instrument: deliver continuous playback params live to sounding voices via a seqlock block, holding normalized stage position across time edits

src/core/instrument/CLAUDE.md

@@ -154,6 +154,39 @@ pitch envelope/curve (AD?) which is off by default."*
 - **S15/S16 are Tier 0–1 engine features, not Tier 2/3** — do not let the held Tier-2
   feature list (velocity layers / round-robin / filter work) drive their build shape.
 
+### Live parameter delivery — a knob moves the note already sounding (settled 2026-07-30)
+
+Daniel's ruling, verbatim: *"hell no, I was going to bring that up for the other envelopes. We
+must live compute, latching the parameters at note on is not acceptable. long term these will be
+automatable parameters."* It rejects the precedent, not one instance of it.
+
+- **Which controls are live is ONE decision, recorded in ONE place** — `isLiveDeckParam`
+  (`ui/deck_groups`). Continuous playback controls go live: the six filter tone/modulation
+  knobs, and every stage time and stage level on all three envelopes. Everything else reloads
+  or drops to the voice-param rebuild. Two controls look continuous but are deliberately not
+  live — the pitch key-track and the velocity→cutoff depth feed values a voice latches at
+  note-on (the pitch ratio, the velocity-curve result), so making them live would retune or
+  re-gain a note already struck. The three capture-anchored overrides (root, loop span, start
+  frame) reload because they name positions in the decoded PCM.
+- **Ownership sits ABOVE every snapshot.** `SampleData::live` is a NON-OWNING pointer to the one
+  block the shell owns per instance; a block owned by a snapshot would leave the drain slot's
+  still-sounding voices deaf to the knob under them. A drain voice tracking the knob is the
+  DESIRED behaviour — it is the note the user is hearing.
+- **Null is the bare engine.** `live == nullptr` is byte-identical to the pre-live core, which
+  is why `sampler_core`'s regression baselines needed no change.
+- **Observation is at block boundaries, never per frame.** `VoiceEngine` reads the seqlock once
+  per `render()` and once per note-on; the per-sample path gained one predicted branch
+  (`filterRamping_`) and no indirection.
+- **The mid-stage rule is HOLD NORMALIZED STAGE POSITION** (Daniel's pick among six candidates):
+  φ = elapsed/duration is held across a stage-time change, so the level is continuous by
+  construction and the remainder takes its share of the new duration. Stated over normalized
+  position rather than output level ON PURPOSE, so a per-segment curve exponent composes with
+  it as a pure map of φ. Recomputing from absolute elapsed (which steps) is the rejected
+  alternative — do not reintroduce it.
+- **Two genuine level steps are smoothed, not ruled away**: a sustain level moved while the
+  voice holds it, and a stage duration dialled to exactly zero mid-stage. Both are absorbed by
+  the envelope's own bounded offset smoother.
+
 ### Non-goals / guardrails (instrument-specific; repo-wide invariants live in root CLAUDE.md)
 
 - **No cross-platform / multi-format.** Windows-only, VST3-only, REAPER-only (D5). Do not
@@ -199,7 +232,8 @@ slider couldn't. Two pure modules split the forward (draw) and inverse (edit) ma
 
