Hosted flags default false and require selected CLAP directions; invalid/disabled input rejects whole prefixes pre-native, default/unselected output filters. Native wildcard-channel/key Off preserves scope; concrete output Off retains legacy/identity profile. Raw negative scope rejects rather than normalize; native choke velocity ignored. Selected output faults retain native history; zero-frame/flush performance restrictions remain. Generated MIDI rejects whole scoped streams before prefix. No note-end completion, implicit MIDI/MPE/UMP conversion, public instrument behavior or third-party/DAW/hardware/deadline claim; offline linked f32/f64 evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-clap/src/notes.rs, crates/ravet-clap/src/output.rs, crates/ravet-device/src/graph_events.rs.

Tests: crates/ravet-foundation/tests/note_release.rs, crates/ravet-host/src/graph_note_input.rs, crates/ravet-host/src/graph_note_output.rs, crates/ravet-host/tests/graph_release.rs, crates/ravet-clap/tests/notes.rs, crates/ravet-clap/tests/output.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-graph/tests/events.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/decisions/0136-scoped-note-release.md.

Directional note completion notifications¶

Portable completion targets, graph/queue preservation and opt-in native profiles notify controllers on originating note input endpoints independently of release/choke and performance output.

Limits: Checked channel/key/wildcard/u32 portable scope and native nonnegative i32 IDs. Carrier offsets order delivery without voice termination times. Hosted explicit CLAP input route/nonzero capacities; native timestamp/velocity ignored, canonical offset uses previous retained offset or zero. Disabled/unselected/wildcard ports filter; selected raw scope/capacity faults discard portable output without native rollback. Portable hosted input rejects whole prefixes. Exported independent input-endpoint output selector below 256, whole missing-route/width/flush rejection before host prefix with audio progressed; incoming native completions filter under generic timing validation. No automatic completion/allocator/ID reuse, MIDI conversion, public reference behavior or third-party/DAW/deadline claim; synthetic offline evidence only.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-host/src/graph_node.rs, crates/ravet-clap/src/output.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/multi_bus.rs, crates/ravet-device/src/graph_events.rs, crates/ravet-graph/src/events.rs.

Tests: crates/ravet-foundation/tests/note_completion.rs, crates/ravet-host/src/graph_parameter_output.rs, crates/ravet-host/tests/graph_note_end.rs, crates/ravet-clap/tests/note_end.rs, crates/ravet-device/tests/graph_events.rs, crates/ravet-graph/tests/events.rs.

Documentation: docs/extended-processing.md, docs/plugin-hosting.md, docs/midi.md, docs/decisions/0140-note-completion.md.

Sample-timed UMP and CLAP packet routing¶

Framed UMP portable events preserve ordered sample offsets and map to/from selected-port CLAP MIDI2 events without resolution conversion.

Limits: Packet transport only; processors own semantic validation and negotiated protocol. Existing reference processors advertise MIDI 1.0 only. No MIDI 2 DAW/device performance claim, pointer-based SysEx mapping, protocol negotiation or automatic synthesis conversion.

Source: crates/ravet-foundation/src/event.rs, crates/ravet-clap/src/lib.rs, crates/ravet-clap/src/main_bus.rs, crates/ravet-clap/src/output.rs.

Tests: crates/ravet-clap/tests/output.rs.

Documentation: docs/extended-processing.md, docs/decisions/0052-sample-timed-ump.md.

Explicit MIDI devices and bounded complete packets¶

Native midir connections enumerate/select exact ports, receive short/SysEx packets through prepared SPSC storage and send validated packets to explicit destinations.

Limits: 1024-byte complete packets, power-of-two 1..1024 slots; newest full input drops. Connection-local microsecond timestamps require explicit audio mapping. No fragmented SysEx, UMP, automatic reconnect/hotplug, physical-device or non-macOS runtime/deadline claim.

Source: crates/ravet-midi-device/Cargo.toml, crates/ravet-midi-device/src/lib.rs.

Tests: crates/ravet-midi-device/tests/packets.rs, crates/ravet-midi-device/src/lib.rs, crates/ravet-midi-device/examples/loopback.rs.

Documentation: docs/midi.md, docs/decisions/0032-midi-device-packets.md.

Guarded macOS CoreMIDI UMP endpoints¶

Exact-ID protocol-selected native inputs/outputs and owned virtual destinations/sources connect bounded exact-word UMP handoff through guarded native callback lifetime.

Limits: macOS/Xcode backend only, runtime scope macOS 27.0.1 arm64. 4096 endpoints/packet queue, 1023-byte display names, 1024 native packets/4096 words per callback. Handles thread-local; close waits outside callbacks. Native conversion/host-tick clock explicit; physical devices, negotiation/hotplug/deadlines and other OS backends unvalidated.

Source: crates/ravet-core-midi/Cargo.toml, crates/ravet-core-midi/build.rs, crates/ravet-core-midi/src/lib.rs, crates/ravet-core-midi/src/macos/mod.rs, crates/ravet-core-midi/src/macos/ffi.rs, crates/ravet-core-midi/native/core-midi.mm.

Tests: crates/ravet-core-midi/src/macos/ffi.rs, crates/ravet-core-midi/examples/virtual-probe.rs, crates/ravet-core-midi/examples/source-probe.rs.

Documentation: docs/core-midi-ump.md, docs/decisions/0061-core-midi-ump-endpoints.md, docs/decisions/0072-owned-ump-sources.md.

Standalone output audio devices¶

Explicit CPAL enumeration/ID selection and configured f32 output streams adapt owned prepared processors through bounded planar scratch; a CLI runs silent callback validation.

Limits: Output-only, 1..64 channels and at most 65,536 scratch frames; no inputs, auxiliary buses, MIDI/events, implicit resampling/conversion, hotplug subscriptions or automatic recovery. macOS UMC1820 20-channel 96 kHz silent callbacks exercised; audible output, latency, deadlines and other targets remain unvalidated.

Source: crates/ravet-device/Cargo.toml, crates/ravet-device/src/lib.rs, tools/device-probe/Cargo.toml, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/tests/output.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0018-output-devices.md.

Input capture and FIFO duplex effects¶

Explicit CPAL f32 input streams publish whole-frame prefixes to a prepared ring; duplex rendering zero-fills underflow, partitions variable callbacks and feeds portable effects.

Limits: 1..64 channels per direction, power-of-two ring 1..65536 frames, scratch up to 65536. Matching nominal rates, independently clocked/sequential streams; no drift compensation or sample-exact alignment. No automatic recovery, hotplug or MIDI/events; hidden-producer automatic recording integration is exercised synthetically, without physical recording validation.

Source: crates/ravet-device/src/input.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/tests/recording_worker.rs, crates/ravet-device/tests/input.rs, crates/ravet-device/tests/output.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0028-input-duplex-devices.md.

Caller-scheduled exact-device output recovery¶

An explicit control-thread owner preserves healthy f32 output, releases missing/failed streams and prepares/starts fresh DSP through a caller-supplied factory.

Limits: Exact host-local ID 1..4096 bytes/no NUL, fixed existing f32 config/scratch limits; no fallback/settings mutation/timer/hotplug subscription/state migration/clock compensation/duplex or native plugin scheduling. Backend work can block; errors retry only on service. Controlled transitions and UMC1820 silent manual restart evidence, physical unplug/real backend fault/other-platform/deadline unvalidated.

Source: crates/ravet-device/src/recovery.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/src/recovery.rs, crates/ravet-device/tests/output.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0090-explicit-output-recovery.md.

Caller-scheduled exact-pair duplex recovery¶

An explicit control-thread owner releases both streams when either exact device disappears or either backend fails, reopening fresh FIFO/DSP through a caller factory.

Limits: Fixed f32 1..64-channel matching-rate configs, scratch 1..65536, power-of-two ring 1..65536; exact IDs 1..4096 bytes/no NUL. No fallback/settings mutation/timer/hotplug subscription/state migration/clock compensation/recording or native plugin scheduling. Controlled transitions and silent UMC1820 manual pair restarts only; physical removal/real backend failure/drift/other-platform/deadline unvalidated.

Source: crates/ravet-device/src/recovery.rs, crates/ravet-device/src/lib.rs, tools/device-probe/src/main.rs.

Tests: crates/ravet-device/src/recovery.rs, crates/ravet-device/tests/input.rs, tools/device-probe/src/main.rs.

Documentation: docs/audio-devices.md, docs/decisions/0091-explicit-duplex-recovery.md.

Explicit paired clocked callback retirement and original-owner recovery¶

An additive f32 paired CPAL route retains the unique prepared clocked renderer and matching capture endpoints until all four callbacks retire, then allows stopped file/DSP extraction and explicit owner-preserving recovery.

Limits: No new dependency/defaults; existing clocked rate/channel/ring/frame/corrected-sinc profile. Failure-owned prepared constructors preserve original P/raw consumer; fallible scratch before child prepare; legacy consuming signatures unchanged, failed-prepare inactive contract. One control retirement worker; disjoint private UnsafeCell capture/renderer, unique non-Clone FnMut data guards, two atomic-only error guards, no Weak/public clones. All FOUR Acquire retirement flags plus stable sole strong ownership before extraction; callback Arc field Drop cannot be inferred from flags. Framework capture Drop only publishes flag/releases non-last Arc; no producer/consumer/DSP/scratch/counter disposal there, including early receiver Drop/asynchronous native owners. Native CPAL/OS locks/closure allocation/destructors and panic runtime remain separate limits. Nonblocking poll; explicit CONTROL wait without deadline/cancellation. Original spawn/input/output/preparation/start errors retain Immediate/Pending ownership, no hidden retry. Caught polling fault returns exclusive stopped owner; foreign lifecycle/restore panic may lose recovery, no forged receipt. Capture/output panic disables its guard, histories exceptional. Stopped result exposes no render/mutable child and consumes into original P and matching raw consumer/PreparedCapture, once-only deactivate; converted/prefetched histories discarded CONTROL, queued raw cursor unchanged. Explicit selected-ID recovery Owned/Live/Retiring/Disabled, known live callback faults retire before selection, healthy selection errors retain pair/original error without absence inference; no enumerate/open/restore while pending or disabled; after proof restore original P/receipt before fresh pair. Normal restore errors retain actual mutated P/receipt; successful restore once, failed opens preserve ownership, generation advances only after successful start. No automatic timer/fallback/subscription/state migration; ordinary DSP faults explicit reset/reopen policy. All24 Drop orders, actual concurrent capture/render and Wave/IntegerSinc/indexed-worker/W215 stopped failed/successful seek17/reprepare/exact suffix/drain qualified offline. Two short silent paired CoreAudio cycles on one USB interface prove original-owner retirement/reopen only; no acoustic validation, synchronized starts, timestamp alignment, live mailbox, physical hotplug/drift, long-session latency, callback/teardown deadline or broad device/platform claim.

