0.10.1 unpublished draft — 2026-11-07 UTC: annotated tag 0.10.1 points to
8a0bdbc0e1beb48988fe73e0aca193c2d8d1d18c; Release 437502618
is a draft with eleven independently verified assets. Release workflow 42361592620
passed. The roadmap records tag,
source, asset hashes, validation scope and remaining publication/commercial gates.
Level-5, other applicable manual work and completed-roadmap acceptance are owner-attested;
ADR-0070 item 5 is owner-approved within its measured scope. This post-tag record is not
included in the tagged source. No public release is authorized.
Historical 0.10.1 release preparation — 2026-11-07 UTC: PR #228 is merged at 82a0a548,
with its final-main Build, CodeQL and PREfast passing. A subsequent reader-consumption
control gap in the native evidence verifier was reproduced and corrected on a separate
review branch; see the roadmap and
native record. PR #229
requires owner review and merge, then CI on the resulting main and an actual UTC tag-date check. Level-5,
other applicable manual acceptance and ADR-0070 item 5 remain owner-approved in their
recorded scopes. No 0.10.1 tag or draft exists; 0.10.0 is unchanged.
Historical 0.10.1 release preparation — 2026-11-07 UTC: owner-reviewed #227 merged as
31cec040a7daf2d637e3e2f9e1ba33ca29de6102, integrating the ADR-0070 item-5 owner
approval and corrected evidence verifier. Its reviewed-head CI passed; the merged-main
CI is tracked in the roadmap.
The planned Changelog date is updated to 2026-11-07 UTC on a separate branch and must
match the actual tag date. That change requires independent review/merge; no tag or
0.10.1 draft exists. The owner-attested Level-5 and other applicable manual acceptance
remain complete, within their recorded scope.
Historical 0.10.1 owner continuation (2026-11-07 Asia/Shanghai): #225 merged as 1a492763,
following #226 at 13a0df99. The owner attests Level-5 and all other applicable manual
validations complete, completed-roadmap human acceptance, and approves ADR-0070 item 5
for the measured Intel Mac/workload scope. Native evidence
records the data and limits. The evidence-update branch still requires independent
review/merge; final-main CI and the actual tag date must be checked before release.
No 0.10.1 tag or draft exists; the 0.10.0 draft remains untouched.
Historical 0.10.1 preparation (2026-11-06 UTC): selected integrated baseline is
55bdbdea090152f635d442916f4f0547e4626600; JUCE remains 9.0.5. The owner attests
Level-5 PASS and completed-roadmap human acceptance. Exact human test metadata is NOT
RECORDED. The release-preparation branch requires CI and owner review/merge; it is not yet
a tagged source. ADR-0070's representative native performance measurements and owner
cost acceptance remain outstanding. No repeat Level-5 is requested. See the
current execution register.
The existing 0.10.0 tag and draft remain unchanged; publication is not authorized.
Historical handover — 2026-11-07 (Asia/Shanghai): owner-reviewed #223 merged at
a0b9d4bb9b1b1615ec8aec9cdbcf41318a596b24, then #219 at
395e06d3cf9c19b3f59b64c026c83f2baf55a0d0. The latter includes #220's
de66265e31fdfcb10b77cc6fc1aada9033849d5f parent merge and has the identical
tree to reviewed #219 7490b296 and synchronized head dabe1c32. State and
fuzz filesystem isolation and the #222 B2 correction are integrated. ADR-0072
remains Accepted; KI-035 / NR-026 is resolved within the verified surviving-processor
component contract. Native DAW behavior and simultaneous processor destruction
remain unmeasured. Exact source and CI identities are in the current register.
The existing 0.10.0 tag, unpublished draft and eleven assets remain unchanged. Deferred native/manual acceptance and commercial/signing decisions remain separate; the candidate decision package requests no release operation. A new follow-up PR requires its own review and merge authority.
Historical post-#222 handover, before #223/#219 integration — 2026-11-06 (Asia/Shanghai): #222 is merged on main at 2b256e90, with Accepted ADR-0072 and official JUCE 9.0.5 unchanged. Actual-main component verification reproduces 945 DSP / 2,443 focused checks and all 166 lifecycle observations. KI-035 / NR-026 is resolved within that surviving-processor component scope; native DAW behavior and simultaneous processor teardown remain unmeasured.
At that checkpoint #220 had merged at de66265e only into codex/state-suite-isolation; #219 remained open/unmerged and contained State plus fuzz isolation. Its combination with B2 still needed final-head validation and human review. Post-integration status/evidence changes were proposed separately in PR #223, then unmerged. See the current register and source-bound post-merge evidence. Deferred native acceptance and protected version/tag/draft/eleven assets remained unchanged. Earlier handovers below are historical checkpoints.
Historical B2 implementation checkpoint — 2026-11-06 (Asia/Shanghai): #221 is merged at
b9f94d83, with successful reviewed-head and post-merge CI. Owner-approved ADR-0072
B2 is implemented in PR #222 at code checkpoint f9d8cbd3: stable binding/event
record, exact-once gestures, processor Undo and guarded post-write banking. Local
945 DSP / 16,074 State / 2,443 focused and partial-ASan 2,115 pass; seven incorrect
source controls are detected. CI checkpoint c0a2796c passes full platform,
ASan/UBSan, Valgrind, configured TSan/realtime/fuzz/pluginval and static gates;
consult #222's final-head rollup after documentation updates. Independent human
implementation review and merge authorization remain separate. KI-035 is unresolved on main. #219/#220 remain
unmerged; their review corrections and current heads are in the roadmap. No release
or deferred native acceptance follows from these automated results.
Historical owner continuation — 2026-11-06 (Asia/Shanghai): #221 is merged at b9f94d83 and
ADR-0072 B2 architecture is owner-approved. A separate B2 implementation is authorized
but not yet accepted/integrated. #219/#220 remain unmerged with new review corrections
in progress. See the roadmap for current execution; earlier handovers retain history.
Historical continuation before the current owner approval: #218 is merged at c2f8f19b; #219 corrections at b2e36abf remain open/unmerged with exact-head cross-platform CI recorded in the roadmap. Separate fuzz PR #220 at 04656924 and NR-026 design review #221 remain open. At that checkpoint the owner preferred Option B for NR-026; B1 was rejected and B2 proposed. ADR-0072 remained Proposed, production KI-035 unresolved and concrete architecture review required. No version/dependency/release changes or deferred native acceptance. Dated handovers below remain history.
JUCE 9.0.5 is integrated on main by PR #213 (18a51df773d8701004fe86e85df820fdf6949f2d) under owner-Accepted ADR-0071.
Product version and existing release assets are unchanged. The upgrade worklog
records source-bound automated evidence and the new PASS — owner-attested Level-5/native/manual
acceptance for 9.0.5 (recorded 2026-11-04 Asia/Shanghai). Exact tested payload/environment fields
were not supplied. No release is authorized. Older attestations remain dated history.
Owner-authorized #216 merged at f15236d5598efb5346a962643fecd1aca778a38a
and #217 at 09cf18876d6ad09dabf9878fc0c719d0c49f10c7, the current combined
main at this checkpoint. ADR-0072 remains Proposed and NR-026/KI-035 remains
unfixed; merging the review packet did not approve its production alternatives
or accept release risk. The #217 comment makes the original NR-026 byte guard
reject combined main; the procedure
documents the source-matching worktree. Ordinary State-suite preset and shared
temporary-file isolation remains a separate cross-platform follow-up. See the
execution register for current
CI, deferred native work and release boundaries.
Remote main b0a063d2db982e3b6cdd1c403abce08098d1cfa1 includes #207–#215.
Owner-approved #215 merged with a tree identical to reviewed head a43c9964;
its post-merge Build
passed 16 selected jobs with three conditional skips. PR #216 is based on main
and remains open for separate review of isolated NR-026 evidence and Proposed ADR-0072.
NR-029/KI-037 was integrated through #212 (82c98e45), with source and
regression provenance in INC-025.
NR-026 remains confirmed on JUCE 9.0.5: standalone wheel teardown UAF plus a held-wheel component-lifetime witness. Architecture review and a release risk disposition remain open.
