Ψ-W2-T1 remediation: scrim the card name over the waveform, hedge two SDK claims, fix a UTF-8-truncation empty-label bug, file the legibility DAW deferral

src/shell/capture/capture_batch.cpp

@@ -401,6 +401,10 @@ void RunRecaptureFromSource(ReaSamplerSession& session)
     req.sampleRate   = recipe->sampleRate;
     req.channelCount = recipe->channelCount;
     req.bitDepth     = WavBitDepth::Float32;
+    // orig->displayName is the ORIGINAL capture's label (recapture preserves identity, it
+    // does not re-mint it — see this function's header comment), so the regenerated file's
+    // stem carries the original capture's stamp, not this render's — do not read it as a
+    // render timestamp.
     req.baseName     = orig->displayName.empty() ? "recapture" : orig->displayName;
     req.trackGuids   = recipe->trackGuids;
 

src/shell/capture/scope_resolve.cpp

@@ -7,6 +7,7 @@
 
 #include "shell/capture/scope_resolve.h"
 
+#include <cstring>     // strnlen — bounded read of GetTrackName's buffer
 #include <filesystem>  // project-dir derivation for provenance parent resolution
 #include <utility>
 
@@ -110,7 +111,9 @@ std::string trackName(MediaTrack* tr)
     // runs once per capture, not per frame.
     std::vector<char> buf(1024, '\0');
     if (!GetTrackName(tr, buf.data(), static_cast<int>(buf.size()))) return {};
-    return std::string(buf.data());
+    // Bounded construction: the SDK doesn't document NUL-termination within bufOut_sz, so
+    // strnlen over the whole buffer (never past it) rather than trusting one.
+    return std::string(buf.data(), strnlen(buf.data(), buf.size()));
 }
 
 // Reads every track's P_RAZOREDITS (SDK header ~2899: space-separated triples of

src/shell/capture/scope_resolve.h

@@ -58,10 +58,13 @@ bool resolveRange(double& start, double& end, std::string& why);
 // Collects the selected tracks (Track scope) into out.sourceTracks + GUIDs + names.
 bool collectSelectedTracks(ResolvedSource& out);
 
-// The track's display name, read-only. GetTrackName (SDK header ~3626) is used rather
-// than P_NAME because it already answers REAPER's own convention for an unnamed track
-// ("Track N"), which is exactly the deterministic fallback a capture label wants; P_NAME
-// would hand back an empty string instead. Empty only if the read itself fails.
+// The track's display name. GetTrackName (SDK header ~3626) is used rather than P_NAME
+// because it already answers REAPER's own convention for an unnamed track ("Track N"),
+// which is exactly the deterministic fallback a capture label wants; P_NAME would hand
+// back an empty string instead. `[verify]` the SDK header states neither that the read is
+// non-mutating nor what a `false` return means; the call site treats it as read-only and
+// treats `false` (or a `true` with an untouched buffer) the same way — an empty name, which
+// falls through to the scope literal fallback either way, so both readings are safe.
 // Callers that build a ResolvedSource by hand (batch capture) use this directly.
 std::string trackName(MediaTrack* tr);