Source: crates/ravet-device/src/lib.rs, crates/ravet-device/src/input.rs, crates/ravet-device/src/clocked.rs, crates/ravet-device/src/reclaimable_clocked.rs, crates/ravet-device/src/reclaimable_clocked_recovery.rs.

Tests: crates/ravet-device/src/reclaimable_clocked_tests.rs, crates/ravet-device/src/reclaimable_clocked_recovery_tests.rs, crates/ravet-device/tests/buffered_file_duplex.rs, crates/ravet-device/tests/indexed_buffered_output.rs, tools/device-probe/src/bin/reclaimable-clocked-duplex.rs.

Documentation: docs/audio-devices.md, docs/audio-files.md, docs/decisions/0231-reclaimable-clocked-duplex-ownership.md.

Native web editor backends¶

Local HTML editors use Cocoa/WebKit, Windows HWND/WebView2 or Linux X11/WebKitGTK with finite backing colours, bounded JSON messages, coalesced snapshots and explicit teardown. Cocoa editor views accept initial drags from inactive windows. WebKit browser context menus are suppressed in all frames while consumer right-click actions still receive events.

Limits: C++ API on all three platforms; the separate Cargo Rust binding remains macOS only. Caller owns the UI loop and callback lifetime. Linux requires GTK3 X11/XWayland, WebKitGTK 4.1 >=2.40 and UI-thread GLib pumping; an existing Wayland GTK context is rejected. Loaded SWELL hosts must provide cooperative LOAD_GTK initialization or editor creation is rejected. Windows requires the WebView2 loader and installed runtime; creation is asynchronous. 50 ms polling, one evaluation in flight, 65,536-byte JSON and 1 MiB inline HTML limits. WebKit context-menu suppression has no native opt-out; macOS synthetic DOM evidence only, Linux runtime validation pending. Windows context-menu policy is unchanged. Linux software painting is selectable with RAVET_WEB_LINUX_SOFTWARE_RENDERING (default OFF); UI CPU cost is unmeasured. Linux lifecycle evidence in local Ubuntu containers and native Omarchy/XWayland, Windows compile evidence only, macOS native probes; no DAW or deadline support claim.

Source: crates/ravet-surface/native/RavetWebView.h, crates/ravet-surface/native/RavetWebView.mm, crates/ravet-surface/native/RavetWebViewLinux.cpp, crates/ravet-surface/native/RavetWebViewWindows.cpp, crates/ravet-surface/native/mingw/EventToken.h, crates/ravet-surface/native/CMakeLists.txt.

Documentation: docs/native-editor.md, docs/decisions/0005-native-web-editor.md, docs/decisions/0014-cross-platform-native-web.md, docs/decisions/0205-webkit-context-menus.md.

Cargo macOS WebKit ownership binding¶

An explicit native crate builds Cocoa/WebKit through Xcode, checks main-thread creation, owns view and callback context, copies bounded snapshots and destroys native callback machinery before releasing state.

Limits: macOS only; Xcode build host required, native deployment target 12. View is not Send/Sync; caller supplies run loop and a valid live NSView parent through a documented unsafe attach. macOS owned-view resizing is available. No portable widgets, x86_64/macOS-12 runtime, native heap or DAW support claim.

Source: crates/ravet-webview/src/lib.rs, crates/ravet-webview/src/macos.rs, crates/ravet-webview/build.rs.

Tests: crates/ravet-webview/src/macos.rs, tools/editor-smoke/src/main.rs, crates/ravet-surface/native/tests/lifecycle.mm.

Documentation: docs/native-editor.md, docs/decisions/0013-cargo-native-gain-editor.md.

Rust-owned macOS editor C ABI¶

Native consumers create/attach/resize/show/destroy Rust-owned WebViews with counted UTF-8 callbacks, UI-thread status checks and retained exactly-once foreign-context release.

Limits: macOS/Xcode only; trusted HTML 1 MiB, snapshot 65536 bytes, dimensions <=16384. Consumers provide valid live handles/buffers/NSView parents and nonthrowing callbacks; host owns window/run loop. Wrong-thread destroy retains ownership; accepted destroy consumes. No format/product policy, other-OS/assistive-tech/DAW support claim.

Source: crates/ravet-webview/src/editor_abi.rs, crates/ravet-webview/include/RavetWebEditor.h, crates/ravet-webview/src/macos.rs, examples/gain-native/Cargo.toml, examples/gain-native/src/lib.rs.

Tests: crates/ravet-webview/src/editor_abi.rs, tools/native-validation/editor.cpp, tools/native-validation/CMakeLists.txt, tools/editor-smoke/src/probe.mm.

Documentation: docs/native-editor.md, docs/decisions/0076-native-editor-abi.md.

Reusable main-thread standalone windows resize their embedded page with native content and include a native title-bar settings button and standard device/channel-pair/rate/buffer/MIDI checklist popup with persistent exact device selections by default, with explicit full opt-out.

Limits: macOS 12+ Cocoa/WebKit and Xcode tools. Trusted local inline HTML up to 1 MiB with one closing body tag, reserved DOM IDs and control-thread snapshot/action contract. Consumer owns device inventory/validation/routing/lifecycle; creation opens no devices. Optional initial content aspect-ratio lock; programmatic resize fits the requested rectangle and native minimum size applies. Versioned preferences up to 8 KiB use a stable window-title key; hidden fixtures use process-local memory. Missing devices are unselected, restored settings never start audio. Plug-in editors and headless fixtures retain their own host/window policy. Programmatic native UI evidence, no broader platform or assistive-technology claim.

Source: crates/ravet-webview/src/standalone.rs, crates/ravet-webview/native/StandaloneWindow.mm, crates/ravet-webview/web/io-settings.html.

Tests: crates/ravet-webview/src/standalone.rs, examples/tutorials/src/ui/mod.rs.

Documentation: docs/native-editor.md, docs/project-starters.md, docs/decisions/0132-standalone-settings-and-knobs.md.

Reusable local web controls¶

Shared slider/number, linear/logarithmic rotary knob, polyphonic piano keyboard, toggle, choice, action-button and meter components provide explicit gestures/actions, held-key ownership, nonfeedback host refresh and retryable disposal; piano chords/glissando share lifecycle release, disabled keys remain opaque and meter text retains actual overload levels. Shared styles prevent UI label/body text selection while keeping editable fields and code output selectable. Knob and slider/fader pointer gestures leave numeric editing, suppress label activation and pointer focus outlines, and preserve direct number entry and keyboard focus styling.

Limits: Trusted inline documents up to 1 MiB; physical slider/knob values with optional logarithmic knob travel, 256 choices and 32-bit IDs. Meter labels 256 and formatter text 4096 JavaScript units; finite nonnegative readings. Consumer owns DOM labels/layout/theme, host schema/queue policy and asynchronous errors. Piano note bounds 0..127 with white endpoints and up to 128 external notes. Native macOS WebKit programmatic and browser keyboard evidence; no assistive-tech audit or complete native widget toolkit/platform claim.

Source: crates/ravet-surface/src/web_controls.rs, crates/ravet-surface/web/controls.js, crates/ravet-surface/web/theme.css, examples/gain-clap/editor/index.html, examples/gain-clap/src/gui.rs.

Tests: tools/editor-smoke/src/main.rs, examples/tutorials/src/ui/mod.rs, crates/ravet-surface/native/tests/control-semantics.js, crates/ravet-surface/native/tests/control-semantics.mm.

Documentation: docs/web-controls.md, docs/decisions/0034-reusable-web-controls.md, docs/decisions/0071-meter-text-and-held-keys.md.

Shared default semantic UI palette¶

Portable SVG themes, reusable local web controls, the standalone settings popup and example editors share semantic background/surface/text/accent colors.

Limits: Selected Amber default uses warm charcoal/plum surfaces and amber emphasis, with a warm paper light companion. Consumer CSS/theme overrides remain explicit; no platform-wide native styling or assistive-technology/contrast conformance claim.

Source: crates/ravet-surface/src/drawing.rs, crates/ravet-surface/src/web_controls.rs, crates/ravet-surface/web/theme.css, crates/ravet-webview/web/io-settings.html, examples/tutorials/editor/index.html, examples/gain-clap/editor/index.html.

Tests: crates/ravet-surface/tests/visual.rs, examples/tutorials/src/ui/mod.rs.

Documentation: docs/web-controls.md, docs/surface-drawing.md, docs/decisions/0132-standalone-settings-and-knobs.md.

Generic native open-file chooser¶

An explicit surface open-file API owns its completion callback, supports a native parent and extension filter, and returns cancellation without any product file policy.

Limits: UI thread after toolkit initialization; Cocoa/GTK asynchronous, Windows modal. macOS owned-window cancellation probe and Linux compile evidence; Windows and actual Linux chooser runtime unvalidated. One file; no save/folder/multi-selection or Rust binding.

Source: crates/ravet-surface/native/RavetFileDialog.h, crates/ravet-surface/native/RavetFileDialog.mm, crates/ravet-surface/native/RavetFileDialogWindows.cpp, crates/ravet-surface/native/RavetFileDialogLinux.cpp, crates/ravet-surface/native/CMakeLists.txt.

Tests: crates/ravet-surface/native/tests/file-dialog.mm.

Documentation: docs/runtime-services.md, docs/native-editor.md, docs/decisions/0020-rust-runtime-services.md.

CLAP editor control and gesture bridge¶

A main-thread gain/bypass edit API queues complete edits and continuous begin/value/end gestures, retains partial host output progress, invalidates stale edits after restore, and exposes coherent requested values and coalesced meters.

Limits: 32 queued commands/complete edits and at most 96 drain iterations per callback, also used by the macOS embedded gain editor. One continuous gesture at a time; live updates reserve end capacity and reject overflow. REAPER 7.82/macOS arm64 GUI gain recording exercised; no guaranteed host delivery. CLAP must serialize consumers; generation must not wrap across outstanding edits.

Source: examples/gain-clap/src/editor.rs, examples/gain-clap/src/lib.rs, examples/gain-clap/src/shared_gain.rs.

Tests: examples/gain-clap/src/editor.rs, examples/gain-clap/src/control_tests.rs, examples/gain-clap/tests/state.rs.

Documentation: docs/editor-control.md, docs/decisions/0012-clap-complete-state-and-edits.md, docs/decisions/0015-continuous-editor-gestures.md.

Rust runtime native ownership facade¶

Opaque handles, bounded returned buffers and consumed callback contexts expose Rust runtime APIs to native SDK consumers; narrow Rust OS bindings supply module paths, macOS UUID and Windows SMBIOS inputs.

