Collapse a Design View mode switch to ONE undo point: FX writes run inline in applyMode's block, deferred park queue deleted

docs/TODO.md

@@ -867,23 +867,24 @@ public accessor surface. Doing that in the same commit that changed the byte for
 the golden test literals pin would roll a format change and a codec extraction
 together, which is the riskier order.
 
-**Also over the bar, blocked differently.** `src/shell/view/view.cpp` measures
-**625 lines** (re-measured after the deferred FX-park split took `fxGuidString`,
-`liveFxGuids` and the park/restore FX writes out into `view_fx_park`). Its remaining
-seam is blocked not by a private-state/friend question but by a build file another
-team owns: `src/shell/view/` has no `CMakeLists.txt` of its own today — a new TU
-there costs one `target_sources` line in `src/app/CMakeLists.txt` instead.
+**`src/shell/view/view.cpp` is no longer over the bar.** It measures **594 lines**
+(`wc -l`, re-measured after the undo collapse moved one track's whole park/restore —
+snapshot, flags and per-FX offline — into `view_fx_park`'s `parkTrack`/
+`restoreTrack`). Recorded because the entry above used to name it as a second
+over-ceiling file: if it grows again, note that a further seam there is blocked
+not by a private-state/friend question but by a build file another team owns —
+`src/shell/view/` has no `CMakeLists.txt` of its own today, so a new TU costs one
+`target_sources` line in `src/app/CMakeLists.txt` instead.
 
 **Priority / risk.** Not stated.
 
 **Done looks like.** `view_mode_model.cpp`'s JSON codec is extracted into its own
 `view_state_codec` TU (with the friend/accessor question resolved deliberately, not
-sidestepped), dropping the file under the ~600-line ceiling; `view.cpp`'s own path is
-unblocked once the build-file ownership question is resolved.
+sidestepped), dropping the file under the ~600-line ceiling.
 
-## FX-GUID stability for `applyRestore` is unverified in the DAW
+## FX-GUID stability for the park's restore is unverified in the DAW
 
-**Context.** The Design View park/restore FX keying (`applyRestore`,
+**Context.** The Design View park/restore FX keying (`restoreTrack`,
 `src/shell/view/view_fx_park.cpp`) rests on `TrackFX_GetFXGUID` returning an identity that
 survives a chain reorder while a track is parked. SWS issue #802 reports that after
 `SNM_MoveOrRemoveTrackFX` reorders a chain, the FXID lines do not follow the plugin

