Bound the automation hold to the window the model has not caught up on, and make that authority model stated, enforced and tested

src/shell/instrument/processor_state.cpp

@@ -168,6 +168,17 @@ InstrumentParams ReaSamplerProcessor::instrumentParams() {
     return params_;
 }
 
+std::uint32_t ReaSamplerProcessor::instrumentParamsGeneration() {
+    std::lock_guard<std::mutex> lock(paramsMutex_);
+    return paramsGeneration_;
+}
+
+InstrumentParams ReaSamplerProcessor::instrumentParams(std::uint32_t& generation) {
+    std::lock_guard<std::mutex> lock(paramsMutex_);
+    generation = paramsGeneration_;
+    return params_;
+}
+
 void ReaSamplerProcessor::setInstrumentParams(const InstrumentParams& params) {
     // The exposed values alone, not the whole set: this funnel fires per mouse move on every live
     // knob and node drag, and InstrumentParams owns seven vectors — copying all of them to diff
@@ -179,6 +190,9 @@ void ReaSamplerProcessor::setInstrumentParams(const InstrumentParams& params) {
             before[static_cast<std::size_t>(row.deck)] = modelParamNormalized(params_, row.deck);
         }
         params_ = params;
+        // Bumped inside the lock with the write it names, so a reader taking the pair together
+        // can never see a generation that does not describe the set beside it.
+        ++paramsGeneration_;
     }
     // Every writer of the parameter set — setState, the editor's commits, the bake's adopt —
     // funnels through here, so mirroring the limiter flag at this one point is what keeps the