Limits: Foreign callers guarantee pointer validity, nonthrowing callbacks and serialized teardown. C++ convenience read maps errors to empty text; Rust/C status retain errors. macOS arm64/Omarchy x64 ABI tests and native facade probes; private macOS consumer integration, Windows runtime validation pending. Raw hardware queries include no product hashing or transmission.

Source: crates/ravet-runtime-ffi/Cargo.toml, crates/ravet-runtime-ffi/src/lib.rs, crates/ravet-runtime-ffi/src/system.rs, crates/ravet-runtime-ffi/include/RavetRuntime.h, crates/ravet-runtime-ffi/include/RavetRuntime.hpp.

Tests: crates/ravet-runtime-ffi/src/lib.rs, crates/ravet-runtime-ffi/src/system.rs, crates/ravet-runtime-ffi/tests/native.cpp.

Documentation: docs/runtime-services.md, docs/decisions/0020-rust-runtime-services.md.

CLAP gain plug-in¶

A loadable gain plug-in advertises mono/stereo ports, gain and stepped bypass metadata/text, sample-timed automation, active/inactive flush, reset, reactivation, and complete session recall.

Limits: macOS arm64 validator/smoke-host and REAPER 7.82 session, automation and render evidence. Default macOS native-editor feature provides an embedded Cocoa gain GUI, committed and continuous gestures and coalesced meters. No broader host or production compatibility claim.

Source: examples/gain-clap/src/lib.rs.

Tests: examples/gain-clap/tests/host.rs, examples/gain-clap/tests/bridge.rs.

Documentation: docs/getting-started.md, docs/decisions/0002-clap-backend.md.

VST3 gain reference¶

External SDK builds separate processor/controller classes over shared Rust gain DSP, bounded sample-timed automation, bypass, complete state and normalized controller recall.

Limits: Mono/stereo native f32/f64 gain effect only; external SDK 3.8.1/macOS arm64 exercised with 47 validator tests including native 64-bit processing. REAPER 7.82 macOS arm64 wet/bypass/state/automation/generic-window checks pass. REAPER precision for this update unobserved. No custom editor, generic instrument/bus/event mappings, production signing or other target runtime claims.

Source: examples/gain-vst3/CMakeLists.txt, examples/gain-vst3/src/gain.cpp, scripts/bundle-vst3.py.

Tests: tools/vst3-validation/contracts.cpp, examples/gain-native/src/lib.rs, scripts/bundle-vst3.py, tools/reaper-validation/native-formats.lua.

Documentation: docs/vst3.md, docs/decisions/0021-vst3-gain-native.md, docs/decisions/0067-vst3-native-f64.md.

Native AUv3 processor and parameter editor¶

A paired f32 native processor/state entry renders through AUAudioUnit with physical global parameters, timed changes/continuing ramps, host bypass, complete live state, transport and opt-in MIDI/UMP input, plus a native parameter editor and embedded extension fixture.

Limits: One main bus, up to 128 parameters/64 channels per direction, public mono/stereo Gain; bounded 1024 links and 1024 minus parameter-count flattened events. macOS arm64 and iOS simulator in-process evidence; no extension discovery/IPC, DAW, physical device, production signing or deadline claim. Auxiliary buses, generated output, factory presets, SysEx and instrument reference remain pending.

Source: native/apple/RavetAudioUnit.h, native/apple/RavetAudioUnit.mm, native/apple/RavetParameterViewController.mm, native/common/RavetNativeSession.hpp, examples/gain-auv3/CMakeLists.txt, examples/gain-auv3/Extension.mm, scripts/build-mobile.py.

Tests: tools/auv3-validation/contracts.mm.

Documentation: docs/mobile.md, docs/decisions/0153-auv3-mobile-native-adapters.md.

Apple mobile standalone effect host¶

An explicit AVAudioEngine/AVAudioSession owner hosts a native effect with microphone permission, preferred device settings, interruption/route/reset rebuilding, retained state and selected CoreMIDI input; the public iOS/iPadOS Gain app exposes native Audio/MIDI settings and consumer-selected deployment minimums.

Limits: iOS/iPadOS 17 arm64/device and arm64 simulator builds; iPhone simulator UI launch and in-process AU contracts only. Physical routing/interruptions/MIDI and extension IPC remain unvalidated; no production provisioning or deadline claim. Matched mono/stereo Gain; its MIDI profile is disabled. Background audio and persisted app sessions remain pending.

Source: native/apple/RavetMobileAudio.h, native/apple/RavetMobileAudio.mm, examples/gain-mobile/apple/main.mm, examples/gain-mobile/apple/Info.plist.in, scripts/build-mobile.py.

Tests: tools/auv3-validation/contracts.mm, scripts/tests/test_mobile.py.

Documentation: docs/mobile.md, docs/decisions/0153-auv3-mobile-native-adapters.md.

Android standalone audio and MIDI host¶

An explicit AAudio f32 effect owner provides prepared planar conversion/chunking, nonblocking capture reads with shortage silence/counters, atomic error handoff, stopped retirement and a bounded immediate MIDI queue; the public foreground app exposes permission/audio-focus and Audio/MIDI settings, with consumer-selected minimum API, compile/target SDK and build-tools.

Limits: Android API 26 arm64 native cross-build, warning-free Java and aligned development APK signature evidence; scripted AAudio-double lifecycle tests only, no Android execution/device/deadline claim. Equal input/output rates/channels, no clock drift conversion; Gain mono/stereo, immediate MIDI 1 input, explicit Start recovery, no SysEx/MIDI 2/background audio or persisted app sessions.

Source: native/android/RavetAAudio.hpp, native/common/RavetNativeSession.hpp, examples/gain-mobile/android/native.cpp, examples/gain-mobile/android/CMakeLists.txt, examples/gain-mobile/android/app/src/main/java/org/ravet/gain/MainActivity.java, scripts/build-mobile.py, .github/workflows/mobile.yml.

Tests: scripts/tests/test_mobile.py, tools/mobile-validation/contracts.cpp, tools/mobile-validation/include/aaudio/AAudio.h.

Documentation: docs/mobile.md, docs/decisions/0153-auv3-mobile-native-adapters.md.

Public AUv2 native performance instrument bundle¶

Public mono/stereo native performance AUv2 instrument adopts selected planar f32/f64 audio, timed MIDI and Level intent, coherent Level state, and checked stopped/offline/reset lifecycle over reusable AU helpers.

Limits: External Apple AudioUnit SDK, macOS arm64 local in-process evidence. Explicit packed float32/64 output ASBD and exact selected native table/entry provenance; f32 Level controls/state/text remain independent of audio precision. Stock intermediate32 Initialize precedes checked stop/deactivate/selected setup/activate/start, ready only after completion. Successful serialized offline mode changes reset voice history while retaining accepted queued timed MIDI/Level intent; failure clears readiness/pending intent and requires serialized uninitialize/initialize. Stopped32↔64 complete Level recall excludes voices/history; inherited stock Reset ignores supplied scope/element. SDK facade may normalize original ASBD size/reserved fields; no arbitrary SDK setup rollback, full wrapper fastmath/backend-fault injection, DAW/auval/device/deadline/other-platform support claim. Existing16voices,1024expanded events minus reserved state slot and1..65536prepared frames; positive opaque StartNote IDs permit1048575nonreused generations per component lifetime. No SysEx/MIDI2/pedal/pitch-bend/expression/program/editor or production distribution claim; external SDK sources remain outside RAVET and no global installation occurs.

Source: crates/ravet-native/include/RavetAuAudio.hpp, crates/ravet-native/include/RavetAuParameters.hpp, crates/ravet-native/include/RavetAuState.hpp, examples/performance-au/PerformanceAU.mm, examples/performance-au/CMakeLists.txt, examples/performance-au/Info.plist.in, scripts/bundle-au.py, scripts/au_bundle.py.

Tests: tools/au-validation/audio.cpp, tools/au-validation/native-parameters.cpp, tools/au-validation/performance.mm, tools/au-validation/performance64.mm, tools/au-validation/performance-precision.mm, tools/au-validation/native-precision-schema.cpp, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/performance-au.md, examples/performance-au/README.md, docs/decisions/0174-auv2-native-performance-instrument.md, docs/decisions/0203-auv2-performance-audio-precision.md.

AudioUnit v2 gain reference¶

An external SDK wrapper embeds the Rust-backed VST3 gain bundle in a local AUv2 component with normalized controls, stereo rendering, dry host bypass and gain preset recall.

Limits: macOS arm64 actual-bundle AudioComponent tests only; host bypass is preserved during preset recall. No custom editor, AUv3, DAW discovery, auval, sandbox runtime, production signing or deadline claim. SDKs remain external; no global installation.

Source: examples/gain-au/Info.plist.in, examples/gain-vst3/CMakeLists.txt, scripts/bundle-au.py, scripts/au_bundle.py.

Tests: tools/au-validation/contracts.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/audio-unit.md, docs/decisions/0022-auv2-reference.md.

Optional native AAX WebKit editor ownership¶

An opt-in native Gain editor uses checked initialized automation delegates, retained callback context and actual public SDK view ownership with separate editor packaging.

Limits: macOS and separately licensed external SDK only; default-off native Gain reference, stock/Performance option rejects. Exact selected native32/64 audio companion cache and native codec provenance retained; host audio remains f32. MAIN ownership; bounded finite positive initialized dimensions, original per-ID begin/value/end refusals and throws. Accepted touch retired once; refused end latches unresolved without replay. Entered callback may destroy GUI while independent context/model/host/container stays retained; reopening waits old context retirement. SDK Initialize/SetViewContainer queries require caller GUI liveness; final Release MAIN, public refcount/NSView liveness obligations. UI post is acceptance; model forwarding and actual Rust audio commitment tested separately. Default headless descriptor has no GUI advertisement. No generic program list, modifier automation menu, meters, accessibility, Pro Tools/PACE distribution, other-platform or deadline support.

Source: crates/ravet-native/include/RavetAaxEditorControls.hpp, crates/ravet-native/include/RavetAaxWebEditor.hpp, examples/gain-aax/GainNativeEditor.hpp, examples/gain-aax/GainNativeParameters.hpp, examples/gain-aax/native-editor.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/editor-controls.cpp, tools/aax-validation/editor.mm, tools/aax-validation/editor-registered.mm, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-native-editor.md, docs/decisions/0234-aax-native-editor-ownership.md, docs/aax-precision.md.

AAX gain reference build¶

Authored public AAX SDK model/algorithm over shared Rust gain DSP defaults to checked mono/stereo native lifecycle and complete global state; an explicit stock wrapper profile preserves its separate schema/control regression.