The #214 main Build attempt 6
completed successfully with 16 selected jobs passed and three optional/routing
jobs skipped; attempts 1–5 had cancelled macOS jobs. JUCE #213's separate
post-merge Build, CodeQL and MSVC runs also succeeded. Owner-deferred native acceptance,
commercial and signing/provisioning decisions, and the unchanged draft remain
separate; see the release assessment.
Owner-authorized PR #211 merged as
c35a9d6b68c53142d42c957d9ef6e5ab1b7caac9; its tree equals reviewed head
58a0dc4f264f3350fd36555a64b0f8c04efe1caa. Production sources remain exactly
those integrated by #209/#210. State157's same-processor A→B→C→B coverage is
integrated once beside State155/156. Actual main local preflight ran 945 DSP /
13,454 state checks; full strict ASan/UBSan/vptr ran 941 DSP / 13,454 state.
Both completed with zero failures; displayed popup32, focused timer/preset201
each and six strictness10 VST3 pluginval passes also completed. Actual main Build41660239454 attempt2 completed16 selected jobs with3 intentional
optional/routing skips; CodeQL41660239752 and MSVC/PREfast41660239461 also pass.
Independently digest-verified memcheck artifact13247606458 records DSP934 / state13,454,
both completed/exit0/zero errors, with existing leak checking disabled. Retained
dependency/capacity failures and complete provenance are in the
post-merge record.
PR #212 remains open and unmerged for separate owner review, with auto-merge
disabled. The missing changelog Evidence Source is corrected using implementation
commits af8edfdd and 05b207e3, explicitly on an unmerged review branch.
The additive synchronization retains State157 and both SpectrumImager fixtures;
production and Spectrum regression bytes equal reviewed 9a00894b. KI-037/NR-029
remains distinct from the unfixed, architecture-gated KI-035/NR-026 Slider issue.
The current review evidence
records the final pushed SHA, validation and CI; pending or failed jobs are not passes.
Native NR-006/010/014 acceptance remains owner-deferred; NR-003 remains Deferred. The annotated 0.10.0 tag, unpublished draft429760301, eleven assets and version metadata are unchanged. These post-tag source fixes are absent from that draft; no rebuild, publication, distribution or release authorization follows.
#209 merged at 0d395366; #210 merged at 0cd95120162b7913a5656f828f27eb96034c1b34.
The latter tree equals validated head 7208bdc2; all selected current-head
workflows completed. Both source corrections and State155/156 are retained once.
#211 remains review-only for its repeated restore-cycle correction. #212 remains
review-only for the SpectrumImager lifetime candidate and corrected coverage
inventory. Its provisional issue ID is reconciled to KI-037; KI-035 remains the
unfixed, architecture-gated JUCE Slider wheel defect. Both PRs remain unmerged.
The execution register and ledgers track post-merge and final-review-head CI.
Native acceptance remains owner-deferred. The 0.10.0 tag, unpublished draft,
11 assets and version are unchanged; post-tag source fixes are absent from it.
#208 is merged at a78b73334dbbbd70dc6ab6de9fd155643983d1f6; #207 at
29150f312ec4a43ec85f35e61028d8338057d927, actual combined main. Reviewed source
and original/fixed/mutant controls survive the additive documentation/test-driver
reconciliation. Combined-main local preflight executes945 DSP/12,234 state/18
Python; actual post-merge CI is tracked in the execution register, separately from
successful synchronized-head CI. NR-023/024 source corrections are integrated.
The callback review confirms two new restore callout failures (NR-025, guarded in a new unmerged branch) and a distinct pinned-JUCE wheel-scope failure (NR-026, human review before any dependency change). New PR merges remain unauthorized. Native/manual acceptance is still owner-deferred, not waived. The 0.10.0 tag, unpublished draft and assets stay intact.
Owner-authorized #208 (e12e1a5) is integrated at a78b733; owner-authorized #207
(5e10d26) is integrated at current main 29150f312ec4a43ec85f35e61028d8338057d927.
Combined post-merge Build41480257211, CodeQL41480257255 and MSVC41480257258 passed;
digest-verified memcheck artifact13161163476 records both suites completed with exit0
and zero errors. The combined local suite now passes 945 DSP / 12,975 state checks,
including the new State156 scale lifetime regression.
PR #209 / NR-025 remains open and unmerged at 2ac19a67e7c7a673c5aab9cf84c0ba78f684be86.
Its refreshed Build run41488872878, PR merge-check41488879744, CodeQL, MSVC/PREfast and
dependency review pass; three optional review jobs were skipped. No merge authorization
is recorded for #209.
NR-027/KI-036 is a confirmed scale/resize callback use-after-free at main 29150f3.
Implementation commit 15a8995a89bd4718bc650b276ad418aa8e2eeca7 adds guards after
synchronous setSize/setTransform parent notifications and after timer scale calls.
State156 passes741/741; original actual-editor ASan reproduces all four close paths,
corrected ASan passes four close/four live paths, and guard-removal controls restore
sanitizer failures. Raw identities are in
gui-scale-callback-lifetime.json.
The correction is not integrated; new PR merges require separate owner authorization.
Native/manual/hardware acceptance for NR-006/010/014 and NR-003 remains owner-deferred, not passed or waived. The 0.10.0 tag/draft/assets remain unchanged and predate the NR-023/024/027 fixes. Continue the source-backed callback lifetime inventory and independent engineering review; do not request native inputs.
Owner-approved #203→#201, then #199→#200→#202 and #204–#206 are merged on actual main
06527b1f5f56e60068818c65d1af0b6d29f9e468. Accepted ADR-0070's atomic stereo/tag
implementation, serialized GUI affinity and rejected-paint retry are effective on
main; NR-011's57 isolated controls/five mutants and NR-012's36 retained observations
are integrated. Post-#204 Build41339340041, CodeQL41339340007 and MSVC41339340000
completed; integrated local suites are945 DSP/11911 state.
Representative native scope/full-engine/GUI costs, owner cost acceptance and targeted
native scope/FFT/editor-lifecycle acceptance remain pending, not waived by merge.
PR #204 corrects rotary
accessibility titles using unchanged captions and adds State152's attachment/key/
lifetime regression. Its merge tree equals reviewed head5b4b506; native
UX/assistive-device acceptance remains outstanding.
The native validation package reuses
the opt-in Bench for paired raw timings/provenance, memory, reader-load models
and host/AX worksheets. #205's merge retains approved head014a24a exactly,
including overlay pruning and collection/analysis consistency controls. Its
exact-head and post-merge Build41402900891/CodeQL41402900875/MSVC41402900872 gates
completed. #206's reviewed3670e7d tree equals main; exact-head gates and post-merge
Build41422157397 (16 selected jobs/3 skips) passed, with verified zero-error
completed memcheck artifact13131618856. Integrated local preflight
passes 945/11911 and 18 Python controls. Shared-container smoke is diagnostic only; no native
machine is configured. The owner defers native/hardware/manual execution for this
engineering round; acceptance remains outstanding. Do not request native inputs.
Independent engineering review reproduces NR-023 transport UB (#207,
unmerged5e10d26, exact-head gates passed) and NR-024/KI-033 editor command UAF (#208, unmerged).
The latter is corrected independently atbdeeadb with State154's115 component checks,
original/fixed/reference-mutant ASan controls. Its local preflight completes
945 DSP / 12,026 state / 18 Python checks and the shipping-Clang ABI gate;
configured pluginval strictness 10 completes both modes, three passes each.
Exact-head remote CI is tracked in #208's discussion. No Accepted architecture change is
selected; new PR merges require separate authorization.
The0.10.0 tag/draft/11 assets remain unchanged at4c13688, lacking NR-022/NR-006.
Ordinary CI/local validation builds are not release replacement or publication.
See the live execution register
and candidate disposition.
All implementation-pending, old-main and merge-authorization statements below are historical checkpoints at their recorded dates/sources, not live instructions.
ADR-0070 has explicit owner implementation approval. This branch implements atomic
stereo/tag validation and separate accepted GUI windows; main 00de8c7 and the
0.10.0 draft retain the original storage. PR #199 records the Accepted decision;
new implementation/NR-011 #200/NR-012 #201 merges are unauthorized. Native
code-generation/performance/manual gates are separate from source/test completion.
