reasampler/docs/product/linux-readiness.md

# Linux readiness — product notes

Framing, rationale, and design-direction calls behind **Phase Λ — ReaSampler on Linux:
the `reaper_reasampler` extension and the ReaSampler 9000 VST3 instrument, both
shipped.** The tickable spec belongs in `docs/PLAN.md` (§Phase Λ); the architecture
detail belongs in the affected `src/**/CLAUDE.md` files once tracks land. This doc holds
the *why* — what "Linux-ready" is defined to mean here, what the tree's actual posture
is, the six decisions Daniel settled on 2026-08-02, the sequencing argument, and the four
forks still open.

**This doc is downstream of two audits and does not repeat them.**
`docs/product/audit-notes/lambda-w1-t1-build-toolchain.md` (findings Λ-01…Λ-10, verify
items V1…V10) owns the build system, toolchain, vendored dependencies, resources, test
harness and packaging. `docs/product/audit-notes/lambda-w1-t2-source-runtime.md` (findings
L2-01…L2-12) owns source portability and runtime behaviour. Both were code-reviewed against
the tree and remediated in place. **Everything below cites them by finding number rather
than re-deriving.** Grep the audits for a cited number; do not read either whole.

Status: framed by product-designer (2026-08-02) after Daniel's rulings the same day.
**Four forks are open** — Λ-F1 (CI), Λ-F2 (the dialog-resource route), Λ-F3 (the
copy-only drag-out invariant), Λ-F4 (the declared support floor) — each stated with the
evidence for both sides in §"Open forks". Λ-F2 gates one track and nothing else;
the other three gate nothing. Everything not marked as a fork is a product-designer call
with its reasoning stated; contradict it in review with an argument, not a preference.

**Slug convention.** `Λ → l`, so tracks dispatch into `pl-w<wave>-t<track>-<slug>` —
Λ-W2-T1 into `pl-w2-t1-linux-compile-blockers`. The two audits already ran under
`pl-w1-t1-build-toolchain-audit` and `pl-w1-t2-source-runtime-audit`. **`docs/PLAN.md`'s
"Worktree slug convention" paragraph
lists the transliterations for Θ / Ξ / Γ / Ψ / Ε / Ρ and does not yet carry Λ — adding it
is a plan-doc edit this phase's PLAN.md entry must make.**

---

## Why now, and what "Linux-ready" means here

The reason to do this now is not demand — it is that **the cost is already sunk and the
window for it to stay sunk is closing.** Two facts from the audits:

- `docs/product/versioning-and-release.md` already commits, in writing, to
  "three platform artifacts per channel per release" (T1 §1e). Linux is not a new promise;
  it is an unredeemed one.
- The panel layer — the product's primary surface — was written against SWELL's
  vocabulary throughout and is portable **call-for-call**, verified name-by-name against
  the vendored headers (T2 §1.5, §"Surfaces checked"). That is an asset the tree acquired
  by discipline, not by luck, and it decays every time someone writes a Win32 call without
  a `#else`. Phase Ψ, Phase Ε and Phase Ρ are all adding extension-side surface right now.
  Compiling on Linux once converts that discipline from a convention nobody can check into
  a build that fails when it is broken.

**What "Linux-ready" is defined to mean in this phase.** A Linux REAPER user installs
`reaper_reasampler.so` and `reasampler_9000.vst3` and gets the same product a Windows user
gets, with four named exceptions:

1. **Prune deletes permanently.** No Recycle Bin, no trash. The confirmation says so.
   (Λ-D5.)
2. **The OS drag-out's copy-only guarantee is conventional, not structural.** SWELL's
   file-list drag takes no effect mask, so nothing at the API level forbids a target from
   treating the drag as a move (L2-10). Λ-F3 decides how the invariant is worded.
3. **Fonts are not Segoe UI and Consolas.** The kit gets an explicit Linux face list
   (see §"Calls made here"); the faces are different, the layout is not.
4. **The ReaSampler 9000 editor comes up under REAPER only.** In any other Linux host the
   plugin loads, scans, instantiates, and processes audio — and shows the host's generic
   parameter UI instead of its own editor. This is a *contract*, not a shortfall; §"The
   non-REAPER-host safety criterion" specifies it as an observable.

**What a Linux user explicitly does not get:** an XDG-trash prune, a macOS build, the
TCP/MCP embed strip, or an editor in Bitwig/Ardour. §"What Phase Λ does not do" states
each with its reason.

---

## The posture as found

Compressed from the two audits. Each claim below is theirs; the citations are the ones
this doc re-read against the tree while writing.

**The extension is close — two one-line compile blockers stand between the tree and a
GCC/Clang build.**

- `src/shell/panel/draw_kit.cpp`'s `loadFont` passes `DEFAULT_PITCH | FF_DONTCARE` to `CreateFont`.
  `FF_DONTCARE` has zero occurrences anywhere in `vendor/WDL/` (L2-01); the file is not
  platform-guarded, only its include is (`loadFont`'s whole body). `draw_kit` links into both modules, so
  nothing builds.
- `src/shell/actions/instrument_drop_win.cpp`'s `writeTempPreset` calls `GetCurrentProcessId()`
  with no platform branch anywhere in the TU. SWELL exports
  `GetCurrentThreadId` and not this (L2-02). The PID exists only to keep two concurrent
  REAPER instances from colliding in the shared temp dir; the atomic counter in the same function
  already carries the intra-process half.

**`core/` is genuinely pure, and it was verified rather than assumed.** Every `#include`
under `src/core/**` is a `core/` sibling, one of 26 standard headers, or the generated
`version_generated.h` — zero REAPER, SWELL, WDL, LICE, VST3 or `windows.h` (T2 §1.1). The
whole directory contains nine preprocessor conditional lines, exactly one of which is a
platform fork, and that one (`capture_paths.cpp`'s `normalizeSlashes`, the Windows case-fold) is *correct*
for Linux with both branches already asserted by `tests/test_capture_paths.cpp`. All 91
test TUs under `tests/` are platform-neutral.

**The panel layer is already SWELL-portable, call for call.** Dialog lifecycle, docking,
double-buffered LICE `WM_PAINT`, mouse/wheel/capture, `WM_CAPTURECHANGED` rollback, all
seven cursors, menus, the keyboard accelerator path, modifier reads, tooltips, drag-out and
`DragQueryFile`/`DragFinish` were each checked by name against `swell-functions.h` /
`swell-types.h` and are present (T2 §1.5). The Windows-only escapes are three:
`DragAcceptFiles` (`panel_window.cpp`'s `openPanel`, under `#ifdef _WIN32`), `SHFileOperationW`
(prune), and OLE `DoDragDrop` (drag-out) — each already carrying a non-Windows branch or a
documented reason it does not. **This is the audits' single most load-bearing finding.**

**The dock panel will not appear until the dialog-resource question is answered.**
`panel_window.cpp`'s `openPanel` calls `CreateDialogParam(g_hInst, MAKEINTRESOURCE(IDD_BANK_PANEL), …)`,
which SWELL resolves out of a per-module registry populated by a **resgen-generated source
file that is not in the Linux target**: `src/app/CMakeLists.txt`'s `else()` (Linux) branch has the `target_sources`
line commented out (and the `elseif(APPLE)` branch's own copy for macOS). The registry head stays null, `SWELL_CreateDialog`
returns null, `openPanel`'s `if (!g_panel.hwnd) return;` guard returns, and the toggle action is a silent no-op with
no console line and no Actions-list checkmark (Λ-01, L2-06). Three defects stack in the
commented-out instructions themselves: the script named in the `elseif(APPLE)`/`else()` branches' comment lines (`mac_resgen.php`) does
not exist, the output filename is wrong, and the output is an `#include`-only artifact that
cannot be a `target_sources` entry at all (Λ-01). Λ-F2 decides the route.

**The instrument's Linux editor is a from-scratch X11 job, and today the target does not
configure at all.** `src/shell/instrument/CMakeLists.txt`'s
`if(WIN32 AND EXISTS "${VST3_SDK}/…/pluginfactory.cpp")` gate is
a conjunction, so a Linux
configure silently omits `reasampler_vst` even with the submodule slice fully initialised.
Beyond the gate: the wrong module entry point is compiled, the artifact is a file where
Linux wants a directory bundle, nothing hands a VST3 plugin the SWELL function table, and
the view reports `kPlatformTypeHWND` only (B1–B4, L2-08). The paint side is the cheapest
part — every painter already draws into a `LICE_IBitmap` through the shared kit, so the
drawing survives a window-system change intact. It is the window and event plumbing that
is entirely absent.