Limits: Local macOS arm64 entry-point/SDK probes and registered Gain parameter/algorithm fixtures at1024frames. Default native owner validates first ordinary realtime mono/stereo and complete native global state including bypass. Explicit stock profile preserves rejected/silent initial mono then positive mono/stereo after public reprepare. Native chunk is a deliberate local prototype change, without released-session compatibility. Optional native editor and internal native32/64 DSP have separate scoped records. No Pro Tools acceptance, production PACE signing, AudioSuite or broad support. Installed signing tool alone is insufficient; SDK agreements and identifiers require release review.

Source: examples/gain-aax/description.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-aax.py, examples/gain-aax/GainNativeParameters.hpp, examples/gain-aax/native-registration.cpp, examples/gain-aax/native-owner.cmake, scripts/aax_bundle.py.

Tests: tools/aax-validation/check-bundle.py, tools/aax-validation/registered.cpp, tools/aax-validation/parameters.cpp, tools/vst3-validation/contracts.cpp, scripts/tests/test_aax_bundle.py, tools/aax-validation/registered-native.cpp, tools/aax-validation/processor.cpp, tools/aax-validation/model.cpp.

Documentation: docs/aax.md, docs/decisions/0023-native-format-references.md, docs/decisions/0213-aax-checked-native-lifecycle.md, docs/aax-precision.md.

Opt-in Gain AAX meter reference¶

The explicit gain-meters local bundle registers six native peak/RMS taps through public SDK AddMeters/descriptions and distinct mono/stereo owned factory IDs while retaining canonical Gain32/64 schema/state/transport/smoothing/bypass DSP.

Limits: macOS arm64 external licensed SDKs; unchanged host-f32 audio/control/state, distinct product/native/effect identities, no editor/stock variant. Authored empty external bootstrap exposes zero unrelated VST3 classes. Each native32/64 local package4 native validators plus actual module startup/exports/version/AddMeters/Initialize→process analytic and late snapshot/native fault receipts; generic fixtures additionally depend on frozen R4/W241 raw native exports pending public adoption. Pipeline Python16 and default Gain32/Performance4/stock14 regressions locally qualified; actual Pro Tools/system installation/PACE production signing/distribution/deadline and other architecture/platform unqualified.

Source: examples/gain-meters-aax/GainMeterParameters.hpp, examples/gain-meters-aax/native-registration.cpp, examples/gain-meters-aax/bootstrap.cpp, examples/gain-meters-aax/description.cpp, examples/gain-meters-aax/CMakeLists.txt, scripts/aax_bundle.py, scripts/bundle-aax.py, tools/aax-validation/check-bundle.py.

Tests: tools/aax-validation/registered-meters.cpp, tools/aax-validation/meters.cpp, tools/aax-validation/meter-composition.cpp, scripts/tests/test_aax_bundle.py.

Documentation: docs/aax-meters.md, examples/gain-meters-aax/README.md, docs/decisions/0262-aax-native-metering.md.

LV2 gain reference¶

Mono/stereo public Gain descriptors use the native f32 processor, cached schema controls and coherent portable LV2 state extension with actual-library lifecycle/audio/state validation.

Limits: External LV2 headers and native 64-bit publication required. Block-start physical control ports; no Atom/MIDI/UI/f64/auxiliary/DAW/Linux-runtime claim. State requires optional host URID map; restore is serialized, save may fail on contention, and no hard real-time feature is advertised.

Source: examples/gain-lv2/gain.cpp, examples/gain-lv2/CMakeLists.txt, examples/gain-lv2/manifest.ttl, examples/gain-lv2/gain.ttl, scripts/bundle-lv2.py, crates/ravet-native/include/RavetLv2Processor.hpp.

Tests: tools/lv2-validation/contracts.cpp, tools/lv2-validation/state.cpp.

Documentation: docs/lv2.md, docs/decisions/0023-native-format-references.md.

Bounded LV2 Atom MIDI note input¶

An external-SDK adapter preflights a complete ordered Atom sequence before mapping MIDI1 short notes with normalized velocity and channel/key release scopes into caller-owned native events.

Limits: Live aligned foreign sequence storage; frame-time/default units, 64 KiB body/1024 raw events. Zero-velocity note-on releases; defined other short MIDI and bounded unknown Atoms are ignored after validation. No invented per-note identities, running status, SysEx, expressions, MIDI2, Atom output or DAW/Linux/deadline claim.

Source: crates/ravet-native/include/RavetLv2NoteInput.hpp, crates/ravet-native/include/RavetLv2Processor.hpp.

Tests: tools/lv2-validation/performance.cpp.

Documentation: docs/lv2.md, docs/decisions/0170-lv2-midi-performance-instrument.md.

Public LV2 MIDI performance instrument bundle¶

A public zero-input mono/stereo f32 LV2 instrument connects bounded Atom MIDI notes, generic Level control and canonical complete state to the native performance archive; an explicit bundler packages metadata/module/notices and validates the selected binary.

Limits: Required cached URID map, 1024 merged notes/control/restore events and 65536 prepared frames. Transactional failure preserves voice history/pending recall. No f64, expressions/pedals/pitch, custom UI, Atom output, DAW/Linux-runtime/device or deadline claim; local macOS ARM actual-module evidence only. No host installation or production signing.

Source: examples/performance-lv2/performance.cpp, examples/performance-lv2/manifest.ttl, examples/performance-lv2/performance.ttl, examples/gain-lv2/CMakeLists.txt, scripts/bundle-lv2.py, scripts/lv2_bundle.py.

Tests: tools/lv2-validation/performance.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: examples/performance-lv2/README.md, docs/lv2.md, docs/decisions/0170-lv2-midi-performance-instrument.md.

Reusable LV2 native processing and complete state¶

The public Gain and Performance LV2 factories consume prepared native schema metadata and coherent complete state with exact originating core/shared-schema admission before resource creators.

Limits: External LV2 SDK, native f32 main profile,1..64 channels/1..1024 writable block-start physical controls/65536 frames bounded by template; state needs cached URID mapping, no threadSafeRestore/hardRT advertisement and contended save may fail after one attempt; unchanged constructor/port/lifecycle, serialized restore and concurrent publication save. Exact cache-schema processor pointer and exact cache/state shared schema pointer; callback-equivalent copied cores/separate copied schemas reject creator0. Queries once on CONTROL; violating metadata exception refuses before acquisition, other native ABI calls remain nonthrowing. Existing ABI supplies no stronger top-level cache/state table-address oracle; coherent views retaining actual origins remain valid. Maintained origin gate required by Gain/Performance bundler profiles with meaningful late-gate failure propagation. Isolated CMake7/7 and actual Gain3/Performance5 packaged validators plus Python4; fresh public/reference/shared acceptance tracked separately. No auxiliary/f64/generated-output/custom-UI/DAW/Linux-runtime/deadline claim.

Source: crates/ravet-native/include/RavetLv2Processor.hpp, examples/gain-lv2/gain.cpp, examples/performance-lv2/performance.cpp, examples/gain-lv2/CMakeLists.txt, scripts/lv2_bundle.py.

Tests: tools/lv2-validation/origin.cpp, tools/lv2-validation/state.cpp, tools/lv2-validation/contracts.cpp, tools/lv2-validation/performance.cpp, tools/lv2-validation/processor-transport.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: docs/lv2.md, docs/decisions/0167-lv2-native-schema-state.md, docs/decisions/0261-lv2-exact-origin-admission.md.

Native precision sidechain CLAP reference¶

A stateless stereo fixed-threshold gate exports main input/output plus an input-only mono auxiliary detector in native f32/f64; its distinct validate-sidechain executable checks the actual public bundle.

Limits: Threshold 0.1, no parameters/state/custom editor; nonfinite detector closes gate. Two prepared precision bridges, selected common size per callback. Linked/built ABI and validator plus isolated REAPER 7.82 auxiliary render pass within recorded scope; host precision was not measured. General host/device/deadline support remains pending.

Source: examples/sidechain-clap/Cargo.toml, examples/sidechain-clap/src/lib.rs, scripts/bundle-clap.py.

Tests: examples/sidechain-clap/tests/host.rs, examples/sidechain-clap/tests/support/mod.rs, examples/sidechain-clap/examples/validate.rs, tools/reaper-validation/sidechain.lua, tools/reaper-validation/check-sidechain-render.py, scripts/tests/test_sidechain_render.py.

Documentation: docs/sidechain-clap.md, docs/decisions/0058-clap-auxiliary-buses.md.

MIDI sine CLAP instrument reference¶

The portable 16-voice sine reference exports stereo audio without input, timed MIDI notes/controllers, stable level, atomic state recall, generic host controls and infinite held-note tail; validate-sine checks its public bundle with a distinct executable name.

Limits: Stereo f32/MIDI dialect only; no custom editor, CLAP note-ID/modulation, SysEx/UMP, auxiliary audio or f64 export. Persists level only; notes/controller/RPN performance state transient. macOS arm64 ABI/validator and REAPER 7.82 synthetic MIDI/audio/state/automation pass with silent hardware sends; other targets/DAWs pending. Development signing only.

Source: examples/sine-clap/Cargo.toml, examples/sine-clap/src/lib.rs, scripts/bundle-clap.py.

Tests: examples/sine-clap/tests/host.rs, examples/sine-clap/tests/support/mod.rs, examples/sine-clap/src/lib.rs, examples/sine-clap/examples/validate.rs, tools/reaper-validation/sine-instrument.lua.

Documentation: docs/sine-clap.md, docs/decisions/0040-clap-main-bus-instrument.md.

Public native identified-performance reference¶

A separate public 16-voice f32/f64 archive consumes generic native processor/schema/cache/audio-state and optional live-publication tables with distinct entry symbols, canonical global level state and bounded original-target completion.

Limits: Mono/stereo no-input buses without auxiliaries,65536 frames/1024 input and output events; optional notifications and portable sine policy. State saves level only, not voices/history. Live publication requires native64-bit atomics; caller owns separate state/render scheduling. No SDK factory/controller advertisement/editor/DAW/device/deadline/other-platform claim.

Source: examples/performance-native/Cargo.toml, examples/performance-native/src/lib.rs, examples/performance-native/include/RavetPerformance.h.

Tests: tools/native-validation/performance.cpp, crates/ravet-instrument/tests/performance_sine.rs.

Documentation: examples/performance-native/README.md, docs/native-processing.md, docs/decisions/0165-public-native-performance-reference.md.

Raw MIDI native32/64 sine reference¶

Distinct raw-MIDI native exports share the portable sine render kernel, preserve acknowledged Level independently of program requests, and expose transient exact raw/voice/request telemetry.