The current evidence and limitations are in worklogs/NR006_SCOPE_PUBLICATION_REVIEW.md
§11 and worklogs/NEXT_RELEASE_DEVELOPMENT_ROADMAP.md. Earlier snapshots below
retain their dates and candidate scope.
Historical pre-integration NR-022 development: commit 0e5e644 commits an outgoing slot's
completed edit before an A/B switch clears pending coalescer state. State test 149
fails 10/126 on the prior processor and passes 126/126 with the correction; local
Release DSP/state counts are 945/10,953, with locked Linux VST3 strictness-10 modes
×3. Native CI/review remain required. This is subsequent development, absent from
the unchanged 0.10.0 tag/draft; no version or release operation is performed.
Owner-decision reconciliation — 2026-10-31 (Asia/Shanghai): ADR-0069 is Accepted; ADR-0065 remains Superseded. The owner explicitly confirms all relevant ADRs manually approved and real-machine testing completed and approved. NR-001/002 are Completed on that authority. Actual test dates, hosts/versions, OS/CPU, devices, scenario results and selected artifact hashes were not supplied and are NOT RECORDED. Detailed host matrix NR-003 is Deferred; its unexecuted cases are not passed.
PR #193 is merged at 4c13688; the unchanged 0.10.0 draft 429760301 contains that
source from Release 7 / run 41173229942. No merge or release operation is authorized
here. The current execution register is worklogs/NEXT_RELEASE_DEVELOPMENT_ROADMAP.md;
the release-readiness worklog preserves earlier original/P1 attestations separately.
Historical governance reconciliation (record updated 2026-10-24, Asia/Shanghai): native JUCE
ADR-0062 remains Accepted; namespace ADR-0063 and Windows installer ADR-0064 are Accepted
under explicit final owner approval. PR #170 → #171 → #172 are merged into inspected main
1e17f5845a90919949435c60d6ddf2bf2bd3fde1. architecture/design-decisions/ADR_INDEX.md
records provenance, exact merge ancestry and native CI evidence. The corresponding owner/
architecture blockers are closed; DAW, receipt-installation, shell/Composer and other unperformed
manual validation remain unverified. Unrelated owner decisions below retain their status.
Operational status snapshot for technical handover. Update on every release
(docs/policies/DOCUMENTATION_LIFECYCLE_POLICY.md). Facts are Verified from the repository;
fields with no repository evidence are marked TODO rather than invented (constraint C7).
Intermittent CI failure (disposition 2026-10-31, Asia/Shanghai): Build 1957's native Intel AU randomise
pass 2/3 aborts after SUCCESS with bad_function_call. First-throw captures locate
the throw in AudioToolboxCore's CAEventReceiver timer block on macOS 15 and 26.
The drained, timer and entry controls do not reproduce the real AU's throw.
Separate enqueue-boundary controls verify listener and component disposal before
queued delivery, also without reproducing it. The cause remains unproven. After
this investigation the owner permits treating it as an occasional failure;
RISK-017 retains the uncertainty and concrete reopen conditions.
See worklogs/CI_1957_NATIVE_INTEL_AU_TEARDOWN.md. The validated 0.10.0 tag/draft
are unchanged and unpublished; no crash retry or conformance gate is relaxed.
Current snapshot: 2026-10-30, 0.10.0 P1 draft replacement complete; unpublished.
PR #187 merged at b085c87d139f124e33a525e75ec13b8218c96f06 with Accepted ADR-0067/0068 and the owner's
targeted human-completion attestation of 2026-10-30. Runtime source is unchanged from the
validated 9f9a76e candidate. Final-main Build 1956 and normal
Release 5 passed every mandatory gate. The recreated annotated tag
0.10.0 has object 7229ec12472649a0d9be0cd563a94e713bc206be and peels to b085c87d139f124e33a525e75ec13b8218c96f06.
The new Draft Release (ID 428664381) targets that exact commit;
all 11 assets were downloaded and verified, including exact payload-file agreement with
the five fresh same-run build artifacts. The old draft 428196589 and old tag object
769d52fb09116b787184d119ff1db6075187e36d were deleted under the one-time authorization.
They remain archived as historical evidence. No publication occurred or is authorized.
Exact manual environments and individual observations were not supplied. Original unrelated
manual approval and the distinct lock-order/public-distribution residuals remain preserved.
Evidence, checksums and both provenance chains: worklogs/RELEASE_READINESS_0.10.0.md
and worklogs/release-0.10.0-p1/draft-replacement.json.
The original 0.9.10 development evidence retains its historical filename.
Historical preparation context (last refreshed 2026-09-28 at b755cfb): the following chronology
records the successive untagged preparations; its version-relative wording is historical. The snapshot
was first taken on main @ 2d0a906 (2026-07-27), i.e. with the 0.9.0 release-prep change set (PR #87:
version bump → 0.9.0, CHANGELOG [0.9.0], installers for all three OSes, user manual +
installation guide under docs/user/), the 0.9.0 installer/packaging rework (PR #89:
Windows component page + dual-path destination page, macOS .pkg component selection,
system-wide installs everywhere, flat ZIP-only release archives), the release-hardening &
commercial-readiness audit (PR #91: NOTICE + THIRD_PARTY_LICENSES.md, SUPPORT.md, issue
templates), and the lean-package / flat-artifact / closed-source / internal-testing
documentation passes (PR #92, PR #93, PR #94) merged — on top of the
0.8.12 line plus all six post-0.8.12 PRs (audit #81, state harness #82, JUCE 9 migration #83
(SHA-pinned, ADR-0022 — Accepted 2026-08-15), RH-PR-8 pipeline + artifact-integrity #84,
release rehearsal #85, product-readiness roadmap #86). The cycle formerly planned as "0.8.13"
was written up as 0.9.0, in preparation for the internal-testing phase — see
docs/COMMERCIAL_STATUS.md.
Superseded before tagging, four times: 0.9.0 was never tagged. The vendor manufacturer-code
change (Anmf → RTec, ADR-0023, Accepted 2026-07-30) landed on top of it as 0.9.1;
0.9.2 (2026-08-07) landed on top of that; and 0.9.3 (2026-08-11) now lands on top of
0.9.2 with six GUI interaction fixes — the Multiband add-split preview line no longer
stalls while the pointer moves (the display's skip-identical-frame gate did not watch the preview
line's position); the click that dismisses a pop-up now does nothing else (JUCE re-delivers it,
so it could also close Settings, discard a half-typed preset name, toggle A/B or add a Multiband
split — one editor-level shield now takes that click for every pop-up type, with KI-018 and
KI-020 the recorded residuals); an open menu no longer outlives the plug-in window being hidden, closed or
sent to the background, where it used to be left floating always-on-top and could even pull a
background plug-in window back in front; two menu-rendering fixes (width measured from the item text,
which had clipped Select All; disabled items dimmed); and Tooltips off now means off (it
previously only lengthened the delay, which a visible tooltip bypassed). One Changed item is
user-visible layout: the Widen row's two drop-downs are now equal width with their join on the
column's centre line, and the Style/Focus caption follows its box. Two installer changes ride
along, both outside src/: the Linux installer now asks where to install and defaults to
the user's own account (~/.vst3 + ~/.local/bin, no root, no password; system-wide stays
available as choice 2 and sudo ./install.sh behaves as before), and the macOS .pkg is now
built with every component non-relocatable and non-version-checked, which is INC-012 — a
re-install used to write over a copy the user had moved out of /Applications (or to the Trash)
and report success while the standard location stayed empty.