**Nothing about the build is optimized, and the documented ship command is a no-op on
Linux.** Root `CMakeLists.txt`'s `set(CMAKE_CXX_STANDARD ...)`/`set(CMAKE_CXX_STANDARD_REQUIRED ...)`/`set(CMAKE_POSITION_INDEPENDENT_CODE ...)` block is the complete list of language settings — there is
no `CMAKE_BUILD_TYPE`, no `CMAKE_CXX_FLAGS`, no IPO/LTO, and no `target_compile_options`
anywhere in the tree. `--config Release` is accepted and ignored by Ninja and Make, so the
README's ship incantation produces a binary with no `-O` flag at all, on a tree whose
`peaks` hot path is documented as presuming an optimizing build (Λ-02). There is also no
symbol-visibility control (Λ-03), no thread library linked (Λ-04), no warning flags
(Λ-09), no `install()` rule anywhere, and no CI configuration in the repo on any platform
(T1 §1e).

---

## Settled decisions (Daniel, 2026-08-02)

Six rulings. They are settled; do not re-litigate them. Each is recorded with the reasoning
given, because the reasoning is what a later reader will need.

### Λ-D1 — The VST3 instrument is in scope. (Audit fork D1 = **Fork B**.)

Phase Λ ships both artifacts on Linux, not just the extension.

**Why.** The instrument is not a standalone product on any platform. The capture browser
reads the extension's bank over the bridge, and the resample bake invokes an extension
action synchronously over the VST3 host bridge — root `CLAUDE.md` §"The resample bake"
makes the crossing structural. **A non-REAPER Linux host was never getting the full
instrument regardless**, because the two features that make it ReaSampler rather than a
generic sampler both tie into the extension directly. So the marginal thing Λ-D1 buys is
precisely a REAPER-hosted Linux instrument — which is the only complete one that exists on
any platform.

**What it costs.** T1 §4 states the asymmetry plainly: Fork A's build work is small and its
unknown is source portability; Fork B's build work is genuinely large *and* carries an
unbounded source tail *and* requires reversing a recorded decision. They are not "the same
phase, one bigger" — they are different-shaped commitments, and this doc's wave structure
keeps them separable (Λ-W6…Λ-W8 can be halted without unshipping Λ-W2…Λ-W5).

**Consequence — D5 is reversed, in writing.** "No cross-platform… Windows-only, VST3-only,
REAPER-only (D5)" is a recorded invariant in three files: `src/core/instrument/CLAUDE.md`
(twice — Invariants and Non-goals), `src/shell/instrument/CLAUDE.md` (Non-goals), and
`src/shell/panel/CLAUDE.md` ("Windows-only (D5) — font/GDI/HFONT choices assume Windows; no
cross-platform font-fallback concern"). D5's *other* two clauses survive untouched: still
VST3-only, still REAPER-only. **Only the platform clause moves**, and it moves to
"Windows and Linux; the editor is REAPER-hosted." Rewriting those three passages is
audit finding B5 and is a named deliverable of Λ-W6-T1.

### Λ-D2 — The instrument reaches SWELL by `dlopen`ing REAPER's own `libSwell.so`. (D2 = **route B3a**.)

`vendor/WDL/WDL/swell/swell-modstub-generic.cpp:69–131` is the vendored implementation:
resolve the host executable's directory from `/proc/self/exe` (falling back to `dladdr`),
`dlopen` `libSwell.so` beside it, `dlsym` `SWELLAPI_GetFunc`, call `SWELL_set_app_main`,
populate the API table.

**Route B3b is rejected.** Building SWELL into the module means the 14 SWELL TUs plus 8
LICE TUs from SWELL's own Makefile and a wholly new third-party dependency
surface — GDK/GTK3, FreeType, Fontconfig, OpenGL — that the extension deliberately avoids
via `SWELL_PROVIDED_BY_APP`. That is a scope expansion in a phase whose entire cost
advantage comes from not having one.

**The consequence Daniel accepted:** B3a makes the instrument's UI load-bearing on being
hosted by REAPER specifically. That is consistent with D5's surviving REAPER-only clause
and with Λ-D1's reasoning above. **It is also why Λ-D3 exists** — the coupling has to be
safe, not merely intended.

**Important: the vendored stub cannot be used as-is.** See §"The non-REAPER-host safety
criterion" — `swell-modstub-generic.cpp:102` calls `exit(2)` on a failed `dlopen`, from a
static constructor. Route B3a is the ruled route; *how* it is implemented is specified
there and is not a re-litigation of this ruling.

### Λ-D3 — Non-REAPER hosts must be protected. First-class acceptance criterion.

Daniel, verbatim: *"REAPER-only is good for now, but we need to protext other hosts."*

A working editor on Linux is required under REAPER only. But the plugin must **degrade
safely** in Bitwig, Ardour, or any other Linux host: no crash, no host takedown, defined
behaviour when `libSwell.so` is absent or unusable. The audits flagged the absent-`libSwell`
failure mode as unverified; this phase must both determine it and hard-guard it. It is
specified as an observable contract in its own section below, and it is an acceptance
criterion of two tracks, not a footnote on one.

### Λ-D4 — macOS is out. (D3 = **out**.)

Daniel, verbatim: *"I don't have a mac to compile on."*

Λ-01, Λ-03, Λ-04, Λ-07, Λ-09 and L2-09 are all marked *shared macOS/Linux* in the audits,
meaning the same edit covers both. **Those edits still get made in their shared form and
noted as shared** — a `#ifdef _WIN32` / `#else` that is right for both costs nothing extra
and does not require a mac. What is out is: macOS as a phase deliverable, any macOS
verification, the `swell-modstub.mm`-under-a-CXX-only-`project()` question (root
`CMakeLists.txt`'s `project(...)` call is `LANGUAGES CXX`), signing and notarization, and the macOS-only
half of L2-11 (`normalizeSlashes` under-folds on case-insensitive APFS — a real pre-existing
defect this phase surfaces and does not own).

**Do not "fix macOS while you're in there."** An unverifiable edit to the APPLE branch is
worse than no edit, because it looks tested.

### Λ-D5 — The Linux artifact is shipped, not developer-only. (D6 = **shipped**.) Hard `unlink` is acceptable. (T2 [Daniel] 2 = **yes**.)

Two rulings that travel together, because both are about what "shipped" obliges.

**Shipped** means Λ-02 (an actual Release/optimized build) and Λ-08 (a documented install
path and artifact name) are **must-fix, not nice-to-have**, and that a Linux `install()`
rule is worth authoring. A developer-only artifact could have skipped all of it.

**Hard `unlink` is acceptable**, with a **platform-aware confirmation string**. XDG trash
is not a ship blocker. The user must be told, at the confirm, that the deletion is
permanent on this platform. Note that L2-05 has a **second half the ruling does not
cover**: on Windows a bank file held open by REAPER's audio engine cannot be deleted and is
counted as "skipped"; on Linux `unlink` on an open file succeeds, the audio keeps playing
from the open fd, and the bytes are gone when it closes. That is not a trash question — it
is the disappearance of the recovery floor root `CLAUDE.md` §"The resample bake" relies on
("the superseded file survives on disk until a prune reclaims it"). Λ-W4-T1 owns it.

### Λ-D6 — Fork B's editor work is real work, and it is sequenced last.

Not a separate Daniel ruling but the direct consequence of Λ-D1 + Λ-D2 + Λ-D3: the X11
editor is the phase's only L-band source item (L2-08; T1 B4 costs it "build S, source L")
and it is the last thing sequenced. Everything before it ships something. If Λ-W8 is
halted, Linux users still have a shipped extension (Λ-W5) and a loading, processing,
generic-UI instrument (Λ-W6) — which is a real product, not a stub.

---

## The non-REAPER-host safety criterion

Λ-D3 stated as something a person can check. This section is the specification the two
instrument waves are graded against.

### The finding that makes this urgent

The audits flagged the absent-`libSwell.so` failure mode as unverified. **It is verifiable
from the vendored source, and the answer is bad.** Reading
`vendor/WDL/WDL/swell/swell-modstub-generic.cpp`:

- `:125` declares `SwellAPPInitializer m_swell_appAPIinit;` — a **file-scope static
  object**, so its constructor runs when our `.so` is `dlopen`ed, i.e. **during the host's
  plugin scan**, before any VST3 code of ours executes.
- `:98–103` — `dlopen(fn, RTLD_LAZY)`; if it returns null, the stub prints to stdout and
  calls **`exit(2)`**.
- `:117` — if `doinit` reports any unresolved SWELL name, **`exit(1)`**.

So compiling the vendored `SWELL_LOAD_SWELL_DYLIB` path unmodified means: **a Bitwig or
Ardour plugin scan on a machine with no `libSwell.so` beside the host binary terminates the
host process.** Not a failed scan — a killed DAW, mid-scan, with the user's session. That is
precisely the host takedown Λ-D3 forbids, and it is a certainty rather than a risk.