Limits: 16 voices, no-input mono/stereo, native32/64; Level ID1/default0.2 only, RAVETMS/version1 complete state. Program application explicitly disabled, request/ordinary voice/RPN/MPE behavior retained; no per-channel patches/host program menu.23 stopped telemetry fields are transient, not state. Actual f64 output exceeds f32 resolution, f32 matches existing scalar output. Pressure/timbre do not modulate sine, no deadline/SDK routing inferred.

Source: examples/performance-native/src/midi.rs, examples/performance-native/include/RavetMidiSine.h, crates/ravet-instrument/src/synthesis.rs.

Tests: examples/performance-native/src/midi.rs, tools/aax-validation/short-midi.cpp.

Documentation: examples/performance-native/README.md, docs/midi.md, docs/aax-short-midi.md, docs/decisions/0247-aax-short-midi-input.md.

Public VST3 performance instrument¶

A separate 16-voice public VST3 reference adopts native f32/f64 no-input rendering, timed identified notes, five audible note-expression declarations, canonical transactional level recall and explicit profile-aware local bundle packaging/validation.

Limits: External SDK, native 64-bit lock-free atomics and mono/stereo profile required. One shared 1024-event budget includes recall/tuning expansion; unsupported selected payloads reject. Brightness/pressure are stored without timbre changes. No generated completion bus, custom editor, programs, MIDI CC mapping or broader platform/device/deadline claim. Local SDK validation is separate from DAW evidence.

Source: examples/performance-vst3/src/performance.cpp, scripts/bundle-vst3.py, scripts/vst3_bundle.py, examples/gain-vst3/CMakeLists.txt, examples/performance-native/src/lib.rs.

Tests: scripts/tests/test_vst3_bundle.py, tools/vst3-validation/performance_instrument.cpp, tools/reaper-validation/performance-instrument.lua, tools/reaper-validation/check-performance-render.py, tools/reaper-validation/test_checks.py.

Documentation: docs/decisions/0176-public-vst3-profile-bundling.md, examples/performance-vst3/README.md, docs/vst3.md, docs/host-validation.md, docs/decisions/0166-vst3-performance-instrument.md.

Native ABI for shared reference DSP¶

A Rust static library exposes exclusively owned gain lifecycle, prepared scratch processing and pure complete/legacy state codecs to native reference format wrappers.

Limits: Public gain reference only, separate 1..2 f32/f64 handles, 65,536 frames and 1,024 f32 parameter events. Shared native adapter uses at most 1 MiB f32/2 MiB f64 copied-input/output audio scratch plus events; processing panic poisons until fresh preparation. Foreign pointers/ranges and serialized ownership are caller obligations. Normal Rust callback heap behavior tested; native allocations/deadlines are outside that evidence.

Source: examples/gain-native/Cargo.toml, examples/gain-native/src/lib.rs, examples/gain-native/include/RavetGain.h, tools/native-validation/CMakeLists.txt.

Tests: examples/gain-native/src/lib.rs, examples/gain-native/src/precision64_tests.rs, tools/native-validation/gain64.cpp, tools/vst3-validation/contracts.cpp.

Documentation: docs/vst3.md, docs/decisions/0021-vst3-gain-native.md, docs/decisions/0066-native-f64-gain-abi.md.

Gain session save and restore¶

CLAP saves a complete 32-byte version-two gain/bypass record, migrates 20-byte version-one gain records, and restores both values coherently at process, flush, or reset boundaries.

Limits: Gain plus boolean bypass only; restore snaps smoothing, then host automation proceeds normally. Requires 64-bit atomics and fewer than 2^31 control publications across callbacks or outstanding edits. REAPER 7.82/macOS arm64 gain/bypass session recall exercised; no preset discovery or broader session compatibility claim.

Source: examples/gain/src/state.rs, examples/gain-clap/src/lib.rs, examples/gain-clap/src/shared_gain.rs.

Tests: examples/gain/tests/state.rs, examples/gain-clap/src/shared_gain.rs, examples/gain-clap/tests/host.rs, examples/gain-clap/tests/state.rs.

Documentation: docs/session-state.md, docs/decisions/0003-gain-session-state.md, docs/WORK_STATUS.md.

Embedded editor and controls¶

The macOS CLAP gain editor embeds a compiled-in WebKit page with gain slider/numeric control, bypass, stereo peak/RMS meters, host automation updates and visible edit errors.

Limits: Embedded Cocoa only, default 480x390 logical size, resizable through 1200x900, default optional native-editor feature. One live gain gesture at a time, bounded updates with reserved end capacity. REAPER 7.82/macOS arm64 controls/meters and FX-chain resize exercised. No plug-in-owned floating windows or general widget toolkit; floating host-wrapper corner resize unverified.

Source: crates/ravet-surface/src/lib.rs, examples/gain-clap/src/gui.rs, examples/gain-clap/editor/index.html, tools/editor-smoke/src/main.rs, tools/editor-smoke/src/probe.mm.

Tests: examples/gain-clap/src/gui.rs, tools/editor-smoke/src/main.rs.

Documentation: docs/native-editor.md, docs/decisions/0013-cargo-native-gain-editor.md.

Optional macOS VST3 gain editor¶

A compiled local gain/bypass page consumes Rust-owned WebView and schema-validated UI codecs; SDK controller callbacks deliver normalized gestures with host refresh, rejected-edit rollback and retryable rejected ends.

Limits: Default-disabled --native-editor, macOS Cocoa NSView only, host UI thread/window/run loop. 65536-byte edit/snapshot JSON; size 360x300..1200x900. Gain/bypass/status and optional host-delivered peak/RMS/diagnostic meters; host queue forwarding required. Actual-bundle synthetic Cocoa/SDK evidence, no REAPER/focus/assistive-tech/other-format/platform claim. Forced destruction cannot guarantee a rejecting host accepts gesture end.

Source: examples/gain-vst3/src/gain.cpp, examples/gain-vst3/editor/index.html, examples/gain-native/src/editor.rs, examples/gain-native/include/RavetGainEditor.h, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py.

Tests: examples/gain-native/src/editor.rs, tools/vst3-validation/editor.cpp, tools/vst3-validation/contracts.cpp.

Documentation: docs/vst3.md, docs/native-editor.md, docs/decisions/0077-vst3-gain-editor.md.

Optional AUv2 Cocoa gain editor¶

Editor-enabled nested VST3 supplies the actual component Cocoa UI protocol through the external SDK wrapper, with gain/bypass gestures, notifying host/preset refresh and rendered-audio verification.

Limits: Default-disabled --native-editor, macOS main-thread AppKit/run loop and live AudioUnit ownership. Shared size 360x300..1200x900; exercised setFrame path, setFrameSize forwarding unvalidated. Host changes use AUParameterSet and bulk preset all-parameter notification. Meter transfer uses SDK timer/run loop; host bypass/stopped rendering retain readings. No DAW/auval/focus/assistive-tech/sandbox/other-architecture claim.

Source: scripts/bundle-au.py, examples/gain-vst3/CMakeLists.txt, examples/gain-vst3/src/gain.cpp, examples/gain-native/src/editor.rs.

Tests: tools/au-validation/editor.mm, tools/au-validation/contracts.mm, tools/editor-smoke/src/probe.mm.

Documentation: docs/audio-unit.md, docs/decisions/0078-auv2-gain-editor.md.

Sample-timed sine factory program recall¶

The public sine reference consumes three complete factory level programs via master-channel MIDI requests, preserving voices and reflecting CLAP state with deferred value refresh.

Limits: Bank 0/programs 0..2 levels 0.2/0.05/1, one global level; chosen master even before MPE negotiation. Unknown addresses/channels preserve values. No program identity persistence, host program/preset menus, General MIDI bank or new DAW program evidence. Hosts service coalesced callback; optional HostParams value rescan occurs on main thread.

Source: crates/ravet-instrument/src/synthesis.rs, examples/sine-clap/src/lib.rs.

Tests: crates/ravet-instrument/tests/synthesis.rs, examples/sine-clap/tests/support/mod.rs, crates/ravet-host/tests/sine_programs.rs.

Documentation: docs/midi.md, docs/sine-clap.md, docs/decisions/0081-sine-program-recall.md.

Native gain complete program metadata¶

A narrow public C header exposes immutable count and atomic complete control/address/name metadata for native gain SDK consumers.

Limits: Reference ABI only, live aligned caller output pointers, 128-byte complete NUL/zero-padded UTF8 names, fixed three programmes. Rejection preserves outputs; normal reads heap-free. No live DSP/current identity, generic ABI/host registration/DAW claim or exceptional deadline guarantee.

Source: examples/gain-native/src/programs.rs, examples/gain-native/src/lib.rs, examples/gain-native/include/RavetGainPrograms.h.

Tests: examples/gain-native/src/programs.rs, tools/native-validation/programs.cpp, tools/native-validation/CMakeLists.txt.

Documentation: docs/parameters.md, docs/vst3.md, docs/decisions/0083-native-gain-programs.md.

Optional VST3 factory program mapping¶

An explicit build maps Rust gain programs to one SDK root/list/selector, complete host value refresh and sample-timed expanded processor control events.

Limits: Default-disabled --factory-programs, macOS arm64/SDK 3.8.1 validated only. ID3 nonautomatable selector, no persisted current identity. Host delivers complete values after optional notification; rollback is local. Raw/expanded events <=1024 (512 program-only), existing smoothing/bypass. No DAW/other-format/menu UI/MIDI/deadline claim.

Source: examples/gain-vst3/src/gain.cpp, examples/gain-vst3/CMakeLists.txt, scripts/bundle-vst3.py, examples/gain-native/src/programs.rs.

Tests: tools/vst3-validation/programs.cpp, tools/vst3-validation/contracts.cpp, tools/vst3-validation/editor.cpp.

Documentation: docs/vst3.md, docs/decisions/0084-vst3-factory-programs.md.

Optional AUv2 factory program mapping¶

An explicit component build maps three complete gain programs to AU factory presets and block-start selector recall with coherent host bypass.

Limits: Default-disabled --factory-programs; macOS arm64 in-process reference only. ID3 finite normalized nearest/ties-up, offset zero only. Explicit factory bypass recall differs from saved-state host-bypass preservation; custom negative preset metadata accepted. AUBase effect dispatch/document restore only, no instrument/ProcessBufferLists, DAW/auval/other architecture or persisted program identity claim.

Source: examples/gain-au/programs.mm, examples/gain-vst3/CMakeLists.txt, scripts/bundle-au.py.

Tests: tools/au-validation/programs.mm, tools/au-validation/contracts.mm, tools/au-validation/editor.mm.

Documentation: docs/audio-unit.md, docs/decisions/0085-auv2-factory-programs.md.

