capture: state the bounds tolerance as empirical, refuse unmeasurable renders, keep refused ones for diagnosis

The one-frame bound is not provable for a per-edge renderer; the test now shows where it breaks. Refused renders move out of the bank instead of being deleted, so the DAW experiment has something to read.

src/core/capture/CLAUDE.md

@@ -52,7 +52,7 @@ Detail specific to these pure modules:
 - `capture_name` — the REAPER-free composition of one capture's label + file-stem base from its source-track name(s), a local-calendar discriminator (`MM-DD HHMM`, from the shell's clock read), and an optional batch ordinal. The label and the stem deliberately diverge: the stem still passes through `capture_paths::sanitizeStem` (so a name that sanitizes to nothing files as `capture`), while the label keeps the source name verbatim. Stem uniqueness stays entirely `makeUniqueTag`'s — this module never disambiguates.
 - `insert_plan` — the REAPER-free logic behind the `insert` shell (M6): computes the `InsertMedia` `mode` bitmask from an `InsertOptions` struct (placement target, tempo-conform ratio, preserve-pitch flag), guaranteeing the &4 stretch-to-time-selection bit is never set and that no tempo bits are set when `conform == None`.
 - `render_settings` — the REAPER-free logic behind the capture action family: `SourceMode` → `RENDER_SETTINGS` bit mapping, `P_RAZOREDITS` string parsing + range-union bounds, razor-else-time range inference, the FX-scope bypass plan (`fxBypassPlanFor`), the tail-mode → `RENDER_TAILFLAG`/`RENDER_NORMALIZE`/`RENDER_TRIMEND` mapping (`tailRenderSettingsFor`) and its realtime-window analog (`realtimeRecordWindowEnd`), the capture-action taxonomy table (`captureActionTable`) `main.cpp` iterates to register the CAPTURE_ITEM/CAPTURE_TRACK family, and `renderSourceLabel` (the source named in the offline backend's bounds refusal).
-- `render_window` — the REAPER-free frame arithmetic behind exact capture bounds: `frameCountFor` (the frame count a project-time window occupies at the project rate — the number the offline backend checks the rendered file against before landing it, so a render that printed something other than the window is refused rather than banked), `renderHonoredBounds` (the gate's verdict and the sole home of its one-frame tolerance and the derivation behind it), and `itemExtentPrintsWindow`, the predicate `render_settings::sourceModeForScope` consults to decide whether REAPER's selected-items render source can express a requested window at all.
+- `render_window` — the REAPER-free frame arithmetic behind exact capture bounds: `frameCountFor` (the frame count a project-time window occupies at the project rate — the number the offline backend checks the rendered file against before landing it, so a render that printed something other than the window is refused rather than banked), `renderHonoredBounds` (the gate's verdict and the sole home of its one-frame tolerance, which is empirical rather than proven — the header states which renderer models it covers and which it does not), and `itemExtentPrintsWindow`, the predicate `render_settings::sourceModeForScope` consults to decide whether REAPER's selected-items render source can express a requested window at all.
 - `track_topology` — the REAPER-free folder arithmetic over a project's flat `I_FOLDERDEPTH` delta list: `directChildIndices` names a folder parent's DIRECT children, the set `shell/capture/render_isolation` silences so a ranged item capture does not print its track's children. Grandchildren are excluded by construction — they reach the parent only through the child that owns them.
 - `tail_control` — the REAPER-free logic behind the docked `bank_panel`'s tail-mode toggle: the cycle order (None → Auto → Manual → None), the Manual-length clamp/scroll-wheel fine-adjust (`clampManualMs`/`adjustManualMs`, 250 ms/notch, 2000 ms default), the toggle's label text (e.g. "Tail: Manual 2.0s"), and the `TailSetting` JSON round-trip persist stores per-project.
 

src/core/capture/render_settings.cpp

@@ -102,8 +102,10 @@ RenderSettingsChoice renderSettingsFor(SourceMode mode, double /*wetDry*/) {
 
 const char* renderSourceLabel(SourceMode mode) {
     switch (mode) {
-        case SourceMode::MasterMix:      return "master mix";
-        case SourceMode::TimeSelection:  return "master mix (time selection)";
+        // MasterMix and TimeSelection share this label because they ARE the same
+        // render — see the header.
+        case SourceMode::MasterMix:
+        case SourceMode::TimeSelection:  return "master mix";
         case SourceMode::SelectedTracks: return "selected tracks via master";
         case SourceMode::SelectedItems:  return "selected media items";
         case SourceMode::RazorArea:      return "razor edits";

src/core/capture/render_settings.h

@@ -100,7 +100,12 @@ RenderSettingsChoice renderSettingsFor(SourceMode mode, double wetDry);
 // bounds refusal: the two ways a render can miss its window — a source that
 // derives its own bounds (selected items, razor edits) versus a time-bounded
 // render that came up short — are indistinguishable from a frame count alone,
-// and naming the source is what tells them apart in a bug report.
+// and naming the source is what tells them apart in a bug report. Quoted verbatim
+// in docs/VERIFICATION.md, which asks for this exact line back.
+//
+// MasterMix and TimeSelection deliberately answer the SAME words: they map to the
+// same RENDER_SETTINGS value and every capture renders custom-time-bounded, so
+// naming them apart would assert a render distinction that does not exist.
 const char* renderSourceLabel(SourceMode mode);
 
 // --- Capture scope: the FX-scope invariant ------------------------------------

src/core/capture/render_window.h

@@ -13,21 +13,21 @@ namespace reasampler::capture {
 // Returns 0 for a non-positive rate or an empty/inverted window.
 //
 // The offline backend compares this against the rendered file's own frame count, so
-// exact-bounds failures surface as a refused capture rather than a wrong file. That
-// REAPER resolves the two edges the same way is UNVERIFIED — a DAW pass decides
-// whether the equality is exact or off by a frame.
+// exact-bounds failures surface as a refused capture rather than a wrong file.
 long long frameCountFor(double startSeconds, double endSeconds, int sampleRate);
 
 // True when a landed render's frame count is consistent with `frameCountFor`'s
-// answer for the same window. Tolerates a one-frame difference, and exactly one:
-// frameCountFor rounds EACH edge, so it sits within a frame of the window's
-// real-valued length (end-start)*rate — and a renderer that floors, ceils or
-// rounds that same length sits within a frame of it too, so two integers derived
-// that way can never be more than one apart. A window whose edges do not land on
-// frame boundaries therefore cannot produce a larger difference; anything larger
-// is a render that printed something other than the window asked for, whatever
-// the alignment. Widening this past one frame retires the exact-bounds invariant
-// rather than relaxing it — do not.
+// answer for the same window. Tolerates a one-frame difference, and exactly one.
+//
+// That bound is EMPIRICAL. It is provable only for renderer models that derive the
+// count from the window's LENGTH (floor/ceil/round of (end-start)*rate) or resolve
+// both edges by the SAME convention; a renderer that resolves the start edge and the
+// end edge by DIFFERENT conventions can legitimately sit TWO frames from this answer
+// (tests/test_render_window.cpp pins both facts). Which model REAPER uses is
+// unverified, so a refusal one or two frames wide may be this gate's fault rather than
+// the render's — the open DAW question in docs/VERIFICATION.md §Capture range and
+// bounds. Widening past one frame retires the exact-bounds invariant rather than
+// relaxing it, and is not a fix to reach for before that question is answered.
 bool renderHonoredBounds(long long expectedFrames, long long actualFrames);
 
 // True when a render bounded by the selected items' own extent