The mitigating detail, worth knowing because it shapes the fix: `doinit` (`:53–67`) does
**not** leave unresolved entries null. It substitutes `&dummyFunc` (`:63`), and `dummyFunc`
(`:51`) is `static int dummyFunc() { return 0; }`. A *partial* SWELL therefore degrades to
"every missing call returns 0/NULL" rather than jumping through a null pointer. A partial
load is survivable; `exit()` is not.

### The implementation shape this obliges

Route B3a (Λ-D2) is the ruled route. It must be reached without the stub's own loader:

1. **Never define `SWELL_LOAD_SWELL_DYLIB`.** Compile
   `swell-modstub-generic.cpp` in its default branch — the same branch the extension already
   uses (`src/app/CMakeLists.txt`'s `else()` (Linux) branch's `target_sources`/`target_compile_definitions` pair) — which exports `SWELL_dllMain(hInst, callMode,
   GetFunc)` (`:135`) and calls `doinit` on the pointer it is handed. The whole file is
   inside `#ifdef SWELL_PROVIDED_BY_APP` (`:21`), so the VST3 target must define that
   symbol too; today it does not.
2. **Own the load.** A new `shell/instrument/swell_bootstrap` TU does the work the stub
   would have done — resolve the host executable's directory, `dlopen` `libSwell.so`,
   `dlsym` `SWELLAPI_GetFunc`, `dlsym` and call `SWELL_set_app_main`, then call our own
   exported `SWELL_dllMain(hinst, DLL_PROCESS_ATTACH, getfunc)` — using **only exported
   surface**, with every failure returning a recorded state instead of exiting. No vendored
   file is patched. This also dissolves the `SWELLAppMain`-as-a-link-requirement noted in
   T1 B3a: we pass an app-main because we choose to, not because the linker demands one.
   `[verify — Linux]` whether a minimal app-main is sufficient for a plugin that only ever
   creates child windows inside a host-supplied X11 window.
3. **Probe the host, not just the library.** A non-REAPER host has no SWELL message loop —
   REAPER's own is what pumps SWELL windows. So even a successful `dlopen` in Ardour would
   produce a window nothing drives. Gate the bootstrap on the host name via
   `IHostApplication::getName()` **and** on the `dlopen` succeeding; either failing means no
   editor. Cheap, and it makes the REAPER-only coupling explicit rather than emergent.
4. **Probe once, lazily, off the audio thread.** The result is a tri-state — untried /
   available / unavailable — computed on first `createView` and never recomputed. No
   `dlopen` from `process()`, no per-`createView` retry, no static-constructor work.

### The observable contract

In **any** Linux host, with or without `libSwell.so`:

- **Scan.** The host opens `reasampler_9000.vst3`, finds `ModuleEntry` / `ModuleExit` /
  `GetPluginFactory`, and enumerates the one class. No crash, no hang, no process exit, no
  blacklist entry.
- **Instantiate and run.** `setActive(true)` and `process()` produce audio (or silence with
  nothing loaded). MIDI notes play. The component state round-trips through
  `setState`/`getState` byte-identically with the Windows build.
- **Editor request.** When no usable platform surface exists, `isPlatformTypeSupported`
  returns `kResultFalse` for **every** type — including `kPlatformTypeX11EmbedWindowID` —
  and `createView(kEditor)` returns **`nullptr`**. It never returns a view whose
  `attached()` then fails, and never returns a view that draws nothing. The host falls back
  to its generic parameter UI.
- **Diagnosis.** Exactly one line, once per process, naming why the editor is unavailable
  (host not REAPER / `libSwell.so` not found at `<path>` / SWELL API incomplete). Written
  through the SDK's own logging or stderr — never a modal, never a message box, never
  repeated per instantiation.
- **Teardown.** Unloading the module does not crash. Nothing calls `exit()`, `abort()`, or
  leaves a partially-initialised SWELL table reachable by a later call.

Under REAPER on Linux the same contract holds with the editor branch taken instead: the
view reports `kPlatformTypeX11EmbedWindowID`, attaches to the host-supplied window id, and
drives its timer through `Linux::IRunLoop`.

### How it is verified

**The VST3 SDK ships a non-REAPER host harness and it is already on disk.**
`vendor/vst3sdk/public.sdk/samples/vst-hosting/validator/source/validator.cpp` is present
in the vendored slice (it lives under `public.sdk/`, which the documented narrow submodule
init already pulls). It is a scriptable, headless, REAPER-free host that instantiates a
plugin and exercises the standard suite. **It is the right instrument for this criterion**
and neither audit named it, because neither swept the SDK's `samples/` tree.

The verification set, all `[verify — Linux]`:

- `validator reasampler_9000.vst3` completes and reports no failures, on a machine with
  **no** `libSwell.so` on the filesystem. This is the load-bearing check: the validator
  process surviving is the direct negation of the `exit(2)` finding.
- The same, in **Ardour or Bitwig**, through a real plugin scan: the DAW finishes scanning,
  the plugin appears in the browser, an instance instantiates, and the generic parameter UI
  opens. A hand check, but the one that answers Daniel's actual sentence.
- The same, under **REAPER on Linux**: the editor opens.
- A **negative-control** run: rename `libSwell.so` beside a Linux REAPER, load the plugin,
  and confirm the generic-UI fallback and the single diagnostic line — not a crash, not a
  blank window.

**The acceptance criteria above must pass with zero VST3 parameters registered.** See
§"Cross-phase dependency: Γ-W4-T1" — today the generic UI is empty, and "the host shows an
empty generic UI" is a pass. It is a poor experience, and Γ fixes it; it is not Λ's to fix.

---

## Wave and track structure

### Why this sequence

Three constraints shape it, and they conflict.

**One: the `[verify — Linux]` items are worthless as a late checklist and near-free as an
early wave.** T1's own §6 Stage 0 says it outright — running V1 and V2 on a Linux box is
"the one action that reprices everything", and every effort band in both audits is
provisional until it happens. A plan that puts verification at the end has, in effect, no
estimates at all.

**Two: nothing can be verified from this Windows box.** Every acceptance criterion for the
first Linux edits is itself a `[verify — Linux]` item. This is not a fixable property of
the plan; it is the phase. The honest structure is to say so: **Λ-W2's edits are authored
blind, from the audits' citations, and Λ-W3 is the session that discharges Λ-W2's
acceptance criteria and answers the sweep in the same sitting.** Λ-W2 is not "done" in the
usual sense until Λ-W3 runs. Pretending otherwise would launder unverified work into
landed work, which is exactly what the audits' `[verify]` discipline exists to prevent.

**Three: the sweep cannot answer the panel-dependent items until the panel renders.**
T2 §6 step 4 flags this and notes the critical path runs through the other track. The
resolution is to pull the dialog-resource work forward into Λ-W2 — which is why Λ-F2 is
worth ruling early, and why the plan states what happens if it is not (Λ-W2-T3 slips and
Λ-W3 splits).

Two further sequencing decisions, both deliberate:

- **The locale codec (L2-04) is pulled forward into Λ-W2**, ahead of everything it looks
  like it should follow. It is the phase's one substantial fix that needs no Linux box at
  all — two writers and three readers, all in `core/`, all unit-testable on Windows today —
  and its failure mode is that the bank index is written unparseable and the project's whole
  bank is lost on reload. It should land before any Linux user saves a project, and there
  is no reason to spend a Linux session discovering that.
- **V9 (does REAPER's Linux install ship `libSwell.so` beside its executable?) runs in the
  sweep, not in the instrument waves.** It is a one-line `ls`, and the entire Λ-D2 route
  rests on it. If it is false, B3a is void and the instrument's editor needs a re-ruling —
  a thing to learn in Λ-W3, not four waves later.

**On the audits' severity disagreement.** T2 grades L2-03 a Blocker on failure-mode quality
with no direct evidence, and L2-04 a Major with a confirmed mechanism, and flags the
inconsistency as a scope call for whoever prioritises the two. This plan **dissolves it
rather than resolving it**: both land in Λ-W2, in different tracks, so the relative grade
never has to be adjudicated.

### Λ-W1 — The audits *(complete)*

Two tracks, both landed: **T1 `build-toolchain-audit`** (Λ-01…Λ-10, V1…V10, D1…D7) and
**T2 `source-runtime-audit`** (L2-01…L2-12). Recorded here so the wave numbering matches the
audit filenames and branch names; nothing to re-spec.

---

### Λ-W2 — Make it buildable, and make it honest

**Four tracks, disjoint at the file level.** Three of them are authored blind against the
audits and verified in Λ-W3; T4 is verifiable on the current box.