Interactive example device and MIDI ownership¶

Native synth/effect/MPE windows use knobs, a layered piano widget, default Audio/MIDI settings, coherent meters/voices, selected channel routing and multiple MIDI inputs; MIDI 2.0 provides an interactive codec inspector.

Limits: macOS live-ui feature, f32 streams with up to 64 channels and output rates 8..192 kHz; 512-frame prepared sub-blocks, 16 fixed patch commands, up to 16 MIDI inputs with 256 packets each and 64 polling attempts/block. Arrival-time MIDI/edits are block-quantized; queue loss clears voices. All four tabs uniformly scale a fixed 900x780 canvas with locked 900:780 content aspect; native viewport, component dimensions/positions and bounds checked at 720x624, 900x780, 1080x936 and constrained wide/tall requests. Explicit device selection/start; stop before changes, no automatic recovery, timestamp mapping or broad device/deadline support claim. Audio/MIDI preferences restore without automatic start; a main Start/Stop control reuses current selections.

Source: examples/tutorials/src/ui/mod.rs, examples/tutorials/src/ui/audio.rs, examples/tutorials/editor/index.html.

Tests: examples/tutorials/src/ui/audio.rs, examples/tutorials/src/ui/mod.rs.

Documentation: docs/examples.md, docs/native-editor.md, docs/decisions/0132-standalone-settings-and-knobs.md.

RAVET Foundry project creation and builds¶

A RAVET-native wizard and shared Rust CLI create independent offline, standalone and effect/instrument plug-in workspaces, reopen versioned TOML settings, preserve consumer source during conflict-checked regeneration and run explicit background builds/local bundles with native directory pickers.

Limits: Local checkout paths, offline/application/plug-in templates, immutable package/kind/processing role, bounded settings/messages/logs and one worker. Seven whitelisted directory fields, <=4096-byte paths, native modal choosers with transient sequenced selection and unchanged cancellation; macOS chooser/bridge evidence, Windows/Linux execution pending. Effect CLAP/VST3/AUv2/AUv3/AAX/LV2 and instrument CLAP/VST3/AUv2/LV2 reference adapters; external SDKs and native CMake3.25. Standalone/custom effect editor use macOS Rust window bindings. Windows x64 MSVC and Linux GTK3/WebKitGTK4.1/X11 native Foundry launchers/source-build guides supplied; target runtime validation pending. Per-file replacement, no group crash atomicity or protection against external writers; closing cancels direct child only. No MPE/component/module/platform chooser, instrument AAX/AUv3 exporters, cross/universal builds, global installation, production signing or platform/DAW/deadline claim.

Tests: tools/foundry/tests/projects.rs, tools/foundry/src/main.rs, scripts/check-foundry.py.

Documentation: docs/foundry.md, docs/project-starters.md, docs/decisions/0194-foundry-project-management.md.

CLAP bundling and smoke host¶

A Python bundler creates a local optimized or debug artifact; a native development host loads it and checks automation, ports, flush, lifecycle, and active state recall.

Limits: macOS bundling uses an ad hoc signature. Windows/Linux packaging paths are untested. No automatic installation or production signing. Load trusted RAVET bundles only.

Source: scripts/bundle-clap.py, tools/clap-smoke/src/lib.rs, tools/clap-smoke/src/main.rs.

Tests: examples/gain-clap/tests/host.rs.

Documentation: docs/getting-started.md, docs/decisions/0002-clap-backend.md.

Disposable REAPER validation harness¶

Public ReaScript checks host discovery, parameter state, editor window creation, automation playback and saved-session recall; Python generates synthetic stereo audio and verifies actual DAW-rendered output. The native meter prototype requires a public marker and empty project before mutations.

Limits: Requires an empty disposable REAPER session and resource directory. Startup/evaluation/audio dialogs may need owner interaction. REAPER 7.82/macOS arm64 actual session/automation, PCM stem renders and GUI gain recording pass. Render source must be verified explicitly in the host dialog. FX-chain zoom/restore inspected; floating-wrapper corner resizing unverified. Native VST3 meter forwarding and editor window handle pass in REAPER 7.82/macOS arm64; visual/assistive-tech behavior remains unvalidated. No production host support or deadline claim.

Source: tools/reaper-validation/validate.lua, tools/reaper-validation/ui-check.lua, tools/reaper-validation/prepare.py, tools/reaper-validation/check-renders.py, tools/reaper-validation/native-meters.lua.

Tests: tools/reaper-validation/test_checks.py, tools/reaper-validation/validate.lua, tools/reaper-validation/ui-check.lua.

Documentation: docs/host-validation.md, docs/WORK_STATUS.md.

Runtime contract workflow configuration¶

A three-platform GitHub workflow configures workspace formatting/tests/lints/Rustdoc and a separate macOS built-CLAP ABI smoke job with two Cargo workers.

Limits: Workflow parsed locally and constituent macOS commands exercised; remote matrix execution pending. No Linux/Windows runtime, DAW/device/GUI/deadline, licensed-SDK, production signing or publication claim.

Source: .github/workflows/runtime.yml.

Tests: .github/workflows/runtime.yml, tools/clap-smoke/src/lib.rs.

Documentation: docs/runtime-validation.md, docs/WORK_STATUS.md.

Explicit bounded local-video worker frames¶

A separate macOS reader opens selected local video, reports first-track oriented metadata and extracts independently timestamped complete owned RGBA frames through a private AVFoundation boundary.

Limits: Thread-confined UI/worker API, UTF8 paths <=4096 bytes, regular files <=2 GiB, duration (0,24h], oriented dimensions 1..4096 and returned pixels <=64 MiB. Native decode allocations/I/O/time are not globally bounded. Codec/container/color conversion follow OS; requested zero timestamp tolerance may reject between-frame positions. No whole-file integrity, automatic playback/audio/AV sync/network URL/DRM/GPU view/device/other-platform/deadline claim.

Source: crates/ravet-media/Cargo.toml, crates/ravet-media/build.rs, crates/ravet-media/src/lib.rs, crates/ravet-media/src/macos.rs, crates/ravet-media/native/Video.mm.

Tests: crates/ravet-media/tests/video.rs, crates/ravet-media/tests/fixtures/README.md.

Documentation: docs/local-video.md, docs/decisions/0178-bounded-local-video-worker.md.

Explicit bounded Metal offscreen rectangles¶

A separate macOS renderer prepares a native Metal pipeline and draws ordered portable filled rectangles with source-over blending into independent owned RGBA readback images.

Limits: Thread-confined UI/worker API, dimensions 1..4096, at most4096 raw rectangles, returned pixels <=64 MiB and conservative clear/covered-pixel work <=67,108,864. Coordinates clip then quantize to f32; no antialiasing or gamma/color-space transform. Native transient resources/driver work and creation/submission/wait/readback/destruction are not globally memory/time bounded. System-selected Metal GPU required, no software fallback. No window/presentation/path/text/image/rounded corners/other-platform/deadline claim.

Source: crates/ravet-metal/Cargo.toml, crates/ravet-metal/build.rs, crates/ravet-metal/src/lib.rs, crates/ravet-metal/src/macos.rs, crates/ravet-metal/native/Metal.mm.

Tests: crates/ravet-metal/tests/metal.rs.

Documentation: docs/metal-drawing.md, docs/decisions/0179-metal-offscreen-rectangles.md.

Reusable AUv2 native schema, control, text and state preflight¶

Apple-SDK C++17 helpers own an immutable native schema cache and isolated complete-state validator, providing full UInt32 IDs/CF metadata, canonical normalized-f32 setter preflight, complete physical text conversion and exact native-stream/AU dictionary preflight before SDK mutation; the public performance component consumes both.

Limits: 1..1024 global descriptors, default32 or explicit32/64 matching native companion tables; audio precision never changes normalized0..1 AU f32 controls or complete physical f32 state/text. Offsets below65536, <=128 ASCII physical parse units and native state<=8208bytes. CF metadata/text and validator lifecycle require serialized control ownership and can allocate; scalar preflight owns no SDK scheduling/notifications, rendering or host-bypass policy. Exact originating tables/library must outlive helpers. No backend rollback, groups/choice labels, f64 control, DAW/auval/device/sandbox/deadline/other platform support claim; macOS arm64 actual module/component evidence only.

Source: crates/ravet-native/include/RavetAuParameters.hpp, crates/ravet-native/include/RavetAuState.hpp, examples/performance-au/PerformanceAU.mm, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/native-parameters.cpp, tools/au-validation/native-precision-schema.cpp, tools/au-validation/performance.mm, tools/au-validation/performance-precision.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/native-processing.md, docs/performance-au.md, docs/decisions/0182-auv2-native-schema-control-state.md, docs/decisions/0203-auv2-performance-audio-precision.md.

Explicit bounded Metal bitmap scenes¶

Immutable validated owned premultiplied RGBA8 assets and borrowed ordered rectangle/image commands provide clipped nearest-sampled source-over GPU composition, independent readback adoption and explicit local-video frame upload.

Limits: MacOS thread-confined UI/worker renderer; assets1..4096 dimensions/exact bytes/RGB<=alpha, raw commands<=prepared4096, distinct referenced objects<=16 and total distinct upload bytes<=64MiB, even clipped; clear/covered work<=67108864. Geometry/UV f32 quantization, nearest edge-clamped numeric components, no implicit gamma/color conversion. Fresh native textures per call; driver transient memory/time unbounded. No implicit reader/window/clock/tint/path/text/high-quality resampling/other-platform/deadline claim.

Source: crates/ravet-metal/src/bitmap.rs, crates/ravet-metal/src/scene.rs, crates/ravet-metal/src/macos.rs, crates/ravet-metal/native/Metal.mm, crates/ravet-metal/native/Scene.inc, crates/ravet-metal/build.rs.

Tests: crates/ravet-metal/tests/images.rs, crates/ravet-metal/tests/metal.rs.

Documentation: docs/metal-drawing.md, docs/decisions/0183-metal-bitmap-scenes.md.

Prepared AUv2 native planar audio bus mapping¶

An Apple-SDK C++17 mapper validates explicit native main/auxiliary layouts and complete compact AU planar f32 AudioBufferLists before publishing caller-owned fixed native pointer arrays; rejected configuration/mapping retains prior state, and the performance component consumes it for prepared/caller preflight.

Limits: 1..9 logical bus pairs,0..64 channels per direction with nonempty active pairs,1..65536 prepared frames. Exact compact direction counts/planar shapes, byte capacity, alignment/address and disjoint output prefixes required; input/output aliases allowed. Live foreign memory/disjoint metadata remain caller obligations. No DSP preparation/ownership, format negotiation, automatic silence/registration/routing, AU f64, DAW/auval/device/sandbox/deadline claim. Local macOS arm64 native/helper/component evidence; counted C++ heap alone does not prove all backend/SDK/Rust allocation.

