docs(tasks): the set is locked, the preload covers it, and the gate that would have undone both is fixed

gig-up runs check-preload --fix whenever the check fails, so a plan that was a
deliberate superset scored STALE and got silently narrowed — bass2 would have
been dropped on gig night and ete_a_mauerpark would have lazy-loaded mid-set.
Membership now uses comm -13/-23 (missing is a fault, extra is information),
counts join on shared banks, and --fix emits the union so it can never shrink.

Second hole, latent: under en_US.UTF-8 a whole-line sort orders 'bass2 5' before
'bass 4' while join compares field 1, so join dropped a pair (123 of 124 shared
banks) and 2>/dev/null ate its warning — a count check with a hole reports ok.
LC_ALL=C and sort -k1,1 on every set operation; join now equals comm -12.
Extras are also count-checked against disk: SuperDirt asserts the recorded count
at boot whether or not the bank is in the set.

Not sampled: every .tidal under live/ evaluated with silent-eval --seeded.
85 do not compile and 21 have a genuinely silent orbit; the failures are
diffuse helper/API drift (scope errors on g, jchord; Pattern String type
mismatches), not one rotten folder. Playable is still not gig-ready — the
play log remains the better signal for a set.

From PLN's Set Builder export, 120/120 min. All ten pass silent-eval seeded;
the set needs 46 banks, all present on disk. preload.scd (gitignored, generated)
regenerated as a superset — 125 banks, adding bass2 for ete_a_mauerpark.

The row existed but bare, and libjack.so.0 resolves to jackd2's — an unwrapped
qjackctl shows an empty jackd2 graph instead of PipeWire's. Same wrap as Ardour.

Three rig items and two of the three next moves closed while the page was being built;
SOUND now carries the measured Master reading instead of the wrong -inf claim.

Where Thursday stands on paper: rig, set, sound, stage, rehearsal, each with an honest
figure and the items only PLN can do, over a live countdown to doors.

check-mix against the running session: twelve orbit faders between +0.0 and +6.0 dB,
none muted, all routed to master. The overnight -inf reading does not hold. Master
-30.2 dB is the real finding, and with OSC off only PLN's eyes can confirm the live value.

A hard DJF swing froze the readout: the 20 Hz door dropped events without
parking one, and the 0.9 s re-arm then replayed the cached strings, so a
value the glass never caught was reprinted indefinitely — pinned at 127 the
'end stop' continue skipped the display entirely and 5.6kHz (value ~108)
stayed on screen for good. The re-arm now recomputes from self.values, so any
dropped event heals within 0.9 s whatever ate it; the door parks instead of
dropping; the flush takes the freshest value. Momentary family_mute lines
still replay — mutes_held() is transient state, not durable.

Cream ground, warm brown ink, sage for OK, amber for WARN, terracotta for the
played-recently badge. Screenshot-verified over HTTP at 1400px.

Fourteen candidates: the nine from the overnight sweep plus the five the driver journal
shows PLN actually played this week, each with its silent-eval verdict. Per-track minutes
against the 120-minute target, reorder, copy the paths out. One static file, no build,
renders offline, LAN-reachable for phone picking.

docs(tasks): Tue-22 gig state — the latency cut is not live, the CPU is capped, and the play log names the set

Three corrections from measurement: sclang predates the s.latency edit (still 0.2 in the
process), max_perf_pct is 55 so every audio number is suspect, and the driver journal shows
12 tracks actually played in 5 days — five of them outside the overnight sweep.

rel_delta caps one message at +-63 (7-bit offset-64); firmware acceleration
compresses a fast flick to 1-2 messages, so flick-to-max landed at ~125.
A saturated delta in the end-stop band (>=115 up / <=12 down) now snaps to
127/0 — slow turns never saturate, precise control untouched. Feel bands,
PLN vetoes at rehearsal.

The firmware's per-control value row never shows driver-integrated values
for relative encoders (stuck at 0 — probe H5 unresolved); PLN chose one
coherent fast overlay over 29 firmware-drawn fictions. Overlay-only mode
(promoted from --oled-overlay fallback to default) draws every knob on the
global 0x36 target with bring-up-after-write; --oled-native restores the
old firmware-drawn mode.

s.latency 0.1 (oLatency 0.1 on top = 0.2 total; the old padding defended
against watchdog-restart bursts, not latency). Regression check in-file:
journal late-count must stay 0, revert on any late. gig-up --bt-off/--bt-on:
a phone or BLE lamp churning wireplumber can kill the fold links — rfkill
the radio before doors.