#### Λ-W2-T1 — `linux-compile-blockers`

**Goal.** The extension compiles and links under GCC/Clang, and when it refuses to load it
says why instead of vanishing.

**Surface boundary — owns:** `src/shell/panel/draw_kit.cpp` (`loadFont`),
`src/shell/actions/instrument_drop_win.cpp` (`writeTempPreset`), `src/app/main.cpp`
(the `REAPERAPI_LoadAPI` failure branch only). **Does not own:** any `CMakeLists.txt`,
`panel_window.cpp`, or any `core/` file.

**Behavior.**
- Drop the `| FF_DONTCARE` term or define it locally in the non-Windows include branch.
  **Do not add `windows.h`** (L2-01's stated direction). The family bits are advisory to
  Windows' font mapper and meaningless to fontconfig.
- Replace `GetCurrentProcessId()` with a platform-neutral uniqueness source behind a guard;
  the atomic counter in `writeTempPreset` already carries the intra-process half (L2-02).
- On the load-failure branch, either switch `main.cpp` to `REAPERAPI_MINIMAL` plus an
  explicit `WANT` list — the pattern `panel_window.cpp` and `panel_audition.cpp` already
  use — or keep the full load and print the failure count via
  `rec->GetFunc("ShowConsoleMsg")` before returning 0 (L2-03). The minimal list is also the
  honest inventory of what this extension actually needs.

**Acceptance criteria.**
- `cmake -B build -S . -G Ninja && cmake --build build` produces `build/reaper_reasampler.so`
  with no errors. `[verify — Linux]` = **V1**.
- `ctest --test-dir build --output-on-failure` passes all 91 targets, no `-C` flag needed.
  `[verify — Linux]` = **V2**.
- A deliberately misspelled entry in the WANT list (or a forced non-zero `failcnt`) produces
  a visible REAPER console line naming the count, not a silent refusal.
- Windows build and `ctest` unchanged.

**Prerequisites.** None. **Discharges:** L2-01, L2-02, L2-03; enables V1, V2, V3.

#### Λ-W2-T2 — `toolchain-floor`

**Goal.** The Linux build is optimized when asked, links what it uses, hides what it does
not export, and reports diagnostics no one has seen yet.

**Surface boundary — owns:** root `CMakeLists.txt`, `src/app/CMakeLists.txt` (the target
property and platform blocks; **not** the source list — that is Λ-W4-T3's),
`cmake/reasampler_targets.cmake`, `src/shell/instrument/CMakeLists.txt` (thread linkage
only; the `WIN32` gate is Λ-W6-T1's), `README.md` and root `CLAUDE.md` §"Build and test" /
§"Install / reload" / §"One-time submodule setup". **Does not own:** any `.cpp` or `.h`.

**Behavior.**
- **Λ-02** — default `CMAKE_BUILD_TYPE` when neither it nor `CMAKE_CONFIGURATION_TYPES` is
  set, and correct the docs' ship instruction to name the single-config-generator path. The
  README currently sends a Linux user to `build/Release/`, which on Ninja/Make does not
  exist; the module lands at `build/reaper_reasampler.so`.
- **Λ-03** — `CXX_VISIBILITY_PRESET hidden` + `VISIBILITY_INLINES_HIDDEN` on both module
  targets. SWELL's own build already uses `-fvisibility=hidden`; the two symbols that must
  stay exported carry their own `visibility("default")` attributes
  (`reaper_plugin.h`'s `REAPER_PLUGIN_DLL_EXPORT`, `fplatform.h`'s `SMTG_EXPORT_SYMBOL`,
  and `swell-modstub-generic.cpp:135`'s `SWELL_dllMain`).
- **Λ-04** — `find_package(Threads REQUIRED)` + `Threads::Threads`. Correct on all three
  platforms, costs nothing on Windows.
- **Λ-09** — `-Wall -Wextra` and `CMAKE_CXX_EXTENSIONS OFF`. **No `-Werror` in this change**
  (the audit is explicit); the diagnostic-set size over the tree is not estimable from
  Windows. Separately, `-Wl,--no-undefined` on the module targets, to restore the
  fail-at-link-time behaviour MSVC gives and GNU `ld` does not — **or** a recorded reason
  why `SWELL_PROVIDED_BY_APP`'s function-pointer design makes the gap moot.
- **Λ-05** — pin the `reaper_plugin.h` → `../WDL/swell/swell.h` include coincidence with a
  comment or an `INTERFACE` target carrying both include dirs as one unit. It is invisible
  on Windows and load-bearing off it.
- **Λ-07** — record the compiler floor, or add `-lstdc++fs` and document why.
- **Λ-10** — one sentence in the platform-support docs: on Linux `vendor/vst3sdk` is
  optional until Λ-W6, so `git submodule update --init vendor/reaper-sdk vendor/WDL` is the
  complete extension-only prerequisite.

**Acceptance criteria.**
- `compile_commands.json` (or a verbose build log) shows an explicit `-O` flag on a bare
  `cmake --build build`. `[verify — Linux]`.
- `nm -D --defined-only reaper_reasampler.so | grep -E 'ReaperPluginEntry|SWELL_dllMain'`
  finds both after the visibility preset. `[verify — Linux]` = **V6**.
- The extension links with `Threads::Threads` **removed**, proving the include-only pthread
  dependency needs no flag — or the symbol forcing it is named. `[verify — Linux]` = **V5**.
- `capture_paths_tests` links without an explicit `-lstdc++fs` on the declared floor, or the
  flag is added and the floor documented. `[verify — Linux]` = **V8**.
- The warning count from the first `-Wall -Wextra` build is **recorded, not fixed**, and
  handed to Λ-W4 as an input.
- Windows build unchanged; `--config Release` still behaves as documented there.

**Prerequisites.** None. Runs concurrently with T1, T3, T4.
**Discharges:** Λ-02, Λ-03, Λ-04, Λ-05, Λ-07, Λ-09, Λ-10; enables V5, V6, V8.

#### Λ-W2-T3 — `panel-dialog-resource` *(gated on Λ-F2)*

**Goal.** The docked bank panel opens on Linux, and if it ever fails to, it says so.

**Surface boundary — owns:** `src/shell/panel/panel_window.cpp` (the `CreateDialogParam`
call and its `if (!g_panel.hwnd) return;` guard, both in `openPanel`, the dialog proc's platform contract, the drop-accept opt-in
also in `openPanel`), `src/resource.rc`, `src/resource.h`, and — **under the resgen route only** —
one `target_sources` line in `src/app/CMakeLists.txt`'s `else()` branch plus a new
include-shim TU. **Does not own:** any other panel TU, `draw_kit`, or any CMake target
property.

**Behavior.** Whichever route Λ-F2 picks, plus, unconditionally: a one-line
`ShowConsoleMsg` on the `!g_panel.hwnd` path naming the missing dialog resource (L2-06).
That single line converts a mystery into a two-minute diagnosis **and is worth having on
Windows too** — land it on both platforms, not behind a guard. The fix is shared
macOS/Linux either way (Λ-D4: made in shared form, verified on Linux only).

**Acceptance criteria.**
- The panel toggle action docks a visible, LICE-drawn bank panel in a Linux REAPER.
  `[verify — Linux]` = **V7**.
- With the resource deliberately unavailable, the toggle prints one console line rather
  than doing nothing. Verifiable on Windows by forcing the branch.
- Dragging a WAV from the file manager onto the docked panel ingests it — or, if it does
  not, the failure is understood rather than mysterious. `[verify — Linux]`, T2 §5 item 3.
  **This criterion's difficulty depends on the Λ-F2 route** — see the fork.
- Windows panel behaviour byte-for-byte unchanged.

**Prerequisites.** **Λ-F2 must be ruled before dispatch.** If it is not, this track slips to
Λ-W4 and Λ-W3's sweep splits into a panel-independent half (run early) and a
panel-dependent half (run after this lands) — a second Linux session, which is the cost of
leaving the fork open.
**Discharges:** Λ-01, L2-06, L2-07; enables V7.

#### Λ-W2-T4 — `locale-independent-numerics`

**Goal.** A persisted float round-trips identically regardless of the process locale, so a
bank index written on a comma-decimal machine is not written unparseable.

**Surface boundary — owns:** `src/core/json/json.cpp` (the `%.17g` writer and the `strtod`
reader), `src/core/model/provenance.cpp` (its own `%.17g`), `src/core/wire/wire.cpp`
(`Cursor::fieldDouble`), `src/core/capture/render_settings.cpp` (the `std::stod` over
REAPER's `P_RAZOREDITS`), and the corresponding `tests/`. **Does not own:** any shell TU,
any CMake file, `wav_codec` (its byte-order handling is already explicit and correct).