Source: crates/ravet-native/include/RavetAuAudio.hpp, examples/performance-au/PerformanceAU.mm, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/audio.cpp, tools/au-validation/performance.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/performance-au.md, docs/decisions/0185-auv2-prepared-native-audio-buses.md.

Validated AUv2 block-start host transport¶

An external Apple-SDK C++17 collector validates independently available host callback tuples before publishing a canonical read-only native transport snapshot; the public performance AU adopts its explicit VST3 projection before parameter transfer and DSP.

Limits: Serialized AudioUnitRender only, live coherent host callbacks/user data required. Float64 sample precision inherited, exact integral range [-2^63,+2^63), u16 signatures, strict Booleans and ordered finite active beat loops. DETAILS unknown/default placeholders require callbacks sidecar; only State2 supplies recording, neither callback supplies pre-roll/sample loops/native bar pairs. Projection omits partial transport lacking playing/samples and native discontinuity/availability. AUBase timestamp cache includes failures; recovery uses new timestamp. Performance DSP ignores transport. Local macOS arm64 helper/native/component evidence only; no DAW/auval/device/sandbox/architecture/deadline or production claim.

Source: crates/ravet-native/include/RavetAuTransport.hpp, crates/ravet-native/include/RavetAuVst3Transport.hpp, examples/performance-au/PerformanceAU.mm, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/transport.cpp, tools/au-validation/performance.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/performance-au.md, docs/decisions/0188-auv2-block-start-transport.md.

Prepared LV2 block-start time:Position transport¶

An external-SDK C++17 collector validates bounded exact-encoding Position objects before publishing direct native transport; the opt-in reusable instrument profile forwards block-start context only after full MIDI/control/time preflight, and the public Performance bundle consumes it.

Limits: 14 distinct nonzero stopped-cached URIDs; live8-byte aligned Sequence body8..65536,1024 ordered raw events and128 unique keys per Position. Long frame,Double beat,Float BPM/speed/numerator,Int denominator exact profile; finite/integral u16 signatures, speed only0/1. At most1offset0Position, laterPositions validate then omit without extrapolation/carry. Missing fields unknown/null; signature DETAILS recording/loop/pre-roll false flags unknown/default, no per-flag availability. Unknown properties/bodies opaque bounded, no recursive validation. No effect Atom port/genericbus factory, timeline output/discontinuity/loops/bar inference. Local macOS arm64; no Linux runtime/DAW/device/deadline/metadata-validator/production claim.

Source: crates/ravet-native/include/RavetLv2Transport.hpp, crates/ravet-native/include/RavetLv2Processor.hpp, examples/performance-lv2/performance.cpp, examples/performance-lv2/performance.ttl, examples/gain-lv2/CMakeLists.txt, scripts/lv2_bundle.py.

Tests: tools/lv2-validation/transport.cpp, tools/lv2-validation/processor-transport.cpp, tools/lv2-validation/performance.cpp, tools/lv2-validation/contracts.cpp, tools/lv2-validation/state.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: docs/lv2.md, examples/performance-lv2/README.md, docs/decisions/0191-lv2-block-start-time-position.md.

Bounded AUv2 native MIDI output delivery¶

A reusable SDK-independent canonical short-MIDI converter and fixed CoreMIDI packet owner stage complete native output before one AU host callback, with exact refusal receipts, stable borrowed bytes and stale/reentrant delivery guards; an actual synthetic AudioComponent proves consumer adoption.

Limits: At most1024 ordered native records and65536frames; exact canonical MIDI1 short bytes and ordinary nonidentity NoteOn/Off only. Velocity nearest/ties-up MIDI7, positiveOn minimum1, zeroOn wire0 with receiver Off convention. Identity/scoped/completion/choke/expression/parameter/UMP/SysEx unsupported. Failed stage preserves diagnostic packet bytes/count but invalidates readiness; every delivery consumes readiness, host acceptance unknown on refusal and no retry/history rollback. Exclusive live ownership/foreign ranges/host nonthrowing callbacks required; no callback deadline/allocation guarantee. Local AudioToolbox setters normalize original facade size/elements and may bypass owned SDK lifecycle validation. Public Performance remains no-output; synthetic component is fixture-only. Local macOS arm64 offline; no DAW/device/routing/production factory/other architecture support.

Source: crates/ravet-native/include/RavetNativeMidiOutput.hpp, crates/ravet-native/include/RavetAuMidiOutput.hpp, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/midi-output.cpp, tools/au-validation/midi-output-component.mm, tools/au-validation/performance.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/decisions/0197-auv2-native-midi-output.md.

Prepared AUv2 native f64 mapping and complete formats¶

Explicit float/double prepared main/aux pointer mappings and complete stopped native/ASBD profiles validate exact sample precision, whole directional formats and output ranges before publication; an actual fixed-f64 synthetic AudioComponent proves native64 rendering and stopped complete Level recall.

Limits: f32 existing names preserved; explicit f64 aliases, no sample conversion/inference. Native1..9buses,1..64channels per nonempty direction,65536frames; compact independent directional AU indices,576output range scratch. Matching structural native table/header/function precision and exact finite equal-rate native packed float ASBD bits/bytes/channels/flags/reserved preflight; rejects retain prior helper config/formats/maps. Foreign origin/lifetime/range ownership remains caller duty. SDK registration/allocation/notification rollback not provided; stock SDK original ASBD size/reserved/padding normalization and unchanged active no-op remain explicit. Actual synthetic fixed64 mono/stereo no-input reference/complete f32 Level only; no AU parameter UI/cross-precision migration/aux host registration. The distributed Performance AU separately adopts explicit32/64 through its checked lifecycle; this helper alone provides no SDK registration. Local macOS arm64 offline, no DAW/device/production factory/other architecture/backend-allocation/deadline claim.

Source: crates/ravet-native/include/RavetAuAudio.hpp, crates/ravet-native/include/RavetAuAudioFormat.hpp, examples/performance-au/CMakeLists.txt, scripts/au_bundle.py.

Tests: tools/au-validation/audio.cpp, tools/au-validation/audio64.cpp, tools/au-validation/precision-component.mm, tools/au-validation/performance.mm, scripts/tests/test_au_bundle.py.

Documentation: docs/native-au.md, docs/decisions/0199-auv2-native-f64-formats.md.

Measured standalone content size and grid workspace consumption¶

The existing main-thread standalone owner exposes actual logical content extent and a complete resizable HTML workspace consumes Rust grid output while preserving default Audio/MIDI settings.

Limits: macOS12+ Cocoa/WebKit/Xcode only; content_size reads finite positive native bounds or None without resizing/callbacks. Native aspect fitting/rounding can differ from requests; user-resize minima do not guarantee programmatic clamping; sample after pump. Existing !Send/!Sync/parent editor borrow/drop unchanged. Fixed five-panel consumer selects explicit two/three-column grid; latest-only geometry waits for viewport within1point and resize retries without bridge redelivery; box presentation>=26points, invalid snapshots rejected, TooSmall retains previous presentation. Standard settings enabled by default; no devices opened and unavailable inventory explicit; hidden native fixture settings process-local. Two actual owned hidden windows/12measured viewport transitions plus default popup/invalid-request/teardown checks, four actual Chromium Rust-derived grid sizes/undersized retention, seven transport groups and trusted text/checkbox input/focus/selection retained across resize pass; no other platform,AX/screenreader,hardware,DAW or deadline certification.

Source: crates/ravet-webview/src/standalone.rs, crates/ravet-webview/native/StandaloneWindow.mm, examples/tutorials/src/bin/layout_workspace.rs, examples/tutorials/src/layout_workspace/geometry.rs, examples/tutorials/src/layout_workspace/index.html.

Tests: crates/ravet-surface/tests/grid.rs, examples/tutorials/src/bin/layout_workspace.rs.

Documentation: docs/grid-layout.md, docs/native-editor.md, examples/tutorials/README.md, docs/decisions/0220-explicit-grid-measured-window.md.

Explicit stopped native output processor recovery¶

Failure-owned preparation and an additive f32 CPAL output owner return the exclusive original processor after explicit asynchronous callback retirement, allowing matching buffered-file stopped seek and explicit reopening.

Limits: No new dependency; tool conversion forwarding default-disabled. Existing 1..64 output-channel and 1..65,536 scratch-frame f32 profile; scratch preflight/fallible allocation before foreign prepare, failed-prepare inactive contract. Legacy consuming APIs preserved. One dedicated control retirement worker per opened owner; callback captures unique guarded shared-cell owners plus primitives only. Narrow audited UnsafeCell/Sync boundary: unique FnMut data borrow, error callback separate atomics, worker never accesses renderer until BOTH Acquire retirement flags and stable sole strong ownership prove callback borrows and Arc fields gone; no Weak/public clones. Normal framework capture Drop performs no allocation/deallocation/lock/wait or processor deactivation, including receiver early drop and asynchronous backend disposal. CPAL/OS callback closure allocation/storage/locks/destruction and panic runtime remain distinct backend/exceptional limits. Pending control poll does not wait; explicit wait joins control without deadline/cancellation. Original preparation/spawn/backend errors retain Immediate/Pending ownership, no hidden retry. Caught worker poll panic returns WorkerFault with exclusive owner after retirement; foreign deactivation panic may lose recovery and cannot manufacture success. Processing panic disables DSP permanently; recovered owner does not guarantee valid history. Option-owned consuming extraction deactivates once, requires explicit reprepare/reopen and no live mutable renderer escape. Actual converted BufferedPlaybackOutput retains unique consumer for matching stopped seeks; local silent CoreAudio20ch/96000Hz recovery/reopen plus257-frame zeroWAV44100Hz/Sinc16 retained590 drain, failed/successful seek17 and exact573 remaining drain pass. Underflows3562/7145 observed separately; no live mailbox, clock/drift, arbitrary endpoint recovery, broad physical-device/platform support or callback/teardown deadline claim.

Source: crates/ravet-device/src/lib.rs, crates/ravet-device/src/reclaimable.rs, crates/ravet-device/Cargo.toml, tools/device-probe/src/bin/reclaimable-output.rs, tools/device-probe/Cargo.toml.

Tests: crates/ravet-device/src/reclaimable_tests.rs, crates/ravet-device/tests/buffered_file_output.rs, tools/device-probe/src/bin/reclaimable-output.rs.

Documentation: docs/audio-devices.md, docs/decisions/0216-reclaimable-native-output.md.

Output-clock buffered file and captured-input processing¶

An explicit f32 processor owner combines unique buffered file PCM with existing output-clock-converted capture, forwards file transport by bounded segments and preserves committed history and original downstream faults.