Eye-in-the-loop probe (lcxl3-probe-display, 2026-09-21) falsified the
'a field write needs no re-summon' assumption: bare set_text on a visible
target (0x35 AND 0x36) never reaches the glass. Every text path now ends
in configure_display(target, 0x7F): touch overlay, 2s home tick, zero-anim.
Plus: ~10 Hz rate gate with latest-value-wins pending flush (H2 ceiling
untested — conservative), and the at-rest overlay re-arms every 0.9s
indefinitely so DJF state/zero stops self-destructing after 1.2s.

Overnight silent-eval sweep of 9 WIP set candidates: 7/9 can play with the
standard #55 seed; techno_orage d2 is a real silent orbit to debug; bass2 and
humps banks not warmed by preload.

docs(tasks): park the card-profile learnings — wireplumber 0.4 lua rules, DMIC guard, ardour sink follow

5 CC moves the buffer-clobber detector wanted (the gate went NO-GO over
it): the track was committed on the pre-remap grid, so its d3/d4/d7
buttons fired across columns into other orbits' controls. Mechanical
remap only; the ^44 step keeps its FIXME(#94) note.

The Bridge's RIG UP ran tools/gig-up.sh --converge, whose converge never
starts lcxl3-driver (boot policy manual), and whose LCXL checks grep the
v2 name 'Launch Control XL' — so a v3 board plugged in read as absent,
painted by nobody, and the gate still said GO. Meanwhile the desktop
launcher runs the ROOT gig-up.sh, a second launcher with the leds() the
gate lacks — two launchers, each owning half the surface story.

- launchers: Ardour launches under pw-jack like gig-up does (bare ardour
  starts its own jackd and splits the graph from scsynth)
- gig-up: 'LCXL present' matches LCXL3 too; 'LCXL LEDs' is
  generation-aware (LCXL3 -> lcxl3-driver, original -> lcxl-leds-watch)
- lcxl-path: follows the v3 path LCXL3 -> driver's 'ParVagues LCXL3'
  virtual port -> SC, falling back to the Midi Through road for v2

Every tray GIG UP click POSTed to the Bridge, which ran
'gig-up.sh --converge --quiet' — flags this script never parsed, so the
arg guard rejected it with 'unknown option' and exit 2, output swallowed
by the Bridge's capture. Net effect: Pulsar opened (PRE_APPS, before the
POST) and nothing else ever booted. The script and its caller had
drifted apart on paper only — this is the contract, written down.

The double click was the appindicator extension's, not ours: it reserves
double-click for SNI Activate (instant menu) and delays single-click by
400 ms, so a single click feels dead. Nothing to fix tray-side; documented
in the changelog.

- BRIDGE_QSS restyles the Qt-drawn popup on dark desktops: tonal surfaces,
  hairline borders, hover pill, magenta on the engaged radio; circles for
  radio groups, squares for boolean toggles. Contrast measured: body 14.7:1,
  disabled 6.4:1, radio ring 3.3:1 (bumped from 2.3:1 in review).
- stat rows and the thermal tooltip read in tabular digits.
- every user-visible string loses its em dash (colons, parens, middots);
  same pass on gearbox.py labels (shared with the web Bridge) and the
  launcher blurbs; unknown gearbox placeholder is now n/a, not a bare dash.
- mnemonics on the action rows (&Open Bridge, &GIG UP, &Restart SuperDirt,
  R&ig, &Start at login, Cut G&PU, &Quit); verified over DBusMenu that Qt
  exports them as underscores, so the shell-drawn twin gets them too.
  Literal ampersand does not survive the export, so the copy avoids it.