 - The engine is the `sampler_core` CMake target over FOUR headers and TWO TUs, split on its own responsibility seam — cold note routing vs the hot per-sample render:
   - `play_params.h` — the value layer: `PlayParams`/`AdsrParams`/`TriggerParams`/`PitchEnvParams`/`FilterParams`, the per-instance mode enums (`ChannelMode`/`VoiceMode`/`MonoTrigger`), and `SampleData` (the ONE loaded capture: decoded PCM + root + loop + start + keyTrack + velocity curve + play params). Shared by the engine, the codec, and the editor, so a UI/codec TU reading a param struct doesn't recompile when a `Voice` member changes. `FilterParams` stores the filter module's own `FilterSettings` by value rather than a parallel copy of its normalized positions.
-  - `envelopes.h` — the three per-frame evaluators (`AdsrEnvelope` AHDSR, `TriggerEnvelope` fade shape, `PitchEnvelope` AD offset), CONCRETE and fully header-inline. Never give them a common base or a virtual `tick()`: they are called per-voice-per-sample. The filter envelope is a SECOND `AdsrEnvelope` instance on the voice, not a fourth class.
+  - `envelopes.h` — the three per-frame evaluators (`AdsrEnvelope` AHDSR, `TriggerEnvelope` fade shape, `PitchEnvelope` AD offset), CONCRETE and fully header-inline. Never give them a common base or a virtual `tick()`: they are called per-voice-per-sample. The filter envelope is a SECOND `AdsrEnvelope` instance on the voice, not a fourth class. `AdsrEnvelope`/`PitchEnvelope` also own `applyLive` (the φ-holding mid-stage rule) and `StepSmoother`, the bounded offset that absorbs the two level steps φ cannot cover.
+  - `live_params.h` / `live_params.cpp` — the live-parameter block: `LiveValues` (the plain, trivially-copyable bundle the audio thread observes), the single-writer `LiveParams` seqlock that publishes it without a lock or a torn read, `foldLive` (the ONE derivation from `PlayParams` — every publisher goes through it so the two representations cannot drift), and `ValueRamp`, the per-frame glide whose EXACT termination is what lets the filter's equality-compare cutoff skip re-engage. Links no engine: the block is a value the voice observes, not a thing the engine owns.
   - `voice.h` / `voice.cpp` — one voice. The per-SAMPLE render half (`advanceFrame` and everything it calls) is INLINE IN THE HEADER by RT constraint; the per-NOTE half (note-on setup incl. the Preserve ring prime, legato retune, gate-off, the off-thread shifter presize) is out of line in the TU. The voice owns its own `VoiceFilter` and filter envelope, run between the pitch stage and the amp multiply — see `engine/filter/CLAUDE.md`.
   - `voice_engine.h` / `voice_engine.cpp` — `VoiceEngine`: note routing, bounded-stealing allocation, user-parameterized voice count (1–32, default 16), `VoiceMode` Poly/Mono (last-note held-note stack, `MonoTrigger` Retrigger/Legato), two-tier panic (CC 123 = all-notes-off release, CC 120 = immediate hard-stop including Trigger one-shots), and the block render loops. Preview injects a synthetic note-on at the loaded capture's root note into the main `VoiceEngine` — no dedicated `PreviewCard`; preview obeys polyphony/mono/voice-stealing/envelopes.
 - `pitch_shift` — hand-rolled **correlation-aligned SOLA** (splice-overlap-add) pitch shifter for the Preserve playback mode: one active read tap chases the write head at the shift ratio; each splice jump is refined by a cross-correlation search so the new read point is waveform-aligned, then old and new taps are crossfaded (raised-cosine, amplitude-complementary). Replaces the prior dual-tap OLA whose fixed half-window tap offset caused anti-phase cancellation on many source frequencies. **GA2:** ring buffer **primed with the actual upcoming source** at note-on (was zero-filled) → gap-free frame-0 onset, ~25 ms Preserve onset latency eliminated (Preserve now speaks on frame 0, matching Varispeed), and real-content-bounded tail (last-window tail-truncation gone). No third-party dependencies; RT-discipline: no allocation in `process()`.
@@ -227,7 +261,7 @@ slider couldn't. Two pure modules split the forward (draw) and inverse (edit) ma
 - `param_slider` — parameter control-panel: vertical stack of TOGGLE (two-segment selector) and SLIDER (horizontal track) rows; maps normalized value to/from handle pixel.
 - `embed_strip` — compact single-row control layout for embed mode in the track FX chain.