**Behavior.** Make the number codec locale-independent at its two writers and three
readers — `std::to_chars`/`std::from_chars`, or a `std::locale::classic()`-bound stream.
**Do not "fix" this by calling `setlocale`**; an extension must not mutate the host's
locale. Add pure tests that pin the emitted text for a fractional value, and that a
fractional value survives a write/read round trip.

Why this is not paranoia: on Windows the CRT starts in the `"C"` locale and nothing here
calls `setlocale`, which is why it has never fired. On Linux, SWELL's GDK backend calls
`gtk_init_check`/`gdk_init_check` and never calls `gtk_disable_setlocale`, and any GTK or Qt
plugin in the same process can do the same (L2-04). The readers are honestly fail-closed —
they require whole-token consumption — so the failure is "the field disappears", not "the
field is silently wrong".

**Acceptance criteria.**
- New pure tests pass **on Windows today**, under a forced comma-decimal `LC_NUMERIC` in
  the test itself. This is the one Λ-W2 track that does not wait for Λ-W3.
- The bank index, view model, tracking ledger, provenance blob and tail setting all
  round-trip a fractional value under that forced locale.
- Byte-for-byte identical output to today's writer under the `"C"` locale — this is a
  persisted format; a changed representation is a compatibility event.
- Nothing on a hot path is touched. The JSON/persist path is declared off all hot paths in
  root `CLAUDE.md`, and this change stays there.

**Prerequisites.** None. **Discharges:** L2-04.
**Note:** T2 §5 item 1 (read `LC_NUMERIC` inside a running REAPER-Linux process) stays in
the Λ-W3 sweep, but only to record how urgent this *was* — the work is not gated on it.

---

### Λ-W3 — First light, and the verification sweep

**One track, deliberately.** This is a person at a Linux box working a checklist where each
answer reprices the next; splitting it across specialists buys no concurrency and loses the
thread. Precedent: Ρ-W1 and Γ-W4 are both single-track waves for the same reason.

#### Λ-W3-T1 — `linux-verification-sweep`

**Goal.** Discharge every acceptance criterion Λ-W2 could not check from Windows, answer
every `[verify — Linux]` item in both audits, and reprice the remaining waves against what
is actually true.

**Surface boundary — owns:** no source file and no CMake file. Its deliverable is a
**verification record** at `docs/product/audit-notes/lambda-w3-verification.md`, one entry
per item: the exact check run, the observed result, and what it changes. Any *fix* the sweep
motivates is filed to Λ-W4, not made here. **The one exception:** a defect that blocks
further sweeping (the build does not link at all) is fixed in place and recorded as a
deviation, because the alternative is a wasted session.

**Behavior — the sweep set.**

| From | Items |
|---|---|
| T1 | **V1** compile, **V2** ctest, **V3** does REAPER's Linux build call `SWELL_dllMain` and populate the API table, **V4** where `UserPlugins/` actually is and whether `reaper_*.so` is the right glob, **V5** pthread link flag, **V6** visibility vs. the two exported symbols, **V7** the docked panel, **V8** `-lstdc++fs`, **V9** does `libSwell.so` sit beside REAPER's executable, **V10** which `uname -m` values the VST3 bundle must carry |
| T2 | process `LC_NUMERIC`; `REAPERAPI_LoadAPI`'s actual return value and the name of any gap; panel file-drop routing; which SWELL GDI/locale build REAPER ships; fontconfig's substitution for "Consolas"; `SWELL_InitiateDragDropOfFileList` acceptance by common targets and whether its 500 ms no-motion timeout cancels a slow gesture; prune against an in-use file |
| New | The `-Wall -Wextra` diagnostic set, counted and categorised; whether `-Wl,--no-undefined` links clean or names an undefined set; whether the four-TU LICE slice links without `lice_colorspace.cpp` (T1 §3 leaves this an unreconciled inference) |

**Three items are load-bearing beyond their own answer and must be run first:**
**V1** (nothing else is observable until it passes), **V9** (a false answer voids Λ-D2's
route and needs a re-ruling before Λ-W6 is dispatched), and the `REAPERAPI_LoadAPI` count
(a non-zero result promotes L2-03 from a diagnostic to a real Blocker and names the gap).

**Acceptance criteria.**
- Every item above has a recorded answer or an explicit "could not determine, because X".
  **A blank is a failure of this track**, not a deferral.
- Λ-W2's four tracks each have their `[verify — Linux]` criteria marked discharged or
  failed, by name.
- Λ-W4 and Λ-W5's scope is restated against the answers, with any effort band that moved
  called out. The audits' bands are provisional by their own statement; this is where they
  stop being.
- Λ-W6's prerequisites (V9, V10) are answered, or Λ-W6 is explicitly blocked pending a
  Daniel re-ruling on Λ-D2.

**Prerequisites.** Λ-W2-T1, T2, T4. **T3 if Λ-F2 was ruled** — otherwise the
panel-dependent items (V7, file-drop routing, and any font check that needs a rendered
panel) are deferred to a second session and that deferral is recorded.
**Discharges:** V1–V10 and T2 §5's seven items, as answers rather than as fixes.

---

### Λ-W4 — Correctness and safety, repriced

**Three tracks, disjoint by directory.** Everything here is known work whose *size* the
sweep may have moved.

#### Λ-W4-T1 — `prune-deletion-safety`

**Goal.** Prune on Linux deletes only what it means to, tells the truth about what it
reclaimed, and tells the user the deletion is permanent.

**Surface boundary — owns:** `src/shell/persist/prune_fs.cpp` (the deletion authority's
non-Windows branch and the reclaim scan), and the prune confirmation text wherever it is
composed (`shell/actions/prune_action` / `shell/panel/panel_bank_ops`). **Does not own:**
`core/reclaim/`'s orphan computation (pure, portable, unaffected), any other persist TU.

**Behavior.**
- **The confirmation string becomes platform-aware** (Λ-D5). On Linux it states the
  deletion is permanent and there is no Recycle Bin. On Windows it says what it says today.
  Same code path, one platform-dependent phrase — not a second dialog.
- **The dead "locked" branch is reckoned with.** `if (ec) return false; // real failure
  (locked/permission) -> skip` encodes Windows file-sharing semantics; on Linux `unlink` on
  an open file succeeds and the branch never fires. Either the branch is documented as
  Windows-only in place, or the Linux path acquires an equivalent guard. **What it must not
  do is stay silently asymmetric** — the recovery floor root `CLAUDE.md` relies on
  ("the superseded file survives on disk until a prune reclaims it") has nothing under it
  on Linux otherwise.
- **The symlink hazard is fixed.** `fs::directory_iterator` + `is_regular_file()` follows
  symlinks under C++17; size is read from the target via `file_size()` but `fs::remove`
  deletes the link, not the target — so prune reports N bytes reclaimed and reclaims zero.
  Symlinked media folders are far more idiomatic on Linux than on Windows. This is a
  reporting *lie*, not a cosmetic issue, and it is not covered by Λ-D5's ruling.

**Acceptance criteria.**
- A Linux prune of a bank file currently playing behaves as recorded in Λ-W3's sweep, and
  the behaviour matches what the confirmation promised. `[verify — Linux]`.
- A symlinked bank file is either skipped, or deleted with its target, and the reclaimed-byte
  figure matches what actually left the disk in both cases. Unit-testable for the
  computation; `[verify — Linux]` for the filesystem half.
- The Windows path — `SHFileOperationW` + `FOF_ALLOWUNDO`, Recycle-Bin recoverable — is
  bit-for-bit unchanged.
- Prune remains the only file-deletion path in the system.

**Prerequisites.** Λ-W3-T1 (the in-use-file check). **Discharges:** L2-05 (both halves) and
the symlink row of T2 §4.

#### Λ-W4-T2 — `linux-font-faces`

**Goal.** The kit asks for faces that exist on a stock Linux distro, so type is chosen
rather than substituted.

**Surface boundary — owns:** `src/shell/panel/draw_kit.cpp`'s five `loadFont` call sites and
the face constants in `draw_kit.h`. **Does not own:** `loadFont` itself beyond the literals,
the palette, any geometry, or the two WCAG `static_assert`s (which are on pixel height and
weight, not on the face, and hold regardless).

**Behavior.** A platform face list at the five call sites: DejaVu Sans / DejaVu Sans Mono
as the Linux defaults, following SWELL's own no-fontconfig fallback list
(LiberationSans/DejaVuSans, LiberationMono/DejaVuSansMono) as precedent. **One code path**,
shared with macOS's eventual San Francisco/Menlo (Λ-D4: made in shared form, not verified).