docs/VERIFICATION.md

@@ -48,11 +48,12 @@ Checks for Θ, Ξ, Ψ, Ε, Ρ, Γ, and Ω work that no unit test can close. Buil
 - [ ] Attempt a mode switch while the transport is playing, then while recording — both refuse, visibly (`docs/COMPLETED.md` §"Ψ-W1-T2")
 - [ ] Click the footer mode segment, save, reopen the project — the mode persisted (`docs/COMPLETED.md` §"Ψ-W1-T2")
 - [ ] `[verify — DAW]` Reproduce the strand: project with FX in both modes, switch to Design, save, close, reopen, toggle to Arrange. Toggle back and forth several more times — the arrangement's FX must NOT converge on permanently offline/hidden. A track the tool refuses to park is NAMED in the console, and the same refusal is not reprinted on a later reapply unless the refused set changed (`src/shell/view/view_fx_park.h`'s `decidePark` / `reportRefusedParks`)
-- [ ] `[verify — DAW]` **The undo collapse.** In a project with several FX across several tracks, switch modes once and count the undo points REAPER shows (Ctrl-Z tooltip / undo history): expect exactly TWO — `ReaSampler: Design View FX state` above `ReaSampler: activate <mode> view` — never one per FX (`src/shell/view/view_fx_park.h`'s `fxParkUndoClose`)
-- [ ] `[verify — DAW]` Then press Ctrl-Z once: every FX re-onlines in that one step and the flags stay parked. A second Ctrl-Z rolls the flags and the ext state back. The FX point must sit ABOVE the switch point, never below it and never folded into it. Verify the EFFECT, not merely that a point exists in the history — a mask narrower than `UNDO_STATE_FX` covers would still show an entry there while doing nothing to FX state on Ctrl-Z, which would look like a pass and isn't (`src/shell/view/CLAUDE.md` §Invariants — the undo-ordering premise, still `[verify — DAW]` until this item and the next close it)
-- [ ] `[verify — DAW]` Open a project saved in Design mode with every inactive leaf's FX already offline, and check the undo history: the load-tick reapply then writes no FX state, so it must add NO undo point at all — the discard form. This only holds when the saved state was actually fully parked — a first open after tagging a new leaf, an FX added to a parked track while it was offline, or a plugin hand-onlined since the last save all have real FX state to write and legitimately mint one correct `ReaSampler: Design View FX state` point; don't record those as a false failure. An entry appearing on a project that WAS fully parked means the discard is not working (`src/shell/view/view_fx_park.h`'s `fxParkUndoClose`)
-- [ ] `[verify — DAW]` Whether `Undo_EndBlock2` tolerates a `ReaProject*` that closed between it and its `Undo_BeginBlock2`, AND which of two undocumented block-nesting models REAPER implements — a GLOBAL counter (an unbalanced block swallows every later action, in ANY project, into one point) or a PER-PROJECT one (an unbalanced block on a now-dead project costs nothing). The drain closes its block unconditionally on the project-gone abort path on the assumption the global model applies; record which model is actually observed, not just whether the call survives. Reproduce by closing a project tab while a mode switch's FX drain is in flight (`src/shell/view/view_fx_park.cpp`'s `FxParkUndoBlock`)
-- [ ] `[verify — DAW]` **Block-inside-drain.** The nesting audit at `drainDeferredFxParks` only covers the drain opening inside an already-open caller block; the pumping premise it documents (`FxParkQueue::take`) also makes the inverse possible — a re-entrant `applyMode` (an action fired mid-drain) or a re-entrant `OnTimer` -> `bankPanelRefresh` -> `mintManagedLanes` opening ITS OWN `Undo_BeginBlock2`/`Undo_EndBlock2` pair while the drain's block is still open. `g_draining` blocks only a second `drainDeferredFxParks` call, not this. Reproduce by triggering a mode-switch action or a lane-mint mid-drain (a heavy FX chain widens the window) and check the undo history for a split or misordered point (`src/shell/view/view_fx_park.h`'s `drainDeferredFxParks`)
+- [ ] `[verify — DAW]` **ONE switch, ONE point.** In a project with several FX across several tracks, switch modes once and count the undo points REAPER shows (Ctrl-Z tooltip / undo history): expect exactly ONE, `ReaSampler: activate <mode> view` — never two, and never one per FX. Then press Ctrl-Z once: the flags unpark and EVERY FX comes back online, in that single step. Verify the EFFECT, not merely that one entry exists — a mask that failed to pick up `UNDO_STATE_FX` would still show one correct-looking entry while leaving every plugin offline, which reads as a pass and isn't. Then Ctrl-Y: the redo re-parks all of it, also in one step (`src/shell/view/CLAUDE.md` §Invariants — "ONE mode switch is ONE undo point")
+- [ ] `[verify — DAW]` **Where the `view_state` lands on undo AND redo.** `persistViewState` writes the ext state AFTER `applyMode`'s block closes, so the point never saw the new `view_state` — the undo direction is expected to come out right by position, the redo direction is the open one. After the Ctrl-Z above, read the footer segment: it must show the mode the user came FROM, and a further switch must bank solos under that mode id. Then Ctrl-Y and read it again: if the tracks re-park while the footer still shows the pre-switch mode, the redo restored the stale ext state and model-vs-project is out of step. Do NOT fix by moving `persistViewState` inside the block — it can open a modal Save-As (`src/shell/view/CLAUDE.md` §Gotchas)
+- [ ] `[verify — DAW]` **No point on open.** Open a project saved in Design mode with every inactive leaf already fully parked (flags AND FX), and check the undo history: the load-tick reapply writes nothing, so it must add NO undo point at all — the `("", 0)` discard form. This only holds when the saved state really was fully parked; a first open after tagging a new leaf, an FX added to a parked track, or a plugin hand-onlined since the last save all have real state to write and legitimately mint one correct point. An entry appearing on a project that WAS fully parked means the discard is not working — and since `mintManagedLanes`' no-op path rests on the same idiom, check that alongside it (`src/shell/view/view.h`'s `applyMintsUndoPoint`)
+- [ ] `[verify — DAW]` **The hitch now sits on the switch.** On a project with heavy plugins (convolution, a loaded sampler) across several parked tracks, time the mode toggle: by design the action does not return until every plugin has unloaded/reloaded. Report roughly how long, and whether the UI recovers cleanly afterwards — the whole write phase runs under one `PreventUIRefresh(1)` hold (`src/shell/view/CLAUDE.md` §Invariants — the documented caveat)
+- [ ] `[verify — DAW]` **Nested blocks around the FX writes.** Two directions, both undocumented in the SDK header. (a) `render_in_place` calls `applyMode` inside its OWN undo block, so its single `ReaSampler: render selected track to a new track` point should now absorb the reapply's FX moves — run that verb from Design mode over a track with FX and confirm ONE point, not two, and that Ctrl-Z reverses all of it. (b) The inverse: fire a mode-switch action, or let `OnTimer` -> `bankPanelRefresh` -> `mintManagedLanes` run, WHILE a switch's plugin loads are in flight (a heavy chain widens the window), and check the history for a split or misordered point. Nothing guards (b) (`src/shell/view/CLAUDE.md` §Gotchas)
+- [ ] `[verify — DAW]` **A→B→A costs two full cycles.** Toggle Arrange→Design→Arrange quickly on a project with heavy plugins: every plugin unloads and reloads twice, where the retired intent queue made a fast double-toggle free. Confirm the END STATE is still correct (every FX online, every driven flag back at its captured value) and report whether the doubled cost is tolerable in practice (`src/shell/view/CLAUDE.md` §Invariants — the A→B→A bullet)
 - [ ] `[verify — DAW]` For a track the console names as left unparked, follow the message's recovery IN FULL: re-enable its TCP/mixer visibility, main send and FX enable, **and set every FX in its chain online** (FX enable is the chain bypass — it does not bring an individually offlined FX back). Then switch modes twice: it parks and restores normally, with no further console line. Do the flag half ONLY on a second such track and confirm it is still refused — the FX half of the trust test, and the reason the message spells the step out (unit-tested only as a decision, never against a live chain)
 
 ## Actions and drops