No src/ change from either: no serialized state, parameter or DSP change, so 0.9.3 is state- and
sound-identical to 0.9.2. What 0.9.2 brought: the first src/ change since 0.9.0 — the preset
drop-down no longer outlives the plug-in window (it was a free-standing menu holding a raw
LookAndFeel pointer and a raw this, which crashed on click after the editor was gone), factory
presets are identified by an immutable internal id instead of by name so a same-named user preset
is selectable in its own right, the Settings control Window Size is relabelled UI Scale, and
the installer component titles are title-cased. Saved-state schema, parameter surface and DSP are
untouched. 0.9.4 (2026-08-21) now lands on top of 0.9.3 in
turn: two Changed entries — the JUCE 9.0.0 → 9.0.1 dependency upgrade (ADR-0026), with no
src/ change and no build-dependency change, and the C++ standard 17 → 23 migration
(ADR-0027), whose only src/ change is one added #include. No build dependency moved for either
and engine output is proven bit-identical across both axes — the two JUCE versions and C++17 vs
C++23 — so 0.9.4 is state- and sound-identical to 0.9.3 as well. One editor-only fix was added
to 0.9.4 on 2026-08-19: a control covered by an open drop-down no longer reports itself hovered
(src/PluginEditor.cpp cursorIsOverOpenPopup()), which touches no parameter, no serialized field
and no DSP, so that identity is unaffected. It ships under the ADR-0025 rule-1 exception —
docs/procedures/TESTING.md §"Gaps in the automated coverage" carries the four disclosures, and
that entry now records a measured correction to the standing claim that the behavioural half of
editor interaction is out of reach: it was driven headlessly on Linux under xvfb for this fix.
Two adjacent defects were measured and filed rather than folded into that change — KI-024 (the
Settings / About / Save-Preset overlays occlude the same way) and KI-025 (the micro-animation
idle gate could seal on a still-lit control when the pointer left the editor inside one frame).
Both were fixed on 2026-08-19 and removed from KNOWN_ISSUES.md: the overlay case by a general
per-widget occlusion test that derives what counts as an overlay rather than listing the three, and
the idle gate by giving its "nothing can move" condition the second half it lacked, with the ease
made to land on zero so the added condition cannot cost anything. Idle cost measured unchanged at
0 passes/s with the pointer outside, before and after. A third editor-only fix followed on
2026-08-20, and it is not another occlusion case: JUCE's tooltip tick mixes a CACHED answer to
"what is the pointer on?" with a LIVE reading of where the pointer is, and the tooltip's own
reposition rewrites that cache from the last event's position rather than the live one — so the box
lands where the pointer is and is labelled with where it was, until the next event. The cached
component is now checked against the live pointer before it is trusted. Two earlier attempts at this
defect were reverted first; both misdiagnoses are recorded in DOCUMENTATION_COVERAGE.md rather
than deleted.
The release in preparation was then 0.9.7, planned as the first annotated tag
this project would cut (0.9.4 through 0.9.6 were, like their predecessors, written up and superseded
before a tag was cut — 0.9.5 by the A7 performance programme, 0.9.6 by the round-1
engineering-review fixes, 0.9.6 in turn by ADR-0034, the maintainer-instructed latency change of
2026-09-03). 0.9.7 and 0.9.8 were in turn closed without a tag, so the release in preparation is now
0.9.9 (CMakeLists.txt:14; CHANGELOG [0.9.9], dated 2026-10-22) and the owner has authorized its first annotated tag and draft release (2026-10-21). The table below distinguishes current replacement results from original-candidate evidence.
The replacement is complete; earlier 0.9.9 detail remains historical. docs/COMMERCIAL_STATUS.md still
carries its 2026-07-26 review date — its content (product model, distribution model, open
owner/legal decisions) is unaffected by the version renumbering, and it is re-dated when its
substance next changes rather than on every version bump.
Product version is 0.10.0; remote main is b0a063d2 and uses JUCE 9.0.5.
The current unpublished draft is ID 429760301, with 11 assets and annotated
tag object 1190e455 peeling to 4c136881. It predates the integrated fixes
and JUCE upgrade. The roadmap
is the execution register; the release assessment
records remaining risks, human acceptance, commercial and provisioning gates.
The following table is a dated historical snapshot. Its former draft ID, tag, current-version, blocker and roadmap claims are superseded by the current records above.
| Field | Value |
|---|---|
| Current Version | 0.10.0 (DRAFT), annotated tag at b085c87. The release artifact remains JUCE 9.0.4; main under ADR-0071 pins 9.0.5 / d60b7a7; parameter IDs, ranges, automation flags and valid state/preset formats are unchanged. |
| Branch Strategy | Feature branch → PR into main. Bare-version annotated tags follow ADR-0059; the first, 0.9.9, now exists and closes RISK-003. The authorized one-time 0.10.0 draft/tag supersession is complete; the replacement tag is immutable and public publication remains unauthorized. |
| Build Status | Replacement 0.10.0: final-main Build 1956 and normal Release 5 passed all mandatory gates; all 11 downloaded assets verified against fresh same-run payloads and checksums. Historical original 0.10.0 candidate only: exact tagged source passed all 13 Build jobs; fixed Release rehearsal also passes. Asset inventory, hashes, modes and versions verified. Evidence tracked in worklogs/RELEASE_READINESS_0.10.0.md. Historical 0.9.10 local validation: see worklogs/STATE_HOST_HARDENING_0.9.10.md; CI is reported separately. Historical 0.9.9 / 9.0.4 validation: Release VST3/Standalone build; DSP 944 / 0, state 5600 / 0; 32-scenario twin dump identical; byte-exact 9.0.3 session restore; pluginval strictness 10, both modes ×3, all first attempts. GCC 14 ABI limitation and full evidence: worklogs/JUCE904_UPGRADE_0.9.9.md. Historical build evidence: Green at the 0.9.4 C++23 build contract (ADR-0027): the shipped configuration was reconfigured and rebuilt at CMAKE_CXX_STANDARD 23 and re-run through the full gate — 140-check DSP + 894-check state suites green, pluginval strictness 10 green in both modes ×3 (no retry needed this time), 29-instance compiler-warning set identical to C++17, and all three CI platforms green including the AppleClang and MSVC jobs. A local Clang 18 + libc++ build covers the macOS standard library. Immediately prior, green at the 0.9.4 JUCE 9.0.1 upgrade: full fresh Linux Release build from a deleted build/ (VST3 + Standalone + both test executables) against the new pin, with FetchContent-by-SHA proven end-to-end (build/_deps/juce-src resolves to e18f7f5… / "JUCE version 9.0.1", GIT_SHALLOW retained); 140-check DSP suite and 894-check state suite green; pluginval strictness 10 green locally in both modes ×3 (one randomise pass took run-pluginval.sh's signal-only retry — the documented host-side JUCE/X11 XEmbed flake, KI-003/KI-007, which the script retries only on a signal exit and never on a validation failure); no new compiler warnings. Windows/macOS remain CI-verified. Earlier: Green at the 0.9.0 release-prep (version bump 0.9.0; local Release build + the 140-check DSP suite + the 774-check state suite re-verified green; CI additionally builds the two installers — the Windows Inno Setup exe and the macOS .pkg — from the same validated staging dirs, and ships install.sh/uninstall.sh inside the Linux zip). The 0.9.0 line ships the post-0.8.12 cycle's state-compatibility harness + the JUCE 8.0.14 → 9.0.0 migration (ADR-0022: pin now the immutable commit f8f8864…; zero C++ source changes — the whole 9.0.0 breaking surface has no project exposure; Linux gains the libegl-dev build dep, JUCE 9 uses EGL not GLX; engine output proven bit-identical 8.0.14 vs 9.0.0 by a 32-scenario twin dump incl. latencies — worklogs/JUCE9_MIGRATION_0.8.13.md). Local Release build + 140-check DSP suite + 774-check state suite green under JUCE 9; pluginval strictness 10 also ran locally green in both modes ×3 during the 0.9.0 release-hardening audit (the egress restriction recorded for the 8.0.14 bump no longer applies — the release binary is fetchable), in addition to the CI gates. Earlier: 0.8.9 (PRs #55/#56/#57/#58); the JUCE dependency was bumped 8.0.8 → 8.0.14 (41acaa7, ADR-0012) and verified green by CI — build + DSP self-tests + pluginval PASSED at strictness 10 on the Linux gate. The 0.8.10 undo/redo + FrameClock work is behaviour-preserving (single forced swaps byte-identical; GUI message-thread only); the multiband flat-recombination fix intentionally changes the multiband audio (removes the crossover dip) with reported latency unchanged. The existing 0.10.0 release artifact remains CMake + JUCE 9.0.4 (ADR-0061; October approval). The integrated 9.0.5 upgrade is governed by owner-Accepted ADR-0071 (2026-11-04); its automated evidence is in worklogs/JUCE905_UPGRADE_REVIEW.md, with Level-5/native manual acceptance PASS — owner-attested for 9.0.5, recorded 2026-11-04 Asia/Shanghai; exact tested payload/environment binding not supplied. Formats remain VST3 [+AU macOS] [+Standalone]. |
