Docs: record live spline-envelope drags; file two follow-ups in TODO.md

docs/TODO.md

@@ -906,3 +906,48 @@ them in full.
 two-instance-of-the-same-plugin case are each observed in a live REAPER session, and
 either the identity is confirmed to survive all four, or a degradation is found and
 the keying is amended.
+
+## Spline-drag abort exits republish the editor's snapshot, not the processor's model
+
+**Context (what shipped — the live spline-envelope drags track).** Both spline-drag abort
+exits — `ReaSamplerEditor::removedFromParent` and the `WM_CAPTURECHANGED` handler in
+`src/shell/instrument/editor_platform.cpp` — roll a drag back by restoring
+`params_ = dragStartParams_`, the editor's own pre-grab snapshot, then republishing
+contours from it.
+
+**The wart.** `dragStartParams_` is a snapshot taken by the editor at mouse-down. If
+`setState` or a bake reload lands mid-drag — either of which can rewrite the processor's
+own model out from under the editor — the rollback re-couriers the STALE snapshot over
+the model rather than the model's own current value, silently reverting whatever landed
+during the drag.
+
+**Intended fix.** Have the processor republish from its own params on these two abort
+paths, rather than the editor courier-ing its own stale pre-grab copy.
+
+**Priority / risk.** Not yet triaged.
+
+**Done looks like.** A `setState` or bake reload landing mid-drag survives a subsequent
+capture-loss or editor-close abort intact — the abort rolls the drag back without
+clobbering the intervening model change.
+
+## `reasampler_processor.h`'s preview mailbox is a candidate seam for the ceiling exception
+
+**Context (what shipped — the live spline-envelope drags track).** `reasampler_processor.h`
+is a documented ~600-line-ceiling exception (`src/shell/instrument/CLAUDE.md` Gotchas):
+after `processor_snapshot.h` and `automation_channel.h` were split out, what remains is
+the class declaration itself, plus a handful of lines over the ceiling since the
+live-contour block landed beside `liveParams_`.
+
+**The wart.** No further seam was found that isn't behaviour — except one candidate not
+yet taken: the preview mailbox (the packed-sequence post/consume pair) looks like it could
+move into its own header-inline `PreviewMailbox` aggregate without adding indirection to
+`process()`'s access.
+
+**Intended fix.** Revisit once the pending sample-rate branch lands — it is expected to
+add roughly 10 more lines to the file, which may tip the decision.
+
+**Priority / risk.** Not yet triaged.
+
+**Done looks like.** Either the preview mailbox is split into its own header-inline
+aggregate with `process()`'s access left zero-cost, or the file is re-affirmed as a
+documented exception once the sample-rate branch's size impact is known.