Fix spline-drag rollback, bake contour leak, held-note live miss, amp clamp

Editor close mid-drag now rolls back published contours like capture-loss does; bake detaches liveContours so a printed capture can't observe a live drag; a held note now receives a live publish that lands in the same block as a note-on; amp spline read clamped to [0,1].

src/shell/instrument/CLAUDE.md

@@ -91,8 +91,9 @@ else — no parameter set, no generation, no host callback — and its release i
 host-facing reader needs the model to carry it mid-gesture; it is what keeps a motion event off
 the host entirely (an unlatched `setInstrumentParams` opens a group edit even when nothing
 exposed moved). `reloadInstrument` republishes the model's contours, so a release, a click-edit
-(add/delete/hard) and a restore all reach the voices through the reload; capture-lost, the one
-exit that commits nothing, re-couriers the restored `params_`.
+(add/delete/hard) and a restore all reach the voices through the reload; capture-lost and the
+editor closing mid-drag (`removedFromParent`) are the two exits that commit nothing — both
+re-courier the restored `params_`.
 
 **The VST3 parameter surface is a THIRD surface onto the one model, never a second copy.** The
 pure half — the frozen id table, the exposed set, the plain-value layer, the formatter — is
@@ -241,13 +242,19 @@ against a performance budget — they are there because `VoiceEngine::applyLiveT
 
 ## Gotchas
 
-- **`reasampler_processor.h` no longer needs a ceiling exception, and the one it had rested on a
-  false premise.** It was described as ONE class declaration; it also carried two namespace-scope
-  aggregates (`MasterBusMeter`, `LoadedInstrument`) and the automation lane's own state. Both are
-  now split out — `processor_snapshot.h` and `automation_channel.h`, on the same grounds
-  `editor_interaction.h` was split out of `reasampler_editor.h` in this directory: neither is
-  behaviour. What remains is under the ceiling. Its bulk is the drain-slot proof and the
-  RT-discipline constraints, which the comment conventions name as keep-worthy.
+- **`reasampler_processor.h` carries a small, documented ceiling exception.** It was described as
+  ONE class declaration; it also carried two namespace-scope aggregates (`MasterBusMeter`,
+  `LoadedInstrument`) and the automation lane's own state. All three are split out —
+  `processor_snapshot.h` and `automation_channel.h`, on the same grounds `editor_interaction.h`
+  was split out of `reasampler_editor.h` in this directory: neither is behaviour. What remains is
+  the class declaration itself, a handful of lines over the ceiling since the live-contour block
+  (`liveContours_` + `publishLiveContours`) landed beside `liveParams_` under the same ordering
+  constraint. No further seam exists that isn't behaviour: every remaining aggregate-shaped chunk
+  (the preview mailbox, the drain-slot triple) is read and written inline by `process()` on the
+  audio thread, so splitting it into its own header would either duplicate the RT-discipline
+  comments at a second site or turn a plain member access into a cross-header one for no gain.
+  Its bulk is the drain-slot proof and the RT-discipline constraints, which the comment
+  conventions name as keep-worthy.
 
 - **The bake click only ARMS; the editor's sync tick runs it.** Calling
   `Main_OnCommandEx` inline from `WM_LBUTTONDOWN` would run the extension's whole landing

src/shell/instrument/editor_platform.cpp

@@ -162,6 +162,15 @@ void ReaSamplerEditor::removedFromParent() {
     // an edit forever and every later internal write to that parameter would emit a bare
     // performEdit. The capture-lost path normally closes it; this does not rely on Windows
     // delivering WM_CAPTURECHANGED before the window goes away.
+    if (drag_ == DragKind::kSplineNode) {
+        // A contour drag reaches the voices without the model (see publishContoursLive) — the
+        // window closing mid-drag is a second exit alongside WM_CAPTURECHANGED that must roll
+        // the voices back the same way, or an abandoned drag stays audible after the editor
+        // that started it is gone.
+        params_ = dragStartParams_;
+        publishContoursLive();
+        drag_ = DragKind::kNone;
+    }
     if (processor_) processor_->endParamGesture();
     if (childHwnd_) {
         KillTimer(childHwnd_, kSyncTimerId);  // stop the poll before the window goes away

src/shell/instrument/reasampler_processor.h

@@ -394,9 +394,8 @@ private:
     // Both live_ and draining_ observe this same block — a block owned by a snapshot would
     // leave the drain's still-sounding voices deaf to the knob under them.
     instrument::engine::LiveParams liveParams_;
-    // The drawn-contour block, SampleData::liveContours' one target, under liveParams_' ordering
-    // constraint and for its reason. No automation merge: no contour is a host parameter, so both
-    // engines read the model/editor publish directly.
+    // SampleData::liveContours' one target, under liveParams_' ordering constraint above and for
+    // its reason (this directory's CLAUDE.md owns why it needs no automation merge).
     instrument::engine::LiveContourBlock liveContours_;
     // The block the ENGINE reads, and the ONE thing SampleData::live points at. Written only by
     // the audio thread, which merges liveParams_ with the host's automation points once per block