| Replacement Test Status | Local DSP 945 / 0 and state 10827 / 0; State 146–148 include the original negative controls, every parameter/ingress/lifecycle and unpumped callback publication. Final-main Build 1956 and normal Release 5 passed the mandatory native VST3/AU pluginval modes ×3, ARM/Rosetta/Intel suites, sanitizer/valgrind, RTSan/TSan, fuzz and source/metadata gates. Targeted human validation is owner-attested complete on 2026-10-30. The distinct RISK-009 lock residual remains open. |
| Test Status | Original 0.10.0 candidate local gate only: DSP 945 / 0, state 5942 / 0, pluginval strictness 10 both modes ×3, all first attempts; Tagged-source CI and the fixed native Release rehearsal pass. Required manual validations owner-approved 2026-10-29. Current inventory: 75 DSP tests + A/B guard; 146 numbered State tests (1–149, 13–15 unassigned), plus tooltip/editor lifetime checks. New coverage: NaN writers, nested release, host/A-B byte acceptance, advancedMode event dispatch. Actual local counts: worklogs/STATE_HOST_HARDENING_0.9.10.md. Historical 0.9.9 evidence: 75 DSP self-tests + an A/B state-restoration clamp guard (944 individual assertions at 0.9.9, re-counted 2026-09-27 on the final run; this cell read 53 tests and 396 until then, and Tests 55–75 were never logged here — docs/procedures/TESTING.md records them; 396 after Test 54, 364 before Test 54, the guard for ADR-0035 points 8-9 — switching Oversampling from a factor to Off must not take the processing with it: the blend was left in flight across the factor duck's bottom, weighting a wrapped path that does not exist at Off, so for the 12 ms of its ramp the output was the RAW input and Drive and the mod algorithms were absent, at full level into the wideners' delay lines (measured as the drive's third-harmonic ratio, which is gain-invariant and so survives the duck: 0.103 at the bottom against 0.289 after the fix and a 0.288 factor→factor control, and the level 0.014 against 0.022); its control is the SAME duck rather than a constant, and it covers a linear widener and a mod algorithm, both with Drive, since the drive stage and the mod algorithms share the one wrapped buffer; 308 before Test 53, the guard for ADR-0035 — a Drive crossing with Oversampling on must be indistinguishable from the same crossing with it off, over all 24 combinations of factor × algorithm × direction × gesture, with the Oversampling-Off run as the control rather than a guessed threshold; 282 before Test 52, the 0.9.7 guard for ADR-0034 — the reported latency is a function of the Oversampling FACTOR alone, pinned over the whole {factor}×{algorithm}×{drive} grid, across a live Drive sweep through the engagement threshold, against the ACTUAL delay in the skipped-wrap state, and, in the leg that keeps the CPU saving honest, by requiring the skipped state's output to be the OS-off output delayed BIT FOR BIT, which a build that simply ran the oversampler all the time cannot satisfy (measured on that counterfactual: 1.31–1.57 absolute); 269 before Test 51, the round-23 guard for the OTHER overflow in the same class — the balance meter divides by ll + rr, a float ADD, which leaves float past FLT_MAX while both energies and their difference stay finite, so finite / +Inf published dead centre for a badly lopsided pair; the test is built on the overflow edge rather than on level, since a MORE lopsided pair whose sum stays finite read correctly all along, and it asserts the value in both directions because -0.0 is finite and symmetric and still the wrong answer; 256 before Test 50, the round-21 guard for EXTREME BUT FINITE audio breaking the phase meter — every value publish()'s sanitize can see is finite, so it never fires, and ll * rr then overflows in float above √FLT_MAX, making lr / +Inf publish 0.0 for a PERFECTLY CORRELATED mono signal; the test is built on the 4.295e9 threshold rather than on large values, driving 4.0e9 and 5.0e9 one binade apart and requiring +1 from both, with three normal-range controls incl. a decorrelated one that "always return +1" cannot pass; 245 before Test 49, the round-20 guard for a restored non-default session GLIDING into its own sound over the first 10–100 ms — each module snapped its smoothers in its own prepare(), which necessarily ran before updateDerived() installed the restored targets; its engine leg is the discriminating one and uses the Mono Maker, the one affected module with no delay line to confuse an empty history with a glide, and a live-smoothing control pins that ordinary edits still glide; 242 before Test 48, the round-3 guard for a duck REQUESTED while the plug-in was inactive -- it fired on activation and collapsed an engaged widener's stereo image to 0.003 of settled for 32 ms; 241 before Test 47, the round-2 guard for a forced duck interrupted by a host re-prepare -- the flag that survived it dropped the A/B slot's remembered Level Match silently, measured as 0.0 dB adopted for an injected -6 dB; 226 before Tests 43–46, the round-1 engineering-review regression guards — oversized-block chunking bit-exact vs a conforming-slice twin, post-re-prepare Mix=0 bit-null from sample 0, correlation-meter NaN recovery, and input-conditioning semantics + chorusRate/chorusDepth/dimMode discrimination, the first behavioural coverage any of those parameters has had; the same round ENGAGES the Test 2/38 algorithm × OS matrices at algoAmount 0.7 with a Dimensional voicing sweep, closing the vacuity recorded for the dump in tests/dsp_dump.cpp:12-27 but never applied to the acceptance suite; 214 before Test 42, whose A7-9 near-silent parked-identity guard adds 12 — bit-exact identity at two tail amplitudes plus a stimulus self-check, at each of four module/rate cases (PERF_AUDIT_A7-9_NEARSILENT_SCOPE.md); 202 before Test 41, whose A7-9 parked-path liveness gate adds 12 — three claims at each of four module/rate cases; 178 before Test 40, whose A7-2T path-equivalence oracle adds 24 — six checks at each of four sample rates), plus the 138-test state-compatibility suite (AnamorphStateTests, 5,600 checks at 0.9.9, re-counted 2026-09-29 after State test 25 gained four checks of its own integrity gate, which runs nothing from a capture whose hash does not match; 5,596 earlier that day, after its three capture-integrity checks; 5,593 on 2026-09-27; this cell read 63-test and 2439 until then, and State tests 65–141 were never logged here — docs/procedures/TESTING.md records them; 2439 after round 18, 2395 before round 18 added State tests 63 and 64: the first the guard for a host thread's restore installing its sound BEFORE announcing its generation, so that the adoption of an older, still-pending restore read its own generation from the engine-config word while the newer sound was already live and re-installed a superseded session over it — deterministically, once the round-17 lock woke it at the newer install's release — until the newer restore's own adoption up to a 20 Hz period later, with a host save in that window persisting the newer session's metadata over the older session's sound; a restore now announces first, and is authoritative from that instant (ADR-0036 §25); the second the guard for a host save landing inside a PRESET-shaped replacement (a per-parameter loop with no replaceState) and recording 3 preset parameters and 30 of the outgoing session into the project file — the one durable reader of the live sound now takes the replacement lock, while the session-shaped replacements were measured reader-atomic already because replaceState and copyState share the APVTS lock; 2373 before round 17 added State test 62, the guard for two whole-sound replacements interleaving: apvts.replaceState is locked by JUCE but the per-parameter