Q-W0 code-review remediation: pitch_shift follower self-heal, T3-03 rate bail, doc/comment riders

src/provenance.cpp

@@ -140,6 +140,9 @@ public:
 
 private:
     bool fail() { ok_ = false; return false; }
+    // TODO(Q-W1): strtol does not check errno/range here, so an out-of-range field narrows
+    // silently to LONG_MAX (then truncates into `int`) instead of failing parse. Flagged for
+    // the Q-W1 wire-codec collapse rather than fixed in place.
     static bool toInt(const std::string& f, int& out) {
         const char* b = f.c_str();
         char* end = nullptr;

src/vst/pitch_shift.cpp

@@ -201,8 +201,9 @@ void PitchShifter::splice(std::int64_t nominalJump, double delay) {
     // search (and the +/-1-lag parabolic refinement calls at bestLag ± 1, and the interpolator's
     // read-ahead) can touch is delay d + jump + maxLag + 2 (maxLag from the coarse/fine search,
     // +1 for the parabola's outer ± 1 probe, +1 for the interpolator's i1 = i0+1 read-ahead),
-    // so the tight cap is filled_ - d - maxLag_ - 2. The code uses - 1 here — one sample of
-    // conservative margin, never out-of-range. In steady state (filled_ == ringLen_) this is
+    // so the tight cap is filled_ - d - maxLag_ - 2. The code uses - 1 here — one sample LOOSER
+    // than that derived cap (not extra margin); ring indexing wraps via modulo everywhere, so
+    // this never runs off the physical ring_ array. In steady state (filled_ == ringLen_) this is
     // > window_ and the nominal jump is untouched; near a primed onset it shrinks the jump to
     // what real history exists (still many source periods with a full-window prime). The floor of
     // 1 is only reachable on the documented degenerate reset-without-prime path — garbage-tolerant.
@@ -375,7 +376,28 @@ AudioSample PitchShifter::processImpl(AudioSample in, const SpliceEvent* linked)
         //     master channel did this frame. Lockstep state means our own trigger would have
         //     fired on the same frame; applying the master's decision keeps the two rings
         //     sample-aligned (one shared lag, one shared schedule).
-        if (linkedEv.fired) applySplice(linkedEv);
+        if (linkedEv.fired) {
+            applySplice(linkedEv);
+        } else {
+            // Self-healing fallback (review rider): the master not firing normally means this
+            // channel's own trigger wouldn't fire either (lockstep). But if the processor ever
+            // renders a mono block mid-note, this follower channel is skipped for that block
+            // while the master keeps advancing — its writePos_/filled_ falls behind and, with
+            // only the `if (linkedEv.fired)` path above, could never resync. So check this
+            // follower's OWN tap distance against the safe band and splice via its own search
+            // when it has left [dLow_, dHigh_], exactly as the master would. Reuses splice() —
+            // no allocation, no new RT cost. In the normal (non-mono-block) case this branch
+            // never triggers: the master's trigger fires first and this whole `if` is false.
+            double d = static_cast<double>(writePos_) - posA_;
+            const double len = static_cast<double>(ringLen_);
+            while (d < 0.0) d += len;
+            while (d >= len) d -= len;
+            if (d <= static_cast<double>(dLow_)) {
+                splice(+window_, d);
+            } else if (d >= static_cast<double>(dHigh_)) {
+                splice(-window_, d);
+            }
+        }
     } else {
         // 3. Splice scheduling: relocate when the active tap's delay leaves the safe band.
         //    Up-shifts (ratio > 1) drain the delay toward 0 -> jump one window OLDER; down-

src/vst/reasampler_editor.cpp

@@ -405,10 +405,14 @@ double clamp01(double v) { return v < 0.0 ? 0.0 : (v > 1.0 ? 1.0 : v); }
 double ReaSamplerEditor::controlValue(int id, const ZonePlaySeconds& play) const {
     // Wall-clock seconds -> normalized over the seconds ceiling; source frames -> normalized over
     // the rate-resolved frames ceiling (T3-03). Two domains, kept explicit so neither leaks a rate.
+    // A stored fade exceeding fadeMaxFrames() at the current host rate reads as norm 1.0 (clamp01
+    // pins it) and gets rewritten down on the next knob touch — deliberate, matching the old
+    // fixed-ceiling clamp behavior in kind, just rate-dependent now instead of fixed at 88200.
     const double fadeMax = fadeMaxFrames();
     const auto secToNorm = [](double s) { return clamp01(s / kEnvTimeMaxSeconds); };
     const auto framesToNorm = [fadeMax](std::int64_t f) {
-        return clamp01(static_cast<double>(f) / fadeMax);
+        // Ceiling unavailable (rate not yet known): inert until fadeMaxFrames() resolves.
+        return fadeMax > 0.0 ? clamp01(static_cast<double>(f) / fadeMax) : 0.0;
     };
     switch (static_cast<ParamControl>(id)) {
         case ParamControl::kPlayMode:      return play.playMode == PlayMode::Trigger ? 1.0 : 0.0;
@@ -435,7 +439,9 @@ void ReaSamplerEditor::applyControl(int id, ZonePlaySeconds& play, double value,
                                     int segment) const {
     const double fadeMax = fadeMaxFrames();  // T3-03: rate-resolved knob full-scale
     const auto normToSec = [](double v) { return clamp01(v) * kEnvTimeMaxSeconds; };
-    const auto normToFrames = [fadeMax](double v) {
+    const auto normToFrames = [fadeMax](double v) -> std::int64_t {
+        // Ceiling unavailable (rate not yet known): inert until fadeMaxFrames() resolves.
+        if (fadeMax <= 0.0) return 0;
         return static_cast<std::int64_t>(clamp01(v) * fadeMax + 0.5);
     };
     switch (static_cast<ParamControl>(id)) {
@@ -476,12 +482,14 @@ double ReaSamplerEditor::fadeMaxFrames() const {
     // T3-03: the Trigger-fade knob's full-scale throw is kFadeMaxSeconds (2 s wall-clock)
     // resolved against the live rate — the SAME time base the envelope overlay already uses
     // to place these source-frame fades on screen (totalSeconds = frames / liveSampleRate()),
-    // and the rate captures are made at (the capture path renders at the project rate). The
-    // 44.1 kHz fallback covers the pre-setupProcessing window (rate still 0) and reproduces
-    // the legacy 88200-frame ceiling there. Storage stays SOURCE FRAMES — this resolves the
-    // UI ceiling only.
+    // and the rate captures are made at (the capture path renders at the project rate).
+    // Pre-setupProcessing the rate is still 0: rather than substitute a literal rate (the
+    // exact residue T3-03 removed), bail the same way paintEnvelopeOverlay does (~line 1396) —
+    // callers treat a <= 0 return as "ceiling unavailable yet" and degrade the knob to inert
+    // rather than guess a rate. Storage stays SOURCE FRAMES — this resolves the UI ceiling only.
     const double rate = liveSampleRate();
-    return kFadeMaxSeconds * (rate > 0.0 ? rate : 44100.0);
+    if (rate <= 0.0) return 0.0;
+    return kFadeMaxSeconds * rate;
 }
 
 double ReaSamplerEditor::previewVelocity01() const {