Limits: Existing optional resampled-playback; no new dependencies/defaults. Outer capture/output1..64, file+capture child inputs<=64, file-first/capture-second ordering, queue/child/output rate equal, zero events/output events/auxiliary buses and f32 only. Prepared arrays<=32MiB plus existing source/converter/FIFO/reader/ring/allocator storage, callback bound<=prepared file maximum. Actual PreparedClockedDuplex sinc/FIFO/priming/underflow/reset/recovery unchanged; no file queue drift estimator or inferred timestamp origin/start alignment. At most two child calls separate consumed file prefix from paused/underrun/EOF zeros; capture/DSP continue. Child transport carries queue output-frame positions, unavailable abovei64MAX, not decoder or device coordinates; fresh prepare/stopped jump discontinuity, zero blocks preserve state, no beat/tempo inference. Typed counters/relaxed monitor separate source consumption, file underrun/EOF/worker status, logical accepted device frames including poisoned silence and child calls/faults; not audible completion or coherent clock/latency. Original child ProcessError retained while outer post-consumption faults use BackendFailure, full block silenced and no further source/child work until reset/reprepare; prior source/child history cannot roll back. Reset pauses retaining cursor/queue; prepare does not consume/reset file. Source Failed drains prefix without EOF and original error remains on worker shutdown. Direct stopped Option-owner extraction deactivates once without read/seek/drain/join; caller-managed session hooks preserved, foreign lifecycle panics exceptional. Native clocked closure remains inaccessible, no live seek/ownership migration; recovery factory restores fresh source/DSP explicitly. Synthetic ±500ppm canonical consumer, stereo grouping, real PCM worker failure and heap receipts only. No new physical device/clock alignment/drift/recovery/long-session latency/deadline claim.

Source: crates/ravet-device/src/buffered_file_duplex.rs, crates/ravet-device/src/clocked.rs.

Tests: crates/ravet-device/tests/buffered_file_duplex.rs, crates/ravet-device/tests/clocked.rs, crates/ravet-device/tests/clocked_input.rs.

Documentation: docs/audio-devices.md, docs/audio-files.md, docs/decisions/0228-output-clock-file-capture-processing.md.

Explicit integer-rate sinc scheduling for bounded-memory long file streams¶

Caller-selected exact integer-rate input/output scheduling extends converted read-ahead beyond the floating profile's source ceiling, with checked finite output duration, original-error ownership and stopped same-version replay.

Limits: No new dependency. Signal constructor accepts positive u32 rates, ratio 1/16..16 and even 16..256 taps; bounded signed relative numerator independent of duration, f64 used only for coefficient/table interpolation. Existing fixed/variable floating arithmetic and APIs remain; integer mode allows zero ppm only and reset restores exact initial phase. Explicit PlaybackConversion::IntegerSinc is an added exhaustive enum variant; consumers must handle it. Equal rates still filter, fractional delay (taps-1)/2 and explicit finite padding/retained-tail policy remain, no hidden copy/trim. New mode can differ in PCM at phase boundaries; no spectral guarantee beyond scoped fixtures. Complete-file sample/clip memory limits remain. Integer read-ahead source bounds are caller usize with independent reader/container/sample caps; checked u128 retained count must fit configured u64 budget and be <=u64::MAX-65536 for largest automatic callback terminal render headroom. An oversized unused budget alone need not reject. Existing Copy/Sinc source ceiling remains 16,777,216 frames. Worker rate 1..768000/channels 1..64/batches 1..4096/arrays 32MiB and separately prepared ring limits remain. Determinable bounds reject before reader/factory I/O; committed cursor/prefix/error ownership preserved. Stopped fresh-reader replay remains O(target), bounded memory, same-version caller obligation and no cancellation/deadline; failed candidate preserves old generation/queue/phase/suffix/cursor, factory side effects not rolled back. Actual prepared output integration preserves unique consumer and explicit stopped reprepare/reopen semantics. No arbitrary-u64 terminal playback, indexed codec seek, RF64/long compressed-reader, live clock/drift, broad physical support or callback deadline claim.

Source: crates/ravet-signal/src/resampling.rs, crates/ravet-audio-file/src/file_playback.rs, crates/ravet-audio-file/src/converted.rs.

Tests: crates/ravet-signal/tests/integer_resampling.rs, crates/ravet-signal/tests/integer_quality.rs, crates/ravet-audio-file/tests/long_converted.rs, crates/ravet-audio-file/tests/long_wave.rs, crates/ravet-device/tests/file_output.rs, crates/ravet-device/tests/buffered_file_output.rs.

Documentation: docs/signal-processing.md, docs/audio-files.md, docs/decisions/0221-explicit-integer-rate-file-scheduling.md.

Indexed finite-history integer PCM playback¶

An explicit known-duration integer-sinc pump rebuilds stopped WAV/AIFF output seeks from a bounded original history window, preserving old playback on candidate failure and separating source work from skipped coordinates.

Limits: Optional resampled-playback; no new dependencies or defaults. IndexedPlaybackReader built-ins are WAV/AIFF Read+Seek only, known stable duration, exact original-frame positioning; no compressed implementation. IntegerSinc-only separate pump; legacy floating/live/replay/empty semantics and counters unchanged. Immutable u128 schedule coordinate and finite chronological history priming preserve coefficients/delay and invalid atomic state. Candidate validates <=taps original frames plus at most one bounded EOF probe; custom short readers use <=taps positive calls, primary full-read PCM uses ceil(window/batch). Metadata factory/backend work and latency separate. Direct failure returns original error and optional advanced candidate reader, old queue/phase/suffix/cursor/generation preserved; generic worker seek releases failed candidate on control. Rich counters separate window validation, actual cursor commits (including errors), source/padding submission after prime and absolute/per-generation output; skipped prefixes not decoded or submitted. Exact retained endpoint validates final window/EOF without priming nonexistent output; known empty supported only in new indexed pump. Temporary scratch <=66KiB plus each state's <=32MiB arrays; old/candidate coexist, reader/ring/allocator separate. Existing rate/channel/batch/container/usize and configured bounds remain, retained output <=u64::MAX-65536. Same-version content caller obligation; skipped regions not authenticated. Actual offline worker/PreparedOutput unique-consumer recovery/reprepare/pause/EOF and heap-free rendering evidence only. No compressed indexing, RF64, live callback seek/wait, clock/drift, filesystem deadline or broad physical support claim.

Source: crates/ravet-signal/src/resampling.rs, crates/ravet-audio-file/src/file_playback.rs, crates/ravet-audio-file/src/indexed.rs, crates/ravet-audio-file/src/converted.rs.

Tests: crates/ravet-signal/tests/integer_priming.rs, crates/ravet-audio-file/tests/indexed.rs, crates/ravet-audio-file/tests/indexed_failures.rs, crates/ravet-audio-file/tests/indexed_long_wave.rs, crates/ravet-device/tests/indexed_buffered_output.rs.

Documentation: docs/audio-files.md, docs/signal-processing.md, docs/decisions/0224-indexed-integer-pcm-seeking.md.

Bounded native LV2 short MIDI output¶

An external-SDK fixed-storage stager and opt-in native LV2 processor profile admit full configured Atom Chunk capacity before state/DSP, stage canonical short MIDI and publish one complete timed Sequence.

Limits: f32 main instrument-input profile; output capacity1..1024 with zero retaining default Gain/Performance ports/calls; explicit prepared maximum frames1..65536. CONTROL cached URIDs and heap-resident owner scratch, actual caller extent/alignment/lifetime and stopped/joined lifecycle/restore/diagnostic exclusion. Full known Atom/control/table/owner/audio alias admission and safe16-byte empty only when independently admitted; no stale replay. Atomic AUDIO reentry refusal before active mutation; no general lifecycle scheduler/threadSafeRestore. Original returned state/native codes and latest actually returned process status separate from nonreturned exception/local errors. Whole input/control/time preflight before dequeue/history; post-DSP malformed output/reflect refusal has no history rollback. Canonical exact native origins depend on separately reviewed LV2 origin correction. Target-only normal/fast stager/authoritative history/refusal/throw/reentry fixtures, max1024 and10000 ordinary-C++heap-free cycles; Root source/dependency review and fresh actual Rust/C++ native/module/package replay accepted; public workspace and actual-host qualification remain separate. No generic raw input/SysEx/UMP/MIDI2/generated expression/identity, extra output ports/nativef64/aux host routing/editor/DAW/deadline or all-allocator/stack-peak proof.

Source: crates/ravet-native/include/RavetLv2MidiOutput.hpp, crates/ravet-native/include/RavetLv2Processor.hpp.

Tests: tools/lv2-validation/output.cpp, tools/lv2-validation/processor-output.cpp, tools/lv2-validation/routing.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: docs/lv2-output.md, docs/lv2.md, docs/decisions/0265-lv2-native-generated-output.md.

Packaged LV2 NoteRouting native reference¶

The explicit local note-routing LV2 profile consumes canonical Rust NoteRouting native tables, with mono/stereo silent audio, complete Level recall, timed note output and block-start transport.

Limits: macOS arm64 local qualification; external LV2 headers, hostf32 audio, Level ID1/default1,24-byte state; channel/key-only scoped release is explicit reference policy. Maximum1024 frames/combined changed-controls+notes/generated events; host Chunk total24592/body24584 required even empty runs and reset every call. Actual independent module MIDI/timing/order/padding/max/capacity/alias/backing-tail/zero-frame/recall and2000 ordinary-C++heap-free/map-free calls; maintained CMake12 incl default Gain/Performance and all6 packaged mandatory validators/signature, Python6 refusal propagation. Pipeline explicitly substitutes recorded canonical Rust archives rather than claiming a fresh Cargo build. Separate root current-source Cargo builds all three native references, twelve native profiles and maintained NoteRouting packaging with actual Cargo, six mandatory validators and strict ad-hoc verification pass; public workspace and real LV2 host/otherplatform acceptance remain separate; no installation or production distribution claim.

Source: examples/note-routing-lv2/routing.cpp, examples/note-routing-lv2/manifest.ttl, examples/note-routing-lv2/routing.ttl, examples/gain-lv2/CMakeLists.txt, scripts/lv2_bundle.py, scripts/bundle-lv2.py.

Tests: tools/lv2-validation/routing.cpp, tools/lv2-validation/processor-output.cpp, tools/lv2-validation/output.cpp, tools/lv2-validation/origin.cpp, scripts/tests/test_lv2_bundle.py.

Documentation: examples/note-routing-lv2/README.md, docs/lv2-output.md, docs/decisions/0265-lv2-native-generated-output.md.