The GUI launcher started SuperDirt, Ardour and Pulsar as raw processes and
never touched the systemd --user layer, so a tray that exits 0 when the shell
takes its host away (perf-tray, Sep 14) or a user-closed MIDI lens (exit 78)
stayed dead: the only convergers were tools/gig-up.sh --converge, rig-doctor
and the Bridge watcher, and the Bridge was dead too. Three days of launches
"worked" with no tray and no lens.

ensure() now refuses to start a unit whose proof process already runs outside
it — which is what makes it safe for the launcher to call --ensure --apply
after scsynth is up instead of spawning a second SuperDirt through
parvagues-sc.service. --status agrees, so a launcher-started SuperDirt is no
longer a false problem row. gig-up.sh converges right after the ready-wait,
and honours the midiviz close-latch (the tray's MIDI Monitor button is the
way back within a session).

open_term() launched sclang directly, bypassing parvagues-sc.service and its
10-pipewire-jack.conf drop-in. With jack2 installed, ldconfig hands scsynth the
real libjack, it finds no server and starts jackd on hw:sofsoundwire, which
takes the card from PipeWire by D-Bus reservation. Meters move, nothing is
audible (raw jackd -dalsa bypasses ALSA UCM, so the SOF speaker route is never
enabled), and Bluetooth cannot work at all since jackd has no BT backend.

Also adds tools/parvagues.desktop so the ordered launcher is one Super-key away;
nothing had ever been installed in ~/.local/share/applications.

"i see the parvagues tray icon, but doesnt react when i click" — twice, with
the unit green both times. Three findings, in the order they mattered:

- The menu WAS exported and populated all along (19 rows over
  com.canonical.dbusmenu). What made it useless is the style: with
  QT_QPA_PLATFORMTHEME=qt5ct and no qt5ct config under the unit, Qt picks
  `qt5ct-style` with a bare #efefef palette — a 2009 grey box on a Yaru
  desktop. Now: Fusion, plus an explicit dark palette when the desktop asks
  for dark (GNOME's color-scheme is the one setting that knows).
- The tray host on GNOME is an EXTENSION, and it registers its
  StatusNotifierWatcher seconds after login. perf-tray printed "No system
  tray available", exited 1, and only Restart= saved it 3 s later. A slower
  login loses that race. Now it waits up to 120 s, polling on a QTimer
  (availability arrives over D-Bus, so the event loop has to be spinning).
- New check `perf-tray reachable`: unit active, item REGISTERED with the live
  pid (a stale item from an old pid looks identical on screen), and the menu
  populated over dbusmenu — the only one of the three that a click needs.
  Negative-tested against a stopped tray.

Also:
- `wireplumber churn` check: starts per hour, and who asked for them. The
  existing checks could only see the wreckage (a failed unit, a dummy sink);
  this sees the cause while audio still works. It FAILs on tonight's 48.
- The kwin midiviz-pin check asked KDE questions on a GNOME session, so it
  warned forever about a file that will never exist. Desktop-aware now: a
  check that cries wolf is one nobody reads on the day it is right.

The rig is multichannel by design: orbit k is the pair (out_{2k-1}, out_{2k}),
wired to its own Ardour track at a gig. Away from the stage that design means
d1 is the only orbit that can reach a sink — and on a freshly booted laptop
(2026-09-07) not even that: scsynth had NO links to any sink, so the whole box
was silent with every check green.

- tools/fold-orbits.py: fold all orbit pairs onto one stereo sink, summed at
  unity. Idempotent, and it VERIFIES — pw-link exits 0 for "File exists" and
  for a port that vanished mid-call, so its exit status proves nothing. The
  channel count is discovered from the graph (28 today, 12 in an older
  comment, 2 on stock SuperDirt), never assumed. Refuses while Ardour runs,
  which owns the mix and prunes SC->hardware links every 2 s.
- gig-up.sh --headphones: SuperDirt -> fold -> Pulsar. No Ardour, no fader
  restore; the fold becomes the readiness gate, because it IS the whole
  monitoring path.
- gig-preflight: `monitor path` check — stage (Ardour receiving on N tracks)
  or headphones (fold present), and it asks fold-orbits rather than
  re-deriving the port math.
- 18 tests, fixtures captured from the real graph: `pw-link -lo` marks links
  by INDENTATION only, so a grep of it fabricates relationships, and a source
  port printed with no indented child is the exact state this tool fixes.

