docs: anchor the checklist citations to headings and symbols, not line numbers

Line numbers rot silently. Ten were already broken, including all eight Precision invariants pointers. Vendor citations left alone.

docs/TODO.md

@@ -247,9 +247,9 @@ dynamically... Toggling the limiter killing the voices isn't a deal breaker thou
 will either be on or off on its instance, toggling during playback is not a use case."*
 
 **The wart — and it is ours, not the SDK's.** `ReaSamplerProcessor::setActive(true)` calls
-`reloadInstrument()` (`src/shell/instrument/reasampler_processor.cpp:89-97`) — a bridge read
+`reloadInstrument()` (`reasampler_processor.cpp`'s `ReaSamplerProcessor::setActive`) — a bridge read
 plus a **full WAV re-decode** plus a fresh engine. `setActive(false)` frees `live_`,
-`draining_` and the graveyard (`:98-107`). So every host-driven activation cycle — a
+`draining_` and the graveyard (`ReaSamplerProcessor::setActive`). So every host-driven activation cycle — a
 latency-change restart, an offline-render bracket, any host that deactivates around transport
 state — pays a disk read and a decode that nothing about activation requires. **Activation
 currently means two things at once**: "the audio thread may run" and "the decoded `SampleData`
@@ -269,7 +269,7 @@ die across the cycle** — only the decoded PCM survives, and those are two diff
 currently collapsed into one. Second constraint: `setActive(true)` is also the non-editor
 legacy-lift trigger for a pre-v10 blob (its opportunistic `refreshRefsFromBank` copies refs in
 once the bank blob is readable), so a path that skips the bridge read must keep that lift
-reachable — the comment at `:90-96` records the residual load-order race it exists to cover.
+reachable — the comment in `ReaSamplerProcessor::setActive` records the residual load-order race it exists to cover.
 
 **Priority / risk.** Low; deferred by ruling. Nothing is incorrect today, only wasteful, and
 Daniel has explicitly accepted the user-visible consequence (held notes cut on a limiter
@@ -530,7 +530,7 @@ needs no live REAPER process to exercise `rec->Register(...)` calls. Once
 **The constraint the fix MUST handle.** The extraction alone buys nothing:
 `action_registry` has no test target today either, so lifting `ingestHandleSectionCommand`
 into it without also standing up the test target just relocates the untested code. The
-same follow-up could collapse `ingest.cpp:466-472`'s hand-rolled `command_id`+`gaccel`
+same follow-up could collapse `ingest.cpp`'s `ingestRegisterActions` hand-rolled `command_id`+`gaccel`
 pair onto `action_registry::registerAction`, which already does exactly that dance for
 the Q-W6 table.
 
@@ -565,7 +565,7 @@ track", nothing to do and the inference is retired into fact. If it comes back "
 summed file", the refusal is over-strict for the TRACK scope and should be narrowed back
 — and the ITEM-scope half is then an OPEN question, not settled: a full-extent item
 capture already sums a multi-track item selection via `&32|single-file`
-(`tests/test_render_settings.cpp:262`), so if `&128` also sums, a ranged item capture
+(`test_render_settings.cpp`'s `testMultiTrackStemRenderIsNamedForRefusal`), so if `&128` also sums, a ranged item capture
 routed through it sums too, and keeping the item refusal in that branch would make item
 scope inconsistent with itself across the range boundary (full-extent sums, ranged
 refuses, same scope). Whether that inconsistency is acceptable or the item refusal should
@@ -798,8 +798,8 @@ the two callers' plumbing.
 
 **Context.** `saveToActiveProject()` returns false for exactly two reasons — no active
 project, or an unsaved one — and in both cases NOTHING was written. Four capture sites
-discard that return outright: `capture_orchestrator.cpp:343`, `capture_batch.cpp:266` and
+discard that return outright: `capture_orchestrator.cpp`'s `RunCapture`, `capture_batch.cpp`'s
-`:333`, and `realtime_lifecycle.cpp:39`.
+`RunBatchCaptureItems` and `RunBatchCaptureRazor`, and `realtime_lifecycle.cpp`'s `CommitRealtimeResult`.
 