The subtlety worth carrying into the work: `draw_kit.cpp`'s `loadFont`'s `if (!hf) return` guard does
**not** catch the failure mode here. SWELL's `CreateFont` always returns a non-null handle
even when the face never resolved — the failure is recorded internally as a null
`typedata`, not as a null return. So a wrong or missing face is not observable at the call
site, only in the rendering.

**Acceptance criteria.**
- Every kit string renders in the intended face on a stock distro, and the numeric readouts
  are tabular. `[verify — Linux]`.
- Windows renders Segoe UI and Consolas exactly as today.
- Row heights, ellipsis points and label truncation are unchanged on Windows; on Linux they
  are *measured* rather than assumed correct.

**Prerequisites.** Λ-W3-T1's fontconfig answer (T2 §5 item 5), which decides whether this is
cosmetic or a readability regression. **Discharges:** L2-09.

#### Λ-W4-T3 — `source-partition-and-invariants`

**Goal.** The build's source list stops relying on every TU's own `#ifdef` discipline, and
the invariants Linux weakens are stated where a reviewer will read them.

**Surface boundary — owns:** the `add_library(reaper_reasampler MODULE ...)` source list in `src/app/CMakeLists.txt`
(the *list*; the property blocks are Λ-W2-T2's), any new platform-sibling TU the sweep
showed was needed, `src/shell/actions/drag_out_win.h`'s invariant comment, and the
corresponding `src/shell/**/CLAUDE.md` invariant passages. **Does not own:** any behaviour
change in a shipped code path.

**Behavior.**
- **Λ-06** — partition the source list where the Λ-W3 diagnostic set says a TU needs it.
  `drag_out_win.cpp` is the model (a real `#ifdef _WIN32` / `#else` split);
  `arrange_drop_win.cpp` and `instrument_drop_win.cpp` are `_win`-suffixed for the surface
  they serve, not for a platform dependency, and the audits found them portable by
  inspection — confirm against the actual compile rather than re-inspecting.
- **L2-10** — make `drag_out_win.h`'s file-header invariant comment the doc a Linux reviewer is pointed at, and treat
  "MOVE is structurally impossible" as a Windows-scoped claim. **The wording is Λ-F3's
  ruling**; the edit is this track's regardless of which way it goes.
- **L2-11** — no Linux action. If the predicate is touched at all it becomes
  "case-insensitive filesystem", not "Windows" — but Λ-D4 puts macOS out, so the right move
  is a comment recording the known macOS defect, not a speculative fix.

**Acceptance criteria.**
- No TU compiles on Linux only because of an `#ifdef` that happens to be complete; every
  platform-specific TU is either partitioned in CMake or carries a deliberate, commented
  guard.
- The copy-only invariant's text says the same thing in `drag_out_win.h`, the owning
  `CLAUDE.md`, and any spec text that cites it.
- Zero behaviour change on Windows.

**Prerequisites.** Λ-W3-T1. Λ-F3 for the L2-10 wording only (non-gating: the track can land
the partition and leave the sentence for a follow-up).
**Discharges:** Λ-06, L2-10, L2-11's Linux half.

---

### Λ-W5 — Ship the extension

#### Λ-W5-T1 — `linux-packaging-and-install`

**Goal.** A Linux user can install a correctly-built `reaper_reasampler.so` by following a
document, and a pipeline can install it by following a rule.

**Surface boundary — owns:** an `install()` rule in `src/app/CMakeLists.txt`, `README.md`'s
platform-support and install sections, root `CLAUDE.md` §"Install / reload", and
`docs/product/versioning-and-release.md`'s artifact and pipeline paragraphs.
**Does not own:** any source file, the toolchain properties (Λ-W2-T2's), or CI (Λ-F1).

**Behavior.**
- Document the Linux `UserPlugins/` root as V4 actually found it, and the
  single-config-generator output path (`build/reaper_reasampler.so`) that no doc currently
  names.
- Add the first `install()` rule in the tree, for both channels. The channel fork is
  platform-independent by construction — `REASAMPLER_CHANNEL` threads through
  `configure_file` into names only — so `reaper_reasampler_beta.so` needs no separate
  mechanism, only a separate destination check.
- Amend `versioning-and-release.md`, which already promises three platform artifacts per
  channel per release and mentions no Linux install path, no signing and no CI. Λ-D4 removes
  macOS from the near-term promise; that document should say **two** platform artifacts per
  channel for now, with macOS named as deferred rather than silently dropped.
- **The beta channel on Linux is uncosted in both audits.** It is almost certainly free —
  the fork is name-only — but "almost certainly" is not a ship criterion. Build and install
  both channels side by side once.

**Acceptance criteria.**
- A clean-machine walkthrough: clone, narrow submodule init, configure, build, install,
  restart REAPER, actions present, panel docks. Following only the README.
  `[verify — Linux]`.
- `reaper_reasampler.so` and `reaper_reasampler_beta.so` coexist in one REAPER with separate
  ext-state namespaces, command ids and dock idents. `[verify — Linux]`.
- The installed binary shows an explicit `-O` flag in its build log — the Λ-02 criterion,
  re-checked on the artifact that actually ships.
- `versioning-and-release.md` no longer promises an artifact this phase does not produce.

**Prerequisites.** Λ-W3-T1 (V4), Λ-W4 (all three tracks — shipping means the correctness
fixes are in). **Discharges:** Λ-08, and Λ-02's shipped half.

---

### Λ-W6 — The instrument module, and the host-safety contract

**Two tracks, disjoint: one is build + docs, the other is source.** At the end of this wave
the Linux instrument loads in any host, processes audio, and has **no editor at all** —
which is a defined, verifiable, shippable state, not a half-done one.

#### Λ-W6-T1 — `vst-linux-module`

**Goal.** `reasampler_9000.vst3` configures, builds and installs on Linux as the directory
bundle a Linux host expects, and the decision that forbade it is reversed in writing.

**Surface boundary — owns:** `src/shell/instrument/CMakeLists.txt` (the gate, the entry-point
source selection, the bundle POST_BUILD and install rule, `SWELL_PROVIDED_BY_APP`, the
modstub TU), and the three D5 passages in `src/core/instrument/CLAUDE.md`,
`src/shell/instrument/CLAUDE.md` and `src/shell/panel/CLAUDE.md`. **Does not own:** any
`.cpp` or `.h` under `shell/instrument/`.

**Behavior.**
- **B5 first, as a documentation act.** Rewrite the three D5 passages: platform clause
  becomes "Windows and Linux; the editor is REAPER-hosted", VST3-only and REAPER-only
  survive verbatim. Nothing else in this wave may land before this does — the invariant
  files are what a future implementer reads.
- **B1** — swap `public.sdk/source/main/dllmain.cpp` for `linuxmain.cpp` on Linux. `dllmain`
  includes `<windows.h>` with no `SMTG_OS_*` guard; `linuxmain.cpp` exports `ModuleEntry`
  and `ModuleExit`, **both mandatory** — the SDK's own loader refuses the module without
  either. Both files are already vendored; this is a source swap plus a platform `if()`.
- **Split the `WIN32 AND EXISTS` conjunction** in `src/shell/instrument/CMakeLists.txt`'s `if(WIN32 AND EXISTS ...)` gate.
  The `EXISTS` half stays (a fresh clone with no VST3 slice must still configure); the
  `WIN32` half becomes a Windows-or-Linux predicate.
- **B2** — the artifact becomes a directory:
  `reasampler_9000.vst3/Contents/<uname -m>-linux/reasampler_9000.so`, per V10's answer.
  `Contents/Resources/moduleinfo.json` is **optional** — the SDK's `getModuleInfoPath`
  returns empty when absent rather than failing — so do not author one. Install roots:
  `$HOME/.vst3/`, `/usr/lib/vst3/`, `/usr/local/lib/vst3/`, `$APPFOLDER/vst3/`.
- **`SWELL_PROVIDED_BY_APP` + the modstub TU** are added to this target, in the default
  (non-`SWELL_LOAD_SWELL_DYLIB`) branch. The `dlopen` itself is Λ-W7's; what this track
  lands is the compiled-in, inert table plus the exported `SWELL_dllMain`.
- **The channel fork applies:** `reasampler_9000_beta.vst3` with its own class UID. The UID
  pair is FOREVER-FROZEN and **must not change** — a Linux build is a new platform, not a new
  identity, and a saved project rebinds by UID.

**Acceptance criteria.**
- A Linux configure produces the `reasampler_vst` target; a Windows configure is unchanged.
- The built bundle's directory shape matches what the SDK's `module_linux.cpp` opens, and
  the SDK's own `validator` loads it. `[verify — Linux]`.
- Both channels build and install side by side; the two class UIDs are byte-identical to the
  Windows build's.
- The three `CLAUDE.md` files no longer claim Windows-only, and still claim VST3-only and
  REAPER-only.

