Docs: record live spline-envelope drags; file two follow-ups in TODO.md

docs/COMPLETED.md

@@ -1776,3 +1776,20 @@ footer readout is the whole indicator. And the readout's fit in the footer's
 count box is bounded only by a character count, not a real pixel width, since a
 pure test can't measure the proportional font without pulling shell drawing into
 `core/ui`; overflow end-ellipsizes rather than breaking layout.
+
+### Live spline-envelope drags: held and new notes follow a dragged knot
+
+Dragging a knot on a Spline-mode amp/pitch/filter envelope in ReaSampler 9000's editor
+is now audible during the drag, for both held and new notes — releasing still commits
+exactly as before, in one undo point. The three contours travel to the audio thread on
+their own seqlock-published, double-buffered block (`core/instrument/engine/live_contours.h`,
+`seqlock.h`), separate from `LiveValues` so a knob publish, an automation merge or the
+live-block compare never carry the ~9 KB contour payload. Landed in the same merge:
+closing the editor mid-drag rolls the published contours back to the pre-grab snapshot
+(`removedFromParent`); the resample bake detaches live contours before its own render
+(`bake_render.cpp`); a pre-existing bug is fixed where a live-parameter publish arriving
+in the same block as a note-on failed to reach the already-held, sounding voices —
+`startVoice`'s `refreshLive()` consumed the new generation without applying it to active
+voices (`VoiceEngine::startVoice` now calls `applyLiveToActive()`); and the amp spline's read is
+clamped to `[0,1]` to absorb a swap-step overshoot from the smoother. Not DAW-verified —
+checks are tracked in `docs/SEPT_VERIFY.md` §5.

docs/TODO.md

@@ -906,3 +906,48 @@ them in full.
 two-instance-of-the-same-plugin case are each observed in a live REAPER session, and
 either the identity is confirmed to survive all four, or a degradation is found and
 the keying is amended.
+
+## Spline-drag abort exits republish the editor's snapshot, not the processor's model
+
+**Context (what shipped — the live spline-envelope drags track).** Both spline-drag abort
+exits — `ReaSamplerEditor::removedFromParent` and the `WM_CAPTURECHANGED` handler in
+`src/shell/instrument/editor_platform.cpp` — roll a drag back by restoring
+`params_ = dragStartParams_`, the editor's own pre-grab snapshot, then republishing
+contours from it.
+
+**The wart.** `dragStartParams_` is a snapshot taken by the editor at mouse-down. If
+`setState` or a bake reload lands mid-drag — either of which can rewrite the processor's
+own model out from under the editor — the rollback re-couriers the STALE snapshot over
+the model rather than the model's own current value, silently reverting whatever landed
+during the drag.
+
+**Intended fix.** Have the processor republish from its own params on these two abort
+paths, rather than the editor courier-ing its own stale pre-grab copy.
+
+**Priority / risk.** Not yet triaged.
+
+**Done looks like.** A `setState` or bake reload landing mid-drag survives a subsequent
+capture-loss or editor-close abort intact — the abort rolls the drag back without
+clobbering the intervening model change.
+
+## `reasampler_processor.h`'s preview mailbox is a candidate seam for the ceiling exception
+
+**Context (what shipped — the live spline-envelope drags track).** `reasampler_processor.h`
+is a documented ~600-line-ceiling exception (`src/shell/instrument/CLAUDE.md` Gotchas):
+after `processor_snapshot.h` and `automation_channel.h` were split out, what remains is
+the class declaration itself, plus a handful of lines over the ceiling since the
+live-contour block landed beside `liveParams_`.
+
+**The wart.** No further seam was found that isn't behaviour — except one candidate not
+yet taken: the preview mailbox (the packed-sequence post/consume pair) looks like it could
+move into its own header-inline `PreviewMailbox` aggregate without adding indirection to
+`process()`'s access.
+
+**Intended fix.** Revisit once the pending sample-rate branch lands — it is expected to
+add roughly 10 more lines to the file, which may tip the decision.
+
+**Priority / risk.** Not yet triaged.
+
+**Done looks like.** Either the preview mailbox is split into its own header-inline
+aggregate with `process()`'s access left zero-cost, or the file is re-affirmed as a
+documented exception once the sample-rate branch's size impact is known.