 **The wart.** A capture on an unsaved project renders the file into the bank folder, adds
 the `Sample` to the in-memory book, records a birth record in memory — and loses all three
@@ -820,7 +820,7 @@ and the choice between those two is recorded rather than implicit.
 
 ## `panel_input`'s wheel handler persists the whole book per wheel message
 
-**Context.** `panel_input.cpp:450` — `handleWheel` calls `markTailDirty()` on every wheel
+**Context.** `panel_input.cpp` — `handleWheel` calls `markTailDirty()` on every wheel
 message that actually moves `manualMs`, while the pointer is over the footer in Manual
 mode. (It coalesces sub-notch deltas within ONE message and no-ops at a bound, so the
 count is wheel messages that changed the value, not raw notches.)
@@ -839,10 +839,10 @@ the value that lands is the gesture's final one.
 
 ## `RunCaptureItemAssign`'s undo point does not follow the pattern its comment claims
 
-**Context.** `capture_orchestrator.cpp:364-365` states that the action follows the bank-op
+**Context.** `capture_orchestrator.cpp`'s `RunCaptureItemAssign` states that the action follows
-family's discard-on-unsaved pattern.
+the bank-op family's discard-on-unsaved pattern.
 
-**The wart.** It does not: `:382-383` records the undo point unconditionally whenever
+**The wart.** It does not: `RunCaptureItemAssign` records the undo point unconditionally whenever
 `sampleId` is non-empty, and never consults the persist's return at all. So on an unsaved
 project it records an undo point for ext-state that was never written — the empty
 no-effect entry `persistBankOp`'s guardrail exists to avoid. The comment describes the
@@ -857,7 +857,8 @@ the unsaved-project case one way.
 
 ## `core/tracking/CLAUDE.md`'s untracked-file enumeration says "reaches the `.rpp`" too loosely
 
-**Context.** `src/core/tracking/CLAUDE.md:24-31` enumerates how a created file can stay
+**Context.** `src/core/tracking/CLAUDE.md` §"Invariants" — "No silent gaps — in memory at
+creation, on disk at the next save" — enumerates how a created file can stay
 untracked, and describes the ledger as reaching the `.rpp` at the following
 `saveToActiveProject()`.
 

docs/VERIFICATION.md

@@ -5,27 +5,27 @@ Checks for Θ, Ξ, Ψ, Ε, and Ρ work that no unit test can close. Build **Rele
 
 ## Precision invariants
 
-- [ ] Dry offline item capture of a 2 s range, re-inserted at its source position, inverted against the source — reads silence (`CLAUDE.md:207`)
+- [ ] Dry offline item capture of a 2 s range, re-inserted at its source position, inverted against the source — reads silence (`CLAUDE.md` §"Precision invariants" — "Null test")
-- [ ] Run the identical offline capture request twice — the two files are byte-identical on disk (`CLAUDE.md:208`)
+- [ ] Run the identical offline capture request twice — the two files are byte-identical on disk (`CLAUDE.md` §"Precision invariants" — "Bit-identical repeats")
-- [ ] After any capture, source items and tracks are unchanged: fader, pan, mute, FX bypass, selection (`CLAUDE.md:209`)
+- [ ] After any capture, source items and tracks are unchanged: fader, pan, mute, FX bypass, selection (`CLAUDE.md` §"Precision invariants" — "Non-destructive")
-- [ ] After a realtime capture, the temp track is gone and every source track's routing is back as it was (`CLAUDE.md:209`)
+- [ ] After a realtime capture, the temp track is gone and every source track's routing is back as it was (`CLAUDE.md` §"Precision invariants" — "Non-destructive")
-- [ ] Capture 10.000–12.000 s — card reads 2.000 s / 96000 frames, no leading or trailing silence (`CLAUDE.md:210`)
+- [ ] Capture 10.000–12.000 s — card reads 2.000 s / 96000 frames, no leading or trailing silence (`CLAUDE.md` §"Precision invariants" — "Exact bounds")
-- [ ] With an FX on the source track: item scope does NOT carry it, track scope does (`CLAUDE.md:212`)
+- [ ] With an FX on the source track: item scope does NOT carry it, track scope does (`CLAUDE.md` §"Precision invariants" — "Capture FX scope")
-- [ ] Track scope on a child track with FX, gain, and pan set on the parent and master — neither colors the capture (`CLAUDE.md:212`)
+- [ ] Track scope on a child track with FX, gain, and pan set on the parent and master — neither colors the capture (`CLAUDE.md` §"Precision invariants" — "Capture FX scope")
-- [ ] Save, move the whole project folder elsewhere, reopen — every card still resolves and auditions (`CLAUDE.md:211`)
+- [ ] Save, move the whole project folder elsewhere, reopen — every card still resolves and auditions (`CLAUDE.md` §"Precision invariants" — "Relative paths only")
 