**Prerequisites.** Λ-W2-T2 (thread linkage, visibility, warnings), Λ-W3-T1 (V10, and V9 if
Λ-D2 is to survive). **Discharges:** B1, B2, B5, and Λ-10's "vst3sdk is optional on Linux"
caveat becomes conditional.

#### Λ-W6-T2 — `vst-host-safety-contract`

**Goal.** The plugin's editor surface refuses cleanly on every Linux host, so that adding a
real editor later is a change of branch taken and not a change of contract.

**Surface boundary — owns:** `src/shell/instrument/editor_platform.cpp` (the
`isPlatformTypeSupported` / `createView` decision and the non-Windows stubs),
`reasampler_processor.cpp`'s `createView` site, `reasampler_embed.cpp`'s
`REAPER_FXEMBED_WM_IS_SUPPORTED`, and a new availability-probe seam under
`shell/instrument/`. **Does not own:** any CMake file, the paint or input families
(untouched — they stay whole-region-guarded), any pure `core/instrument/` module.

**Behavior.**
- The editor's availability becomes a **tri-state probe** (untried / available /
  unavailable), computed once, lazily, off the audio thread. In this wave the Linux answer
  is unconditionally *unavailable*; Λ-W7 gives it a real computation without changing a
  single call site.
- `isPlatformTypeSupported` returns `kResultFalse` for every type when unavailable;
  `createView(kEditor)` returns `nullptr`. Never a view that fails to attach.
- One diagnostic line per process, naming the reason. Never a modal.
- `reasampler_embed`'s `REAPER_FXEMBED_WM_IS_SUPPORTED` continues to return 0 off Windows.
  That is correct and stays correct until someone decides otherwise; see §"What Phase Λ does
  not do".
- **The Windows path is not restructured to accommodate this.** The probe is a Linux branch
  on an existing decision, not a new abstraction over both.

**Acceptance criteria.** The full observable contract in §"The non-REAPER-host safety
criterion", verified by all four of its checks: `validator` with no `libSwell.so` present,
a real Ardour or Bitwig scan, a REAPER-on-Linux load, and the renamed-`libSwell.so` negative
control. Plus:
- Windows editor behaviour bit-for-bit unchanged — same window class, same `wndProc`, same
  `CS_DBLCLKS` fall-through.
- Nothing added to `process()`; no `dlopen`, no probe, no branch on the per-voice-per-sample
  path.
- **The criteria pass with zero VST3 parameters registered** (see the Γ dependency below).

**Prerequisites.** Λ-W6-T1 (there must be a module to load). Concurrent with nothing else in
this wave. **Discharges:** Λ-D3's Λ-W6 half; L2-08's fallback half.

---

### Λ-W7 — The SWELL bootstrap

#### Λ-W7-T1 — `swell-dylib-bootstrap`

**Goal.** The plugin acquires a working SWELL function table under REAPER on Linux, without
the vendored stub's `exit()` behaviour and without vendoring SWELL.

**Surface boundary — owns:** a new `src/shell/instrument/swell_bootstrap.{h,cpp}`, the
availability-probe computation Λ-W6-T2 left stubbed, and the `SWELLAppMain`-shaped callback.
**Does not own:** any vendored file (nothing under `vendor/` is patched), the CMake source
list beyond adding one TU, or the editor.

**Behavior.** Exactly the four-point implementation shape in §"The non-REAPER-host safety
criterion": never define `SWELL_LOAD_SWELL_DYLIB`; own the load through exported surface
only (`SWELLAPI_GetFunc`, `SWELL_set_app_main`, our own `SWELL_dllMain`); gate on the host
name **and** the `dlopen`; probe once, lazily, off the audio thread.

The failure taxonomy the probe must distinguish, because they need different messages: host
is not REAPER / executable path unresolvable / `libSwell.so` not present at the resolved
path / `SWELLAPI_GetFunc` missing or version-mismatched (the stub checks
`SWELLAPI_GetFunc(NULL)==(void*)0x100`) / API table incomplete. **The last one is not fatal**
— `doinit` substitutes a zero-returning `dummyFunc` for each miss, so a partial table
degrades rather than crashes; whether to accept a partial table or refuse is a judgment for
implementation review, with "refuse if any name the editor actually calls is missing" as the
starting proposal.

**Acceptance criteria.**
- Under REAPER on Linux, the probe reports *available* and the SWELL table resolves with
  zero misses. `[verify — Linux]`.
- Under `validator` with no `libSwell.so` anywhere, the probe reports *unavailable*, the
  process exits normally, and one diagnostic line is printed. **This is the direct negation
  of the `exit(2)` finding and is the track's headline criterion.** `[verify — Linux]`.
- Under Ardour or Bitwig **with** a `libSwell.so` reachable, the host-name gate still
  refuses — proving the gate is on the host, not only on the library. `[verify — Linux]`.
- No vendored file is modified; `git status` under `vendor/` is clean.
- Windows build unaffected — the whole TU is behind a platform guard.

**Prerequisites.** Λ-W6-T1, Λ-W6-T2, and **V9 answered affirmatively**. If V9 is negative,
this track does not exist and Λ-D2 needs a re-ruling.
**Discharges:** B3 (route B3a); Λ-D3's runtime half.

---

### Λ-W8 — The X11 editor

#### Λ-W8-T1 — `x11-embed-view`

**Goal.** The ReaSampler 9000 editor opens, draws and responds under REAPER on Linux.

**Surface boundary — owns:** a Linux sibling to `src/shell/instrument/editor_platform.cpp`
(window creation and parenting, the run-loop timer, the event-driven input path), and the
`#ifdef _WIN32` region boundaries in `reasampler_editor.h` and the eight
`editor_input_*` / `editor_paint*` TUs — **boundaries only, not their contents**.
**Does not own:** `draw_kit`, any pure `core/instrument/` module, any painter's drawing
logic, `instrument_bake`, or the processor.

**Behavior.** The audits cost this at **L**, and call it a new competence rather than a port
(L2-08; T1 B4 = "build S, source L"). The build-side cost is nil — the Linux IIDs are
already in the vendored slice (`commoniids.cpp` defines `Linux::IEventHandler`,
`Linux::ITimerHandler`, `Linux::IRunLoop` under `#if SMTG_OS_LINUX`, and that file is
already in the `vst3_sdk` source list). What must be written:

- `kPlatformTypeX11EmbedWindowID` instead of `kPlatformTypeHWND`; `attachedToParent`
  receiving an X11 window id.
- A `Linux::IRunLoop`-driven timer replacing `SetTimer`/`WM_TIMER` — including the editor's
  sync tick, which the bake's arm-then-run discipline rides on.
- An event-driven input path replacing the `wndProc` switch. `RegisterClassW` /
  `CreateWindowExW` / `DefWindowProcW` have **no SWELL analogue at all** — SWELL has no
  window-class model, only `SWELL_CreateDialog` and raw `HWND__` construction.
- Substitutions the audit already resolved by name: `MoveWindow` → `SetWindowPos`;
  `GetWindowLongPtr`/`SetWindowLongPtr` → the non-`Ptr` forms returning `LONG_PTR`;
  `GetKeyState` → `GetAsyncKeyState`; `TrackMouseEvent`/`WM_MOUSELEAVE` → nothing, so
  hover-leave needs its own derivation (the panel layer already documents the same gap);
  `DragAcceptFiles`/`DragQueryFileW` → the drop path Λ-W2-T3 settled for the panel.

**A worked reference implementation is already on disk and neither audit named it.**
`vendor/vst3sdk/public.sdk/samples/vst-hosting/editorhost/source/platform/linux/` contains
`window.cpp` (returning `{kPlatformTypeX11EmbedWindowID, …}` and answering
`Linux::IRunLoop::iid` from `queryInterface`), `runloop.cpp`, and `irunloopimpl.h` (a
`RunLoopImpl` implementing `registerEventHandler` / `registerTimer` / their unregisters
against `Linux::IRunLoop`). It is the *host* side of the contract rather than the plug-in
side, which makes it a precise specification of what our plug-in side must satisfy. It sits
under `public.sdk/`, so the documented narrow submodule init already pulls it. **This does
not shrink the L band** — it is a reading input, not a library — but it removes the "we are
guessing at the contract" risk from the estimate.