write loop that follows it is locked by nothing, so a host thread's restore install and a message-thread A/B apply, undo or preset load wrote over each other and the SETTLED sound held values from both sessions (30 parameters from one and 3 from the other, measured), audible and savable until the next adoption's re-install repaired it up to a 20 Hz period later; the factory preset path — defaults, then the table's overrides — was found in the same round to be a whole-sound replacement in two loops that no document had ever named as one (ADR-0036 §24); 2336 before round 16 added State test 61, the guard for a relative operation (the A/B toggle, a preset step) deriving its target and then calling a primitive that drains, so a restore landing in the gap left the target naming a session that was no longer live: the toggle became a no-op and the step loaded the neighbour of a selection that was gone (ADR-0036 §23); 2272 before round 15 added State test 60, the guard for a restore that records no presetBaseline having its clean baseline read off the LIVE parameters at adoption time, which absorbed every sound edit made in the pending window and reported the user's own edits as clean (ADR-0036 §22); 2271 before round 13 gave State test 38's audio thread the non-vacuity check its siblings already had, 2198 after the round-12 test 59, 2144 after the round-11 tests 57–58, 2000 after the round-9 test 52, 1952 after the round-8 tests 50-51, 1928 after the round-7 test 49, 1909 after the round-6 test 48, 1882 after the round-5 test 47, 1866 after the round-4 tests 45–46, 1836 after the round-3 test 44, 1753 after the round-2 tests 42–43, 1701 after State tests 37–41 and 1506 before them; 45–46 are the round-4 review closures, the D-2 / ADR-0036 ownership guards: A/B state coherent across off-message-thread restores with a host-thread save inside the pending window byte-identical to the owner's, restore cycles with the audio thread running, preset transitions under concurrent host saves, restore with re-prepare on two host threads, and the undo history a host restore only clears; 1476 before round 27 added State test 36, the durability half of the malformed-value repair contract: the write-back into the serialized tree sat inside the "did the live value move?" branch, so a corrupt file that resolved to the value already in force (which unusable text does for every parameter whose range starts at its default) kept its damaged text in the tree and in every later save; 1460 before round 26 added State test 35, the guard for a REFUSED preset load still ducking the audio: the editor raised the masking duck before asking the manager to load, so a file the manager then refused dry-filled ~32 ms to mask a swap that never happened (an engaged widener's side energy at 0.4549 of the control's); the duck now belongs to the load path's own onAboutToLoad boundary, which fires only after every check that can refuse and still before the first parameter moves. The test COUNT is main's registered functions, re-measured in round 24 and found to have been one ahead since before round 20: the suite registered 32 while every document said 33, and State test 34's arrival makes the true figure 33, not 34. 1431 checks before round 24 added State test 34, the foreign-preset acceptance guard: a valid XML preset from another plug-in was loaded as if it were ours, adopting any value whose id happened to match and resetting every parameter it did not name, with the loader reporting success — both loaders now refuse a root that is not ANAMORPH, exactly as they refuse an unparsable file; 1406 before round 20 took State test 33 from thirty cases to thirty-nine, for the malformed numeric booleans the first implementation of the recovery policy coerced to true instead of repairing; 1323 before round 18 added State test 33, the modern-Settings repair contract; 1301 before round 17 added State test 32, the malformed-persistence guard; 1278 before round 16 added State test 31, the per-slot Level-Match reset guard; 1270 before round 15 added State test 30, the off-message-thread prepareToPlay latency guard; 1237 before round 14 added State test 29, the omitted-Setting reset; 1201 before round 13 extended State test 28 with the repository's REAL frozen pre-0.8.4 fixture mutated in place: only the six Settings values replaced, and width, mix, the preset name and both A/B slots asserted intact on every restore — untouched → State test 6's exact values, every Setting malformed → defaults, out-of-domain → clamped; 1111 before State test 28, the round-12 guard for a MALFORMED host-hidden Setting in a legacy session: migrateFromLegacyApvts cast the parsed value straight to int, undefined for NaN, infinity and out-of-range doubles, and JUCE's parser accepts "nan"/"inf" as numbers — measured through the real 0.2 restore, every such value became −2147483647 in the tree and was re-saved with the session, "2147483647" wrapped to INT_MIN through a second UB, and AArch64 saturated the same inputs differently; malformed → default, finite-out-of-domain → clamped, valid unchanged, 88 checks over both legacy shapes; 1096 before State test 27, the round-11 restore/latency integrity guards: a root that claims to be ours but carries no ANAMORPH sound child must adopt NO metadata and no Settings (it restored nothing, so preset name, indicator tick and dirty baseline would describe a session that never loaded), a rejected A/B slot's label must describe the reseeded sound rather than the payload that was refused, and the D-1 request/timer machinery must leave the host holding what the settled state predicts after off-thread automation drains; 1077 before State test 26, the round-8 guard for a restore that carries no A/B data at all: a 0.2 session, or an AnamorphRoot with no AB child, used to leave abSlot[] and the active index holding the PREVIOUS project's values on a reused instance, so the next A/B switch recalled the previous project's sound underneath the restored one (measured: raw width 0.10 against a restored 0.75, and 0.90 for the A leg). Its fresh-instance leg was written expecting a vacuous pass and refuted that expectation — the constructor seeds both slots EAGERLY, so a fresh instance kept the open/Default snapshot rather than the restored session; 1057 before State test 25, the cross-version field capture that discharged the compatibility checklist's "Session reload verified" box: a session WRITTEN by a rebuilt 0.9.5 binary (tests/fixtures/field_capture_0_9_5.session + .manifest) must reproduce exactly in 0.9.6 — sound (5 parameters × both A/B slots, which differ, so the B leg is not vacuous), preset name and dirty-star. It is the only fixture in the tree that is not a reconstruction built by current code; 1040 before State tests 22-24, the round-4 guards: an off-message-thread latency change must be DEFERRED to the processor timer rather than delivered on the calling (audio) thread (D-1/KI-027), the abandoned-gesture trigger must read the PHYSICAL mouse buttons rather than JUCE's cached copy (the macOS half of KI-028/KI-013, whose discriminating assertion is macOS-only and is verified by the macOS CI job), and a restore must leave the host holding the RESTORED state's latency rather than a rejected value's; 941 before State tests 19-21, the round-3 guards: a malformed or non-finite serialized value must restore the DEFAULT rather than a range endpoint (measured: "abc" pinned Width to its minimum, "inf" to its maximum), a repaired parameter must reach the SAVED state (the corruption used to be written straight back out), and an abandoned value-box press must not hold a host gesture open (KI-028, narrowed to macOS); 936 before State test 18, the round-2 guard for a preset entry that carries no value (it used to set that control to the BOTTOM of its range instead of its default: Width, whose range runs 0–200 % around a 100 % default, collapsed to mono) and before State test 4's two InternalState assertions were made non-vacuous, which is what exposed a 0.2-era session leaving the previous project's Settings in force (ER-STATE-08); 928 before State tests 16 and 17; 924 before State test 16, the round-2 first-activation guard (a restored session, and a fresh instance, must be at level from the first blocks rather than ducking in: measured 0.0014 of settled level before the fix, 0.98 after); 920 before the 0.9.6 restore-semantics guards: absent-PARAM default on a reused live instance, and the wrong-typed A/B slot payload