 ## The decisive observation
 
-- [ ] **Run first.** `docs/verify-track-scope-multitrack.md` §3 by hand, and count the files REAPER writes (`docs/TODO.md:552`, `docs/COMPLETED.md:894`, `docs/COMPLETED.md:906`)
+- [ ] **Run first.** `docs/verify-track-scope-multitrack.md` §3 by hand, and count the files REAPER writes (`docs/TODO.md` §"The `&128` multi-track output shape is still DAW-unobserved", `docs/COMPLETED.md` §"Ψ-W3-T1", `docs/COMPLETED.md` §"None of the seven is DAW-verified")
-- [ ] Two files confirms Ψ-W1-T1 and Ψ-W3-T1 at once; **one summed file invalidates both** — stop and report, the refusal is costing a capture 1.0.0 accepted (`docs/COMPLETED.md:905`)
+- [ ] Two files confirms Ψ-W1-T1 and Ψ-W3-T1 at once; **one summed file invalidates both** — stop and report, the refusal is costing a capture 1.0.0 accepted (`docs/COMPLETED.md` §"None of the seven is DAW-verified")
-- [ ] Then walk the rest of `docs/verify-track-scope-multitrack.md` (§1–§2, §4–§7) for the multi-track refusal itself (`docs/COMPLETED.md:898`)
+- [ ] Then walk the rest of `docs/verify-track-scope-multitrack.md` (§1–§2, §4–§7) for the multi-track refusal itself (`docs/COMPLETED.md` §"Ψ-W3-T1")
 
 ## Capture range and bounds
 
-- [ ] Over an item much longer than the selection: item scope × time selection, and item scope × razor — each lands exactly the window, not the whole item (`docs/COMPLETED.md:844`)
+- [ ] Over an item much longer than the selection: item scope × time selection, and item scope × razor — each lands exactly the window, not the whole item (`docs/COMPLETED.md` §"Ψ-W1-T1")
-- [ ] Same source: track scope × time selection, and track scope × razor — same exact window (`docs/COMPLETED.md:844`)
+- [ ] Same source: track scope × time selection, and track scope × razor — same exact window (`docs/COMPLETED.md` §"Ψ-W1-T1")
-- [ ] One razor-union case (two disjoint areas, one track) — lands the requested window, no `ReaSampler capture failed:` line (`docs/COMPLETED.md:852`)
+- [ ] One razor-union case (two disjoint areas, one track) — lands the requested window, no `ReaSampler capture failed:` line (`docs/COMPLETED.md` §"Ψ-W1-T1")
-- [ ] Capture an item whose extent already equals the window — still lands, unchanged (the byte-identity regression floor) (`docs/COMPLETED.md:849`)
+- [ ] Capture an item whose extent already equals the window — still lands, unchanged (the byte-identity regression floor) (`docs/COMPLETED.md` §"Ψ-W1-T1")
 - [ ] **The millisecond floor — SETTLED, nothing to re-run for `TailMode::None`.** The floor lives in the custom-time-bounds field (`RENDER_BOUNDSFLAG=0`), not in the render engine. Two live 48 kHz `TailMode::None` renders on `RENDER_BOUNDSFLAG=2` (time selection, handed over via `GetSet_LoopTimeRange`) came back exact — 97627 frames against 97627 — the second over a window whose START carried a sub-millisecond remainder, with no floored model of that window able to reproduce the count. Time selection is now the only bounds mode a capture can reach; the console verdict line and the `RENDER_STARTPOS`/`ENDPOS` read-back probe that answered this are gone. Full observation: `src/core/capture/render_settings.h`'s `kRenderBoundsTimeSelection`
 - [ ] **Still open — Auto and Manual tail.** `checkRenderedBounds` judges `TailMode::None` only (Auto/Manual add frames by design), so the settled result covers those two by INFERENCE, not observation, and the inference rests on an unverified PREMISE too: that the (retired) floor applied to the bounds identically across all three tail modes, and that all three now hand the window over the same way. Neither is measured — both live short renders that settled the bounds mode were `TailMode::None`; no Auto or Manual capture has been observed at all. **On Auto/Manual, the ONLY automatic check left is the 0-byte gate (`checkRenderedFileNotEmpty`)** — there is no automatic bounds signal for those two modes at all until this bullet is closed by hand. What would establish it: repeat an off-grid-start capture at **Manual** over a source that is loud right to the window's end, and check the landed file's frames against window + `tailMs` — a floored edge shows up in that count. **Auto** cannot be checked by count (it trims trailing silence), so it needs the null test by ear/inversion against the source instead
 - [ ] `[verify — DAW]` A tail is assumed to render PAST the window end — the SDK header (`:3048`) confirms only that `RENDER_TAILMS` is a length in ms, not that it extends past the end. If that assumption is wrong, a tail capture is silently SHORTER than its window with no detector at all. Report whether either tail capture comes up short against the source
@@ -34,30 +34,30 @@ Checks for Θ, Ξ, Ψ, Ε, and Ρ work that no unit test can close. Build **Rele
 
