fix(ingest): convert-on-import to 32f WAV, undo-group bank+assign, overflow guards

Non-WAV sources decode via PCM_source::GetSamples and land as canonical 32f
RIFF/WAVE; hash taken post-conversion so re-imports dedup. Undo block covers
bank mutation + assign_request atomically. Overflow guards + adversarial tests.

src/assignment_request.h

@@ -75,6 +75,15 @@ std::string encodeAssignmentRequest(const AssignmentRequest& req);
 // malformed / truncated / trailing-garbage input (never UB, never a partial value) —
 // the reader shell treats absence/malformed as "no pending request." Round-trips:
 // decodeAssignmentRequest(encodeAssignmentRequest(x)) == x.
+//
+// READER REQUIREMENT (instrument-side, S8 follow-up dispatch): after successfully
+// decoding a request, the reader MUST verify that (bankId, sampleId) resolves to an
+// existing sample before acting on it. An undo on the extension side rolls back the
+// `banks` ext-state key (removing the sample) but cannot atomically clear the
+// `assign_request` key if the write happened outside the undo block. Even with the
+// undo-grouping fix (Major 2), the reader must guard against this: treat an
+// unresolvable (bankId, sampleId) pair as a stale/no-op request and discard it
+// silently, never crashing or selecting a nonexistent entry.
 std::optional<AssignmentRequest> decodeAssignmentRequest(const std::string& wire);
 
 } // namespace reasampler