 - `knob_deck` — pure knob-deck layout + hit-test (FB1): group-box / caption-row / compact-toggle / knob-cell geometry, deterministic whole-group wrap, `DeckLayout` / `DeckHit`. Mirror of `action_bar`/`param_slider`; no LICE or REAPER types.
-- `deck_groups` — WHICH groups the Sample face's deck carries, split from `knob_deck`'s HOW they lay out: the `DeckParam` control-id space (the editor's `ParamControl` is an alias of it), the `DeckGroupId` list, `sampleDeckGroups` in signal-flow order (**pitch → filter → amp**, then voice/master), and the deck's bipolar-knob law. Reads `PlayMode` for the AMP group's Gate/Trigger face, which is why this and not `knob_deck` is the module that touches the engine's value layer.
+- `deck_groups` — also home to `isLiveDeckParam`, the editor's commit-tier routing predicate (see "Live parameter delivery" above); WHICH groups the Sample face's deck carries, split from `knob_deck`'s HOW they lay out: the `DeckParam` control-id space (the editor's `ParamControl` is an alias of it), the `DeckGroupId` list, `sampleDeckGroups` in signal-flow order (**pitch → filter → amp**, then voice/master), and the deck's bipolar-knob law. Reads `PlayMode` for the AMP group's Gate/Trigger face, which is why this and not `knob_deck` is the module that touches the engine's value layer.
 - `curve_popup` — pure curve-popup geometry + dismissal test (FB1): centered sheet over the Sample face — width/height clamps, title row, Close button rect, curve-box rect, outside-sheet dismissal test. Mirror of `overflow_menu`; no LICE or REAPER types.
 - `envelope_overlay` — pure amp-envelope→polyline geometry for the Sample-view envelope overlay (read from `envelope_overlay.h`): maps Gate's AHDSR shape or Trigger's fade-in/unity/%-length/fade-out shape to a polyline inside a rect at the shared time base (Gate: a bounded param-domain schematic, sample-length-free; Trigger: PCM-aligned wall-clock), every vertex clamped in-canvas (`x`/`y` inside the rect). Shares the `EnvNode`/`AmpEnvelope`/`timeToX`/`levelToY` vocabulary with `envelope_edit` so the drawn handle and its grab region agree pixel-for-pixel. No VST3/REAPER/LICE types at the boundary.
 - `envelope_edit` — pure node hit-test + pixel-delta→clamped-param inverse map for the draggable envelope nodes (read from `envelope_edit.h`): `nodeAtPoint` resolves a grab to the nearest node within a pick radius (Chebyshev distance, draw-order tie-break); `resolveNodeDrag` maps a pixel delta since grab to a new `AmpEnvelope`, enforcing monotonic-in-time ordering between neighbouring nodes and the same caller-supplied per-param clamp bounds the sliders use — a drag can never produce a param a slider couldn't. Mirror of `card_drag`/`waveform_view`; the inverse of `envelope_overlay`'s params→polyline forward map, so node-drag and slider-edit read/write one shared model and can never diverge.
@@ -243,6 +277,16 @@ slider couldn't. Two pure modules split the forward (draw) and inverse (edit) ma
   Channel-mode (D-E) bus-renegotiation design and the earlier Preserve-onset-latency
   framing in the S16 guardrails. Root `CLAUDE.md` is the current source of truth
   for both — do not reintroduce either superseded design.
+- **A filter envelope only advances while its depth is non-zero.** `tickFilterCutoff`'s exact
+  skip at `modAmount == 0` skips the envelope tick along with the solve, so dialling depth up
+  mid-note starts the envelope from the note's stage-0 position rather than from where it would
+  have been. Continuous either way (the contribution starts at 0), and keeping the skip is what
+  holds the at-rest per-sample path byte-identical — but don't read a live depth move as
+  "resuming" an envelope that was never running.
+- **A live edit leaves the snapshot's own `sample.play` stale, on purpose.** The block, not the
+  snapshot, is the audio thread's source; a new voice latches the stale copy and is corrected by
+  `applyLive(snap)` before its first frame. The persisted `params_` is written by the same
+  commit, so `getState` is never stale.
 - **`keyboard_strip`'s width-uniformity guarantee is client-pixel only.** Its test sweep
   covers client-pixel widths (including multiples standing in for larger client areas);
   nothing in the instrument implements `IPlugViewContentScaleSupport`, so host-side DPI