 ## Names and channels
 
-- [ ] Capture from a named track — the card reads `<Track> MM-DD HHMM`; capture again the same minute and the second carries an ordinal (`docs/COMPLETED.md:882`)
+- [ ] Capture from a named track — the card reads `<Track> MM-DD HHMM`; capture again the same minute and the second carries an ordinal (`docs/COMPLETED.md` §"Ψ-W2-T1")
-- [ ] Capture from an unnamed track, and from a multi-item selection — both readable, `+N` present on the multi (`docs/COMPLETED.md:882`)
+- [ ] Capture from an unnamed track, and from a multi-item selection — both readable, `+N` present on the multi (`docs/COMPLETED.md` §"Ψ-W2-T1")
-- [ ] Load a named capture into ReaSampler 9000 — the same name shows there (`docs/COMPLETED.md:881`)
+- [ ] Load a named capture into ReaSampler 9000 — the same name shows there (`docs/COMPLETED.md` §"Ψ-W2-T1")
-- [ ] The card label stays legible over its scrim at every card size (`docs/COMPLETED.md:883`)
+- [ ] The card label stays legible over its scrim at every card size (`docs/COMPLETED.md` §"Ψ-W2-T1")
-- [ ] Capture a dead-center mono source — the `.wav` is roughly half the size of the equivalent stereo capture (`docs/COMPLETED.md:887`)
+- [ ] Capture a dead-center mono source — the `.wav` is roughly half the size of the equivalent stereo capture (`docs/COMPLETED.md` §"Ψ-W2-T2")
-- [ ] Insert that collapsed file on a stereo track and null it against the source — confirms REAPER sums a 1-channel item at unity (`docs/COMPLETED.md:891`)
+- [ ] Insert that collapsed file on a stereo track and null it against the source — confirms REAPER sums a 1-channel item at unity (`docs/COMPLETED.md` §"Ψ-W2-T2")
-- [ ] Capture a true-stereo source — stays 2-channel, and both it and the collapsed file load into the instrument correctly (`docs/COMPLETED.md:889`)
+- [ ] Capture a true-stereo source — stays 2-channel, and both it and the collapsed file load into the instrument correctly (`docs/COMPLETED.md` §"Ψ-W2-T2")
 