end-to-end; 0.8.13 harness + the 0.9.2 preset-identity test — serialized-schema shape, parameter-registry snapshot vs tests/fixtures/parameter_registry.snapshot, raw-exact save→load→save round-trip (byte-identical), the 0.2 / pre-0.6.4 / pre-0.8.4 legacy-migration fixtures, corrupt/foreign-state robustness, user-preset round-trip + exclusion rules, A/B + view-param preservation, factory/user preset identity under a shared name, factory-id integrity, and the indicator identity across a session reload incl. every fallback (0.9.2); worklogs/STATE_HARNESS_0.8.13.md; both suites blocking fail-closed on all three CI platforms — run-tests.sh on Linux/macOS, the Windows job runs both exes), and pluginval at ANAMORPH_PLUGINVAL_STRICTNESS (.github/workflows/build.yml — the single authority for the number) in both modes (deterministic + --randomise ×3, blocking) on all three platforms, and for the AU as well as the VST3 on macOS (the AU had passed no automated format-conformance gate at all before 0.9.4; it is installed into the AudioComponent registry first, since a never-installed .component can report zero plugin types however correct it is). The deterministic mode's seed is nonzero: --random-seed 0 is pluginval's "pick a random seed" sentinel, so that mode was not previously deterministic. macOS also executes the universal binary's x86_64 slice under Rosetta 2, which nothing ran before, and a fourth build job macos-intel (macos-15-intel) runs both suites and the whole VST3+AU gate again against a thin x86_64 build on native Intel hardware — Rosetta translates onto arm64, so it answers "the shipped slice runs" and not "an Intel CPU runs it"; the job asserts it really is native Intel before doing anything and ships no artifact. Beyond the four build jobs the run also carries docs, source-lint, the first-party Clang warning gate now carried by linux itself (against scripts/clang-warning-baseline.txt — no NEW warnings; 15 sites are recorded there (12 pre-existing debt + the three deliberate A7-9 exact float compares, 0.9.5; 0.9.7's ADR-0034 change removed two -Wswitch-enum sites in AnamorphEngine.cpp)), sanitizers (ASan + UBSan, then valgrind memcheck, both suites) and linux-lto-tests (both suites built and run with -flto, the only place a behavioural assertion executes the shipped optimization class). Newest: testVelvetGatherEqualsPerSampleLoop (Test 40, A7-2T: the H5 block gather must be bit-identical to the general per-sample loop, obtained without any product change by under-preparing a second instance so the gate's own numSamples <= accum.size() clause routes it to the loop; swept at 44.1/48/96/192 kHz over blocks 32/128/512/4096 plus a density-1.0 pass, so it reaches both the block-exceeds-decorrSamps regime and the deep half of the tap set, neither of which Test 39 can. Proven live on a seeded one-sample tap-delay error: 20 of 20 equivalence checks fail at sample 3 of block 0. It is the gate for A7-2 and must be green before the ring-gather rewrite lands), then testVelvetBlockLengthInvariance (Test 39, A7-1 / 0.9.5, renamed under A7-2B when the image it was named for was deleted: the same audio driven at 512, at 32 and through a mixed 32/128/64/256/32 cycle must be bit-identical at 44.1/48/96/192 kHz, which is what holds the cross-block linear history image honest; proven to fire on a wrong slide and on a missing invalidation, and it passes unchanged against the pre-0.9.5 engine so it asserts a pre-existing contract), then testHaasParkedWarmHistory (Test 34, performance Wave 4: with Haas selected and Amount settled at exactly 0 under FTZ, every block must pass through bit-untouched, re-engaging on silent input must play back audio recorded WHILE parked — the delay lines must keep recording through the parked fast path — and re-parking must return to bit-transparency), testSoloColdThroughDrag (Test 33, performance Wave 3: with nothing soloed, a UI-cadence split drag must leave the solo monitor's settled fast path engaged — bank cold, output buffer bit-untouched — and re-engaging must snap the cutoffs to the freshest drag targets; the pre-Wave-3 gains+cutoffs gate wakes the bank and glides instead of snapping, failing both), testHighRateCrossoverSnap (Test 32: a moved crossover must land bitwise-exactly and let the solo monitor go cold at 44.1/48/96/192 kHz — the pre-fix glide float-stalls at 192 kHz 0.4688/0.9375/1.8750/3.75 Hz short of target, never cold, and fails; normal rates double as the unchanged-behavior guard), the Test 29 normal-drag tracking checks (slow-drag regression fix: a 6.65 oct/s ≈ 600 px/s drag's band edge must be AT the target 0.1–0.35 s after release on both the multiband and solo-monitor paths — the flat 4 oct/s cap measures 0.47 of full / 0.60 of the width-0 leak and fails both) and testForcedSwapDuringOrdinaryFadeOut (Test 31: a forced swap landing mid-ordinary-fade-out keeps forced semantics — the pre-fix engine dropped the request and replays a 0.494-peak stale Haas tail, failing). The JUCE 8.0.14 bump was green on CI (41acaa7); also testMultibandSplitDragNoPitchShift (Test 29: worst 100 ms pitch chunk < 18 cents — the accepted controlled-FM bound of the R(f) = 4·max(1, f/300) oct/s slew-limited smoother, ADR-0015 final + slow-drag fix — through drags, the whole catch-up and an unbroken tone-crossing crawl (the shipped follower measures ~14; the uncapped ~8 oct/s glide measures ~28 and the bare one-pole ~50, both fail); max spur < −31 dBc, measures −41.3 — the chained bank fades measure −28.5 and the rejected fref=150 variant −27, both fail; discrete jumps land < 200 ms; a released 6-oct flick lands by plain gliding well under a second) and testDryFillRespectsOutputGain (Test 30: no dry-fill spike at Output Gain −24 dB — the unscaled fill measures 15.8× and fails). docs/procedures/TESTING.md. Validation surface added 2026-08-18 (engineering-roadmap round): a GCC-only first-party warning gate beside the Clang one (linux-lto-tests, 3 accepted sites baselined, verified live on seeded -Wshadow/-Wduplicated-branches); -Werror=function-effects over the JUCE-free leaf layer (realtime job, 0 diagnostics against 52 on the engine TU, fires on a seeded allocating call); libFuzzer over setStateInformation (fuzz job, fixed seed, corpus-seeded, ASan+UBSan as the oracle — it found a double-free in its own harness on the empty input); LeakSanitizer promoted to a gate (detect_leaks=1); the shipped Linux ABI floor asserted on the stripped bytes (GLIBC_2.38 / GLIBCXX_3.4.31 — the artifact does not load on Ubuntu 22.04 LTS, previously undocumented); the MSVC ABI series asserted and the toolset recorded; and two committed instruments that were previously scratchpad-only — tests/bench.cpp (PERFORMANCE_BUDGET's procedure, C2-enforcing) and tests/dsp_dump.cpp (the DEPENDENCY_POLICY rule-2 bit-identity harness, which self-checks that its 32 scenarios are repeatable AND distinct). |
| Release Status | 0.10.0 REPLACEMENT DRAFT COMPLETE, ID 428664381, unpublished. New annotated tag at b085c87; normal Release build 5 / run 41001157732. All 11 fresh assets downloaded, hashes/provenance/versions/permissions/notes verified. Original candidate and recovery provenance remain archived in the readiness worklog. |
| Known Blockers | No remaining P1 implementation, targeted-human or automated draft-release gate. Public publication remains unauthorized; commercial/JUCE licensing, distribution terms, signing/notarization remain a separate owner track. RISK-009 lock-order residual, RISK-015 acceptance and deferred P3 work retain their documented scope. |