Measured, not assumed: 14/14 orbits arrive at the sink (bd swept d1-d14, peak
per orbit), and the links survive 32 s of autoroute reconciling.

First production run of the failed-units check flipped the whole set-
readiness verdict on apport-autoreport.service — honest but wrong: the
rig runs entirely in user scope, and system-scope corpses (apport, snapd
chores) rarely gate a set. User scope stays a FAIL.

An scsynth whose pipewire-jack client loses its startup race gets no
negotiated format (quantum 0) and busy-spins its data loop at ~95% of a
core at RT priority, unit green, process alive. Hours of that starved
the SOF DSP's IPC until the firmware wedged and every sink vanished.
Same config also boots clean at 1.5% — a probabilistic race, so the
durable answer is detection + self-heal:

- sc-watchdog spin detector: /proc CPU deltas every poll (zero forks),
  after 10s sustained >=85% ONE pw-top shot decides — quantum>0 is a
  musician playing and is never touched; quantum 0 is the spin
  (restart via the shared rate limit). Suite 15/15 incl driven-guard.
- rig-doctor: SOF DSP IPC-timeout check (with the no-root cold-boot
  cure), failed-units check (start-limit trap, negative-tested),
  scsynth orphan-spin check on the same quantum oracle. 51 checks.
- start_and_midi.scd: mi global effects measured LIGHT (all=1.3% vs
  off=1.7% idle, 5 boots) — acquitted, kept ON, gated behind PV_MI_FX
  so the next suspicion is a knob-flip, not a guess.
- CHANGELOG Sprint 8 + backlog closure.

The PRUNE ran unconditionally every 2s. With Ardour closed it deleted
SuperCollider's ONLY output links, and a linkless pipewire-jack client
self-drives its data loop into a 100%-CPU error spin at RT priority.
Hours of that starved the SOF DSP's IPC until the firmware wedged
(IPC timeout -110) and every sink vanished (2026-09-07). 'SC must
never reach hardware' is Ardour-session policy, not idle-laptop policy:
routing and pruning now both require Tidal tracks in the graph.

Sprint 7 covers the morning: mi-UGens s.sync, the preload pointed at what gets
played, three stacked bugs in its freshness check, 198 AppleDouble deletions,
s.latency 0.3->0.2, and the wireplumber start-limit outage.

Archive entry carries nine learnings, the load-bearing ones being that pgrep
costs 53-59ms a call here while the real trick is the cheap prefilter (the regex
on every comm is WORSE than the pgrep it replaced); that case-in-a-variable does
no alternation; that start-limit-hit is this box's signature trap and retrying is
the one action that cannot work; and that a valid measurement can be silent,
because mute sits downstream of all DSP while a null sink lies.

Memory: verify-the-leg-that-breaks gains the three 2026-09-07 instances plus two
rules (ask why two numbers disagree; a tool owns the commands it prints).
rig-state records the reset-failed lesson and the BT-by-name detail.

PLN: 'media keys dont work' + 'tried bluetooth headset couldnt get sound there'.
Cause was neither:

    wireplumber        failed (start-limit-hit)
    Sinks:  100. Dummy Output      <- the ONLY sink
    0 bluez objects

pipewire is the graph; wireplumber is the session manager that puts DEVICES in
it. Without it there are no device nodes at all -- every hardware sink vanishes,
PipeWire invents Dummy Output, media keys act on nothing, and a Bluetooth
headset cannot appear however well it pairs. It reads exactly like dead
hardware.

The trap is StartLimitBurst=5 / 5min with Restart=on-failure. Five hand-issued
restarts inside two minutes exhausted it, and from then on restarting AGAIN
cannot work. Cure is reset-failed, then start. Third instance of this exact
shape in one session after parvagues-sc twice: on this box, 'X will not start'
means check reset-failed first.

rig-doctor's check_pipewire tested pipewire on PATH, pw-jack on PATH, and
pipewire.service is-active -- and pipewire.service was ACTIVE for the whole
outage, so the check was green while the box had no audio at all. Presence
versus function again. It now also asserts wireplumber is active and that the
graph holds at least one real output (alsa_output/bluez_output, never
auto_null/Dummy), FAILs with the reset-failed cure in the fix field, and WARNs
on a dummy or unset default. It caught a live regression the first time it ran.