 ## Mode switching
 
-- [ ] Solo tracks in Arrange, switch to Design, solo different tracks, switch back — each mode restores its own solo set verbatim (`docs/COMPLETED.md:864`)
+- [ ] Solo tracks in Arrange, switch to Design, solo different tracks, switch back — each mode restores its own solo set verbatim (`docs/COMPLETED.md` §"Ψ-W1-T2")
-- [ ] Attempt a mode switch while the transport is playing, then while recording — both refuse, visibly (`docs/COMPLETED.md:859`)
+- [ ] Attempt a mode switch while the transport is playing, then while recording — both refuse, visibly (`docs/COMPLETED.md` §"Ψ-W1-T2")
-- [ ] Click the footer mode segment, save, reopen the project — the mode persisted (`docs/COMPLETED.md:861`)
+- [ ] Click the footer mode segment, save, reopen the project — the mode persisted (`docs/COMPLETED.md` §"Ψ-W1-T2")
 
 ## Actions and drops
 
-- [ ] Add the import action to a Media Explorer toolbar and fire it from there — it imports (`docs/COMPLETED.md:867`)
+- [ ] Add the import action to a Media Explorer toolbar and fire it from there — it imports (`docs/COMPLETED.md` §"Ψ-W1-T3")
-- [ ] Fire the existing Main-section import binding — still works (`docs/COMPLETED.md:869`)
+- [ ] Fire the existing Main-section import binding — still works (`docs/COMPLETED.md` §"Ψ-W1-T3")
-- [ ] Unload/reload (restart REAPER) — no duplicate Media Explorer entry in the action list (`docs/COMPLETED.md:870`)
+- [ ] Unload/reload (restart REAPER) — no duplicate Media Explorer entry in the action list (`docs/COMPLETED.md` §"Ψ-W1-T3")
-- [ ] Drag one card across the arrange, over an FX window, over the TCP/MCP and back — cue changes per surface, every transition reverses (`docs/COMPLETED.md:875`, `docs/COMPLETED.md:876`)
+- [ ] Drag one card across the arrange, over an FX window, over the TCP/MCP and back — cue changes per surface, every transition reverses (`docs/COMPLETED.md` §"Ψ-W1-T4")
-- [ ] Drag fast, and drag onto a narrow TCP — target class still resolves; no release anywhere in REAPER is a silent no-op (`docs/COMPLETED.md:875`, `docs/COMPLETED.md:878`)
+- [ ] Drag fast, and drag onto a narrow TCP — target class still resolves; no release anywhere in REAPER is a silent no-op (`docs/COMPLETED.md` §"Ψ-W1-T4")
-- [ ] Drop a single card into the arrange — an item lands at the pointer's track and time (`docs/COMPLETED.md:877`)
+- [ ] Drop a single card into the arrange — an item lands at the pointer's track and time (`docs/COMPLETED.md` §"Ψ-W1-T4")
-- [ ] Drag-out to an external app twenty-plus times in a row — audio arrives every time; this is a soak, a single pass is not a gate (`docs/COMPLETED.md:109`)
+- [ ] Drag-out to an external app twenty-plus times in a row — audio arrives every time; this is a soak, a single pass is not a gate (`docs/COMPLETED.md` §"Θ-W1-T2" — "Neither acceptance criterion has actually been met yet")
-- [ ] Drop a capture onto an FX container — the instrument loads with that capture (`docs/COMPLETED.md:110`)
+- [ ] Drop a capture onto an FX container — the instrument loads with that capture (`docs/COMPLETED.md` §"Θ-W1-T2" — "Neither acceptance criterion has actually been met yet")
 