| Pending Tasks | Current priorities: worklogs/RELEASE_READINESS_0.10.0.md; pluginval integrity pin completed by PR #181. Historical roadmap chronology: The post-0.8.12 audit roadmap is now the working plan (worklogs/POST_0.8.12_AUDIT_AND_ROADMAP.md): Phase-1 (0.8.13) item #1 — the state-serialization & parameter-compatibility regression harness — SHIPPED this cycle (worklogs/STATE_HARNESS_0.8.13.md), and the JUCE 9.0.0 migration + JUCE-by-commit-SHA supply-chain pin also SHIPPED this cycle (ADR-0022, worklogs/JUCE9_MIGRATION_0.8.13.md — bit-identical twin dump; the ADR is now Accepted — Architecture Review plus the DEPENDENCY_POLICY Level-5 audition, signed off 2026-08-15 against the 9.0.1 build that succeeded this pin); RH-PR-8 release-pipeline foundation also SHIPPED this cycle (worklogs/release-hardening/RH_PR8_RELEASE_PIPELINE.md: tag convention + release.yml — the tag itself is cut at the 0.9.0 release); 0.9.0 release-prep also SHIPPED (version bump + CHANGELOG [0.9.0] + installable packages (RH-PR-5b/6 unsigned skeletons: Inno Setup exe, macOS .pkg, Linux scripts in the zip) + docs/user/ manual + install guide); next in Phase 1: the remaining supply-chain pin (pluginval version), macOS dSYM restoration (-Wl,-object_path_lto), the retroactive flat-recombination ADR + the 0.8.12 Level-5 audition record. Earlier history: the Wave-3 handover roadmap shipped as performance Wave 4, and Wave 4's open items (the fresh-eyes sweep — DSP lenses only — and the small-buffer attribution) shipped as performance Wave 5 (both PR #76, folded into CHANGELOG [0.8.11] — 2026-07-20; all Class A — twin-dump bit-exact, suite 140 checks; see worklogs/performance/WAVE4_INVESTIGATION.md + WAVE5_INVESTIGATION.md). A 0.8.11 final performance + release-readiness pass then closed the three remaining named candidates with no code change (worklogs/performance/FINAL_PASS_0.8.11_INVESTIGATION.md): the GUI fresh-eyes sweep is now DONE (carried in-line after the Workflow lens was lost to the org token limit a third time — the paint + message-thread surface is already exhaustively optimised; no Class-A finding); W3-10 deferred as Class B (measured: 15.5 % of samples differ from identity at Width==1); W5-D prototyped (bit-exact but only 1.10× at the frozen SSE2 flags — the 4-wide win needs an AVX2/-march build decision). Next ranked candidates: W5-A (lat==0 mix-ring round-trip, highest blast radius), W5-D coupled to an AVX build ADR, then W3-10 only if a Class-B width tier is ever adopted. A crossover-divider glide-speed request (make the slowest split movement < ~0.5 s, currently ~1.3 s) was investigated with no code change (worklogs/performance/XOVER_GLIDE_SPEED_0.8.11_INVESTIGATION.md): the ~1.3 s is the flat 4 oct/s sub-300-Hz floor of the R(f) = 4·max(1, f/300) rate cap, which is the Accepted-ADR-0015 final operating point (a measured constant ~1.25 Hz peak swept-crossover FM ≈ the bass JND, KI-012). Reproduced in scratchpad/xbench.cpp (session scratchpad, not committed — the worklog records the numbers): any base > ~4.8 oct/s fails Test 29's 18-cent bound, and the ~0.5 s target needs ~12 oct/s ≈ 40 cents (grossly audible). Reaching it therefore requires either raising the FM budget (conflicts with Accepted ADR-0015) or the linear-phase H2 crossover (adds reported latency) — both AI-Agent Hard Stops → Architecture Review Gate, escalated for a product/architecture decision; the operating point is unchanged. A GPU/GUI rendering-efficiency pass shipped as performance Wave 6 (0.8.12, worklogs/performance/WAVE6_GPU_RENDER_INVESTIGATION.md): a 5-lens adversarial Workflow confirmed the idle/Simple/hidden GPU paths are already at ~0 and at their frontier, and that the spectrum cannot be made opaque pixel-identically (it nests in a translucent rounded panel); the one behaviour-neutral win was the spectrum solo-headphone transparency layer, which was allocating a plot-sized offscreen FBO every Advanced-mode frame — now clipped to the glyph and skipped at full opacity (pixel-identical). Remaining GPU opportunities are all either not-pixel-identical (opacity), behaviour changes (ε idle gate), or interaction-only (drop-shadows, ease-time bottomLayer rebuild); none are low-risk/high-value. H7 + a LevelMeters gate stay Category C (→ one Architecture Review), then Multiband LR4 SIMD, then OSD-2 (OS-only). H16 is largely superseded by FrameClock. Formal CPU/memory budget numbers remain a TODO (PERFORMANCE_BUDGET); real-DAW host matrix (KI-004/KI-009); release-tag adoption completed by 0.9.9 (RISK-003 closed); optional KI-001 warm-bank refinement (needs ADR). A pre-release hardening program is planned — docs/architecture/RELEASE_HARDENING_PLAN.md (licensing, signing/notarization, installers, tag-triggered release pipeline; the first implementation task RH-PR-2 build hardening shipped — PR #63, ADR-0021, [0.8.11] ### Security; RH-PR-8 (tags + release-pipeline skeleton) shipped in the 0.8.13 cycle — RISK-003 closes when the first tag is cut; next are RH-PR-3/4/5 (notarization, licensing, Authenticode), gated on ADR-0016..0020 + human business decisions). |
| Roadmap | Current working plan: worklogs/PRODUCT_READINESS_ROADMAP_0.8.13.md (post-RH-PR-8; supersedes the execution phase of POST_0.8.12_AUDIT_AND_ROADMAP.md, whose Phase-1 items all shipped — state harness PR #82, JUCE 9 PR #83, RH-PR-8 PR #84 + rehearsal PR #85). Phases: 1 = release completion (planned to ship as 0.9.0; now 0.9.9 — see Release Status; release prep DONE — annotated 0.9.9 tag now exists, closing RISK-003; 0.9.10 development follows (for final 9.0.4, Architecture Review is APPROVED, Level-5 is PASS (A–G) and compatibility is 8/8 PASS on the owner attestation of 2026-10-21 UTC; current records are in docs/procedures/RELEASE_COMPATIBILITY_CHECKLIST.md and docs/procedures/LEVEL5_AUDITION.md); 2 = 0.9.x user-facing product readiness (user manual + installation guide + installers shipped with the 0.9.0 prep; remaining: auval-in-CI as an ADDITION to the pluginval AU gate that landed in 0.9.4 — not AU coverage itself, which now exists — plus host matrix, golden-audio, UX KIs, perf-budget numbers); 3 = commercial infrastructure (owner decisions → signing/notarization of the now-existing installers → licensing); 4 = 1.0 preparation (QA matrix, schema-freeze fixtures, support matrix). Owner ratification of Phases 2–4 pending. (AAX remains Not Supported by decision — COMPATIBILITY_POLICY.) |
| Ownership | TODO: no owner/team metadata in the repository. Requires project-owner input. Company of record: RollyTech (CMakeLists.txt:423); contact per repository owner. |
| Dependency | Pin | Version-lock reason |
|---|---|---|
| JUCE | 9.0.5 — immutable commit d60b7a7… — CMakeLists.txt:71 (d60b7a7) (FetchContent, CMakeLists.txt:70-72 (9.0.5), ADR-0071) |
Framework for all DSP, parameters/state, GUI, and plugin wrappers. An unpinned bump can silently change DSP/latency/state-ABI and the X11 editor path (INC-006 lives in JUCE). Pin = reproducible, audited behaviour. A bump is a Build System change (ADR + Review). The bumps are recorded in ADR-0012 (8.0.8 → 8.0.14), ADR-0022 (8.0.14 → 9.0.0 + the SHA pin), ADR-0026 (9.0.0 → 9.0.1), ADR-0054 (9.0.1 → 9.0.2), ADR-0060 (9.0.2 → 9.0.3, superseded) ADR-0061 (9.0.3 → 9.0.4; historical owner Architecture Review 2026-10-21 UTC, Level-5 PASS A–G and compatibility 8/8 PASS for 9.0.4 only) and ADR-0071 (9.0.4 → 9.0.5; Accepted, owner Architecture Review 2026-11-04 Asia/Shanghai; automated target validation recorded, Level-5 and native/manual acceptance PASS — newly owner-attested for 9.0.5, recorded 2026-11-04 Asia/Shanghai; exact tested payload/environment not supplied; PR #213 merged; no release authorized). See docs/policies/DEPENDENCY_POLICY.md, RISK-001. |
| C++ standard | C++23 (CMakeLists.txt:16-18, ADR-0027) |
Raising it is a build-contract change (Build System → Architecture Review Gate). Raised 17 → 23 in the 0.9.4 cycle: engine output proven bit-identical, one missing <algorithm> include fixed. On MSVC, C++23 arrives as /std:c++latest — see ADR-0027 §Consequences. |
| pluginval | v1.0.4, release archives and executables SHA-256 pinned in scripts/pluginval-release.json |
The conformance gate (strictness 10). Both platform wrappers use scripts/acquire-pluginval.py, which verifies archive, executable and cached inventory integrity. |
| Linux system libs | distro (scripts/setup-linux.sh) |
ALSA/JACK/X11/FreeType/GTK/WebKit/mesa/xvfb for headless build + validation. |
No team structure exists in the repository, so the following is a proposed mapping (governance guidance, not asserted fact); the project owner should confirm/assign:
| Documentation area | Proposed owner |
|---|---|
docs/architecture/ (incl. ADRs, DSP, signal flow) |
DSP / Audio engineer |
docs/architecture/PARAMETER_*, SERIALIZATION_*, STATE_* |
Whoever owns the parameter/state surface (compatibility-critical) |
docs/procedures/ (BUILD, CI_CD, PACKAGING, RELEASE) |
Build / Release engineer |
docs/policies/ |
Tech lead / maintainer (these are binding) |
POSTMORTEMS, KNOWN_ISSUES, FUTURE_RISKS, HANDOVER |
Maintainer (updated per release/incident) |
- Read
docs/SOURCE_OF_TRUTH.md, thendocs/policies/AI_AGENT_POLICY.md(Hard Stop conditions). - Build + test locally per
docs/procedures/BUILD.md/TESTING.md. - Before touching DSP/parameters/threading/state/latency, read the governing policy + ADR.
- Keep docs in sync per
docs/policies/DOCUMENTATION_LIFECYCLE_POLICY.md; refresh this file each release.