The headset itself was only MUTED: bluez_card active profile was already
a2dp-sink, and the sink read '[vol: 0.20 MUTED]' -- per-device state wireplumber
persists. Unmuted by NAME, because the BT node id moves between calls while the
device reconnects. Not caused by the quantum/mute testing, which ran at 00:10
with no BT device connected and left force-quantum verified at 0.

latency-lens --print-config used to hand over 'systemctl --user restart pipewire
pipewire-pulse wireplumber' with no warning, which repeated is precisely this
trap. It now says ONCE, states the consequence, gives the cure, and points at
the runtime setting that needs no restart.

Doctor: 48 checks, 0 fail, 10 warn, 38 pass.

The comment read 'increase this if you get late messages', and the rig had 136
of them on 2026-09-06, so the arrow only ever pointed one way. Value history: 1
second, then 0.3, never revisited.

Those 136 were not a latency shortfall. Two bursts (64 at 19:58, 72 at 20:03)
with values DECAYING 8.1s -> 0.65s: a backlog draining, not a trickle of
near-misses. Both sit against SuperDirt restarts, and the 20:03 one is the
watchdog's spurious restart-on-boot fixed in b9564095 -- SC restarted, its clock
reset, Tidal kept its logical clock, the backlog flushed as 'late'. The
documented reason to pad this was a misdiagnosis of a bug that no longer exists.

0.2 is SuperCollider's own documented default and this is a direct tax on how a
ctrl+enter feels. Lower is fair game; the floor is whatever keeps 'late' at zero
under the densest material. Clean boot after the change: 0 lates.

latency-lens now counts 'late' per candidate alongside pw-top's ERR, and a late
rejects a quantum on its own: ERR is the audio graph missing its deadline, late
is the MUSIC being handed over too late to play on time. Different failures, and
a quantum decision wants both. Matched as 'late <digits>' -- an earlier hand
grep for the bare word scored six hits on metalPlate.scd and inflated the count.

Deleted 198 AppleDouble resource forks named zz._*.wav, on explicit owner
instruction. Every one confirmed by file(1) magic before removal rather than by
name pattern -- 198/198 candidates came back 'AppleDouble encoded Macintosh
file', zero false positives, 0.3 MB. 69 were in playable banks
(rhadamanthe_fx 227->189, _divers 314->293, _vocal 77->72, _melo 32->30); 129
were under Samples/baba/__MACOSX/, whose emptied dirs were rmdir-ed. Sample
indices were untouched: the zz. prefix sorted them after every real sample,
which is presumably why someone renamed rather than deleted. The boot is now
free of the 'WARNING: File reading failed' wall.

Then three faults in the freshness path, each hiding the next:

1. preload.scd's mismatch banner said 'whitelist is STALE, regenerate it' when
   the cause was unreadable files, and regenerating provably changed nothing.
   Now reports 'N bank(s) DID NOT FULLY LOAD', separates got==0 (whole bank) from
   0<got<expected (folder changed, or some files are not audio), and prints the
   file(1) one-liner that distinguishes them.

2. check-preload.sh compared bank NAME SETS and never counts. The plan said
   rhadamanthe_vocal=77 against a folder of 72 and the checker printed 'ok' while
   the boot said 'expected 77 files, got 72' -- and --fix refused to regenerate,
   because by the name-set test nothing had changed. The everyday way to hit this
   is dropping a new pack into an existing bank: every new file lazy-loads
   mid-set under a green check. Now compares name+count pairs and prints
   'plan N -> disk M' per drifted bank.

3. The bank-name regex was case-blind. [a-z0-9_]+ truncated rampleA0 to rample
   and collapsed every vocalOoh1/vocalScatJ into one 'vocal', which is why the
   checker said 111 banks while SuperDirt loaded 124. 124 was always the truth;
   the regex was wrong in both directions, undercounting the plan AND inventing
   two bank names that do not exist. bank_counts() had inherited it, so drift in
   a camelCase bank stayed invisible even after fault 2 was fixed.

Three numbers now agree: checker 124, boot '124/124 banks OK in 5.2 s',
independent parse 124/124/no gap. Drift tested both directions on a camelCase
bank, plan byte-identical afterwards.