 ## Bank packages
 
@@ -65,48 +65,48 @@ Checks for Θ, Ξ, Ψ, Ε, and Ρ work that no unit test can close. Build **Rele
   export/import round trip: writes-one-file, the transfer itself, re-importing the
   same file never overwrites, the round trip back to the source, the too-new /
   truncated / mid-payload-corruption refusals (each an exact string), the
-  unsaved-project refusals, and drag-and-drop (`docs/COMPLETED.md:1126`)
+  unsaved-project refusals, and drag-and-drop (`docs/COMPLETED.md` §"Ε-W3-T1")
 - [ ] Force a degraded tracking ledger and confirm the import refuses **before the
   file picker opens**: save a project with a bank, close REAPER, edit the saved
   `.rpp`'s `owned_files` ext-state value inside its `<REASAMPLER ...>` block — corrupt
   the JSON for the `Unreadable` case, or bump `"v":2` to `"v":3` for the
   `FutureVersion` case — reopen the project, then run *ReaSampler: import bank
   package (.rsbank)*. Read off: the console prints the ledger-refusal block and no
-  file dialog ever appears (`src/core/tracking/origin_ledger.h:95,101`,
+  file dialog ever appears (`origin_ledger.h`'s `LedgerStatus` and `ledgerDegraded`,
-  `src/shell/actions/package_import_action.cpp:161-167`)
+  `package_import_action.cpp`'s `ledgerPermits`)
 - [ ] Export dialog: type a destination name with no extension, then again over a
   name that already carries a different one (e.g. `mybank.bak`) — read off whether
   `GetUserFileName` appended `.rsbank` itself or ReaSampler's own re-append produced
   the double-extension result (`mybank.bak.rsbank`) the code expects
-  (`src/shell/package/CLAUDE.md:112-122`)
+  (`src/shell/package/CLAUDE.md` §"Gotchas" — "The re-append is suffix-blind")
 - [ ] Both the export and the import file dialogs open in front of REAPER's main
   window, not behind it — `GetUserFileName` takes no owner window
-  (`src/shell/package/CLAUDE.md:110-112`)
+  (`src/shell/package/CLAUDE.md` §"Gotchas" — "`GetUserFileName` also takes no owner window")
 - [ ] With a ReaSampler 9000 instance's editor open on the destination project
   (Browse view visible), import a `.rsbank` from the docked panel — the browser
   reflects the new bank without closing or reopening the editor (the bank-generation
-  bump, `src/shell/persist/session.h:114-121`, polled by the instrument at
+  bump, `session.h`'s `bumpBankGeneration`, polled by the instrument at
-  `src/shell/instrument/processor_reload.cpp:444-475`)
+  `processor_reload.cpp`'s `pollBankSync`)
 - [ ] Drag two or more `.rsbank` files onto the docked panel in one drop — each lands
   as its OWN new bank, never merged into one, and if the tracking ledger is degraded
   the refusal prints ONCE for the whole drop rather than once per file
-  (`src/shell/panel/panel_window.cpp:63-94`)
+  (`panel_window.cpp`'s `handleDropFiles`)
 - [ ] Kill REAPER (or the process) partway through an import so a partial bank file
   is stranded under its real name in the bank folder, then re-run the same import
   into the same project — read off what happens. Whether the import verb should
   pre-clean that stale debris is an open question, not yet decided
-  (`src/shell/package/CLAUDE.md:102-108`)
+  (`src/shell/package/CLAUDE.md` §"Gotchas" — "A crash mid-export strands the `.rsbanktmp` sibling")
 
 ## The resample bake
 
-- [ ] Bake a dialed sound — the banked file sounds like what the editor was playing (`docs/COMPLETED.md:737`)
+- [ ] Bake a dialed sound — the banked file sounds like what the editor was playing (`docs/COMPLETED.md` §"Ξ-W2-T1" — "Not demonstrated")
-- [ ] Bake the result twice more — iteration composes, nothing is lost per pass (`docs/COMPLETED.md:737`)
+- [ ] Bake the result twice more — iteration composes, nothing is lost per pass (`docs/COMPLETED.md` §"Ξ-W2-T1" — "Not demonstrated")
-- [ ] Save and reopen after a bake — the instance still points at the baked capture (`docs/COMPLETED.md:737`)
+- [ ] Save and reopen after a bake — the instance still points at the baked capture (`docs/COMPLETED.md` §"Ξ-W2-T1" — "Not demonstrated")
-- [ ] Confirm no bake put an item in the arrange, and the superseded file is still on disk (`docs/COMPLETED.md:737`)
+- [ ] Confirm no bake put an item in the arrange, and the superseded file is still on disk (`docs/COMPLETED.md` §"Ξ-W2-T1" — "Not demonstrated")
-- [ ] Bake from an instance in a background project tab — refuses rather than writing into the wrong bank (`docs/COMPLETED.md:725`)
+- [ ] Bake from an instance in a background project tab — refuses rather than writing into the wrong bank (`docs/COMPLETED.md` §"Ξ-W2-T1" — "Two behaviors worth recording")
-- [ ] Load the VST with the extension not installed — the resample affordance reads unavailable, not silently lossy (`docs/COMPLETED.md:731`)
+- [ ] Load the VST with the extension not installed — the resample affordance reads unavailable, not silently lossy (`docs/COMPLETED.md` §"Ξ-W2-T1" — "Two behaviors worth recording")
-- [ ] After a bake: instance is in Trigger with start point reset, channel mode and preview velocity survived (`docs/COMPLETED.md:714`, `docs/COMPLETED.md:720`)
+- [ ] After a bake: instance is in Trigger with start point reset, channel mode and preview velocity survived (`docs/COMPLETED.md` §"Ξ-W2-T1" — "Reset-scope classifications made at review")
-- [ ] Gate mode + active sustain loop — "Bake Hold" appears within ~500 ms, its label fits its cell, its travel is duration-ordered (`docs/COMPLETED.md:806`)
+- [ ] Gate mode + active sustain loop — "Bake Hold" appears within ~500 ms, its label fits its cell, its travel is duration-ordered (`docs/COMPLETED.md` §"Ξ-W3-T1")
 
 ## Render in place
 
@@ -164,13 +164,13 @@ Checks for Θ, Ξ, Ψ, Ε, and Ρ work that no unit test can close. Build **Rele
 
 ## Instrument migration
 
-- [ ] Open a project saved before the zone retirement — the instance reopens on its first zone and sounds the same (`docs/COMPLETED.md:85`)
+- [ ] Open a project saved before the zone retirement — the instance reopens on its first zone and sounds the same (`docs/COMPLETED.md` §"Θ-W1-T1")
-- [ ] Such an instance with implicit channel mode + a stereo capture reopens **Stereo** — confirm that is acceptable by ear (`docs/COMPLETED.md:78`)
+- [ ] Such an instance with implicit channel mode + a stereo capture reopens **Stereo** — confirm that is acceptable by ear (`docs/COMPLETED.md` §"Θ-W1-T1")
 
 ## Look and feel
 
-- [ ] Sign off by eye in a live editor window: knob arcs, needles, envelope splines, waveform outline (`docs/COMPLETED.md:669`, `docs/COMPLETED.md:583`)
+- [ ] Sign off by eye in a live editor window: knob arcs, needles, envelope splines, waveform outline (`docs/COMPLETED.md` §"Θ-W7-T1", `docs/COMPLETED.md` §"Θ-W6-T1" — "Antialiasing pass")
-- [ ] Same pass for legibility: text sizes, arc weight, and whether the waveform stroke thickens the docked panel (`docs/COMPLETED.md:613`, `docs/COMPLETED.md:562`)
+- [ ] Same pass for legibility: text sizes, arc weight, and whether the waveform stroke thickens the docked panel (`docs/COMPLETED.md` §"Θ-W6-T1", `docs/COMPLETED.md` §"Θ-W6-T1" — "Sizing")
-- [ ] Piano strip at the 840 px default — keys tile uniformly, the 37 px end gutters read as acceptable (`docs/COMPLETED.md:219`)
+- [ ] Piano strip at the 840 px default — keys tile uniformly, the 37 px end gutters read as acceptable (`docs/COMPLETED.md` §"Θ-W2-T3")
-- [ ] Resize the editor across several widths — gutters stay symmetric, no key width jumps (`docs/COMPLETED.md:217`)
+- [ ] Resize the editor across several widths — gutters stay symmetric, no key width jumps (`docs/COMPLETED.md` §"Θ-W2-T3")
-- [ ] Set host/OS scaling to 150% then 200% — record how the strip and the AA strokes actually look (`docs/TODO.md:418`, `docs/COMPLETED.md:226`)
+- [ ] Set host/OS scaling to 150% then 200% — record how the strip and the AA strokes actually look (`docs/TODO.md` §"High-DPI host scaling is unverified (distinct from the antialiasing audit)", `docs/COMPLETED.md` §"Θ-W2-T3" — "Width uniformity is guaranteed in client pixels only")