**Acceptance criteria.**
- The editor opens, draws every face identically to the Windows build (compare screenshots
  at the same window size), and every drag, click, wheel and keyboard interaction behaves
  the same. `[verify — Linux]`.
- Hover-leave is correct on every hover surface, without `TrackMouseEvent`.
- The bake's arm-then-run tick fires under `IRunLoop`, and a bake completes end-to-end on
  Linux: staged file, extension action invoked, outcome read back, adopt and reset.
  `[verify — Linux]`.
- **Λ-W6-T2's contract still holds** — a non-REAPER host still gets `nullptr` from
  `createView`. Re-run all four checks; this is a regression criterion, not a new one.
- Nothing added to `process()`. No dispatch added to any per-sample path (the phase-wide
  structural heuristic in root `CLAUDE.md`).
- Every new file lands under the ~600-line ceiling with a responsibility seam, not a
  bisection. The editor's existing band-axis split (`_chrome` / `_waveform` / `_deck` /
  `_browse` / `_curve`) is the seam vocabulary to reuse — the Linux platform TU is a sibling
  to `editor_platform`, per L2-08's own direction: "it needs a sibling, not a rewrite."

**Prerequisites.** Λ-W7-T1. **Discharges:** B4, L2-08.

---

### Concurrency, and the shared files

**Wave order is serial; tracks within a wave are concurrent.** Two deliberate exceptions to
the strict reading:

- **Λ-W6 may run concurrently with Λ-W4 and Λ-W5.** It touches `src/shell/instrument/` and
  that directory's CMake and `CLAUDE.md` files, plus `src/core/instrument/CLAUDE.md` — none
  of which Λ-W4 or Λ-W5 opens. The only reason to serialise is attention, not contention.
- **Λ-W6-T2 is prerequisite-gated on Λ-W6-T1** (there must be a module before it can refuse
  to show a view). They are file-disjoint but not order-free — the same shape PLAN.md
  already records for Γ-W3 ("T1 before T2 — serial").

**Shared files, named** — all textual adjacency, not semantic contention, unless marked:

| File | Tracks | Nature |
|---|---|---|
| `src/app/CMakeLists.txt` | Λ-W2-T2 (property + platform blocks), Λ-W2-T3 (one `target_sources` line, **resgen route only**), Λ-W4-T3 (the source list), Λ-W5-T1 (the `install()` rule) | Four disjoint regions of one file. Λ-W2-T2 and Λ-W2-T3 are the only pair in the same wave; one line each. |
| `src/shell/panel/draw_kit.cpp` | Λ-W2-T1 (`loadFont`'s `CreateFont` args), Λ-W4-T2 (`kitFontsInit`'s five `loadFont` call sites) | Different waves. |
| `src/shell/instrument/CMakeLists.txt` | Λ-W2-T2 (thread linkage), Λ-W6-T1 (gate, entry point, bundle, install), Λ-W7-T1 (one added TU) | Different waves. |
| `src/shell/panel/panel_window.cpp` | Λ-W2-T3 alone | **Deliberately not split.** The L2-06 diagnostic and the Λ-01 resource route are the same function; under the resource-id-0 route they are the same *line*. Splitting them would be semantic contention. |
| `src/shell/instrument/editor_platform.cpp` | Λ-W6-T2 (the refusal branch), Λ-W8-T1 (the real branch) | Different waves; the second replaces the first's computation without touching its call sites. |

---

## Cross-phase dependency: Γ-W4-T1

**Verified against `docs/PLAN.md` while writing this: `Γ-W4-T1 vst3-parameter-set` is
listed as pending** (PLAN.md §Γ-W4, and in the plan's summary map). Its own spec states the
current position plainly: *"Today the plugin has zero parameters"* —
`ReaSamplerProcessor::initialize` never populates `SingleComponentEffect::parameters`, so
`getParameterCount()` returns the SDK default 0. The T2 audit confirms the same by grep.

**Why it matters to Λ.** The host's fallback when a plug-in reports no usable editor is its
**generic parameter UI**. With zero parameters registered, that fallback is empty — so
today, "no editor" degrades to *nothing*, not to *controls*. Once Γ-W4-T1 lands its 44
derived parameters, the identical Λ code path degrades to a usable generic UI instead.

**The dependency and its direction:**

- **Λ does not block Γ**, and **Γ does not block Λ.** Λ-W6-T2's acceptance criteria are
  written to pass with zero parameters — "the host shows its generic UI, which may be
  empty" is a pass. Nothing in Λ is scheduled against Γ.
- **Γ landing strictly improves Λ's user-visible outcome**, at no cost to Λ. If Γ-W4-T1 is
  already on `dev` when Λ-W6-T2 is verified, the tester will see a populated generic UI;
  that is a better result, not a different criterion.
- **Λ must not register any VST3 parameter itself.** Γ-W4-T1's `ParamID` table is
  FOREVER-FROZEN from the moment it ships, on the same footing as the command-id strings and
  the class UIDs. A parameter minted in Λ to make a Linux fallback look better would
  collide with a table Λ does not own. **This is a hard boundary, and it is the only
  Γ↔Λ interaction that could actually go wrong.**
- **Another team is running Γ concurrently. Λ assumes no schedule for it** — not "Γ will
  land first", not "Γ will land later". If a Λ track's brief needs a Γ fact, it reads
  `dev` at dispatch time.

---

## Calls made here (product-designer calls, not forks)

Two questions the audits raised as `[Daniel]` that this doc answers rather than escalates.
Contradict either in review with an argument.

**Silent font substitution is not acceptable; the kit gets an explicit Linux face list**
(T2 [Daniel] 3, landed as Λ-W4-T2). The reasoning is `docs/product/visual-design-language.md`:
the kit's type is part of a deliberate visual identity, and the palette-role discipline
exists precisely so a visual direction is a single-file change rather than an emergent
property of the host. Letting fontconfig pick is the opposite of that. The cost is five
string literals. The one thing that would change the call is if the sweep shows the stock
substitution is *already* the intended face on every target distro — unlikely, and it would
make the face list a no-op rather than wrong.

**The `[verify — Linux]` items are not forks and do not wait for Daniel.** T2's [Daniel]
list included items that a Linux box settles (which SWELL build REAPER ships, whether
fontconfig lands Consolas on a monospace face, whether drag-out is accepted as a copy).
Those are Λ-W3 sweep items. A question is only a fork here if reading code and running a
Linux box both leave it open.

---

## What Phase Λ does not do

- **macOS.** Λ-D4. Shared-form edits are made and noted as shared; no macOS build, no macOS
  verification, no signing or notarization, no `swell-modstub.mm`-under-CXX-only
  investigation, no fix for L2-11's case-insensitive-filesystem defect.
- **XDG trash.** Λ-D5. Hard `unlink` with a platform-aware confirmation. The XDG spec
  (`~/.local/share/Trash` plus a `.trashinfo` sidecar) is a self-contained move-plus-metadata
  write and remains a clean follow-up if a Linux user ever asks for it — file it to
  `docs/TODO.md`, do not smuggle it into Λ-W4-T1.
- **Route B3b's dependency surface.** Λ-D2. No vendored SWELL build, no GDK/GTK3, no
  FreeType, no Fontconfig, no OpenGL, no `pkg-config` in this tree. If a track finds itself
  reaching for one of those, the design has drifted and the track stops.
- **An editor in a non-REAPER host.** Λ-D3 requires safe degradation, not capability. Even
  with `libSwell.so` reachable, a non-REAPER host has no SWELL message loop, so the
  host-name gate refuses on purpose.
- **The TCP/MCP embed strip on Linux.** `reasampler_embed`'s
  `REAPER_FXEMBED_WM_IS_SUPPORTED` keeps returning 0 off Windows. It is a second 0→1 on a
  read-only secondary surface, its paint body is LICE and would port, and it becomes
  genuinely cheap once Λ-W8 lands. Deliberately out, and worth revisiting after.
- **VST2 / AU / CLAP / standalone.** D5's format and host clauses survive Λ-D1 untouched.
- **CI.** Λ-F1 is open; until it is ruled, Λ ships nothing that presumes a runner.
- **Any parameter registration.** Γ-W4-T1's, exclusively. See above.
- **Windows behaviour changes.** Every track carries a "Windows unchanged" criterion. This
  is a port, and a port that improves Windows by accident has also changed Windows by
  accident.

---

## Open forks — Daniel's

### Λ-F1 — Does CI get built in this phase, and on what runner? *(audit D4, unruled)*

**No recommendation.** This one is genuinely a resourcing call, and both sides are
defensible enough that a product-designer preference would be noise.

**For building it now:** `versioning-and-release.md` already commits to multiple platform
artifacts per channel per release and hands "the pipeline" to dev-ops — and there is no CI
configuration anywhere in the repo, on any platform (`.github` and `.gitlab-ci.yml` are both
absent). The moment Linux ships, the tree has two toolchains and one of them is not on the
developer's machine. Every Windows-only commit after that is a Linux regression waiting to
be discovered by a user. A GitHub-Actions job running `cmake` + `ctest` on Ubuntu would
catch L2-01-class breakage — an undefined Win32 symbol — at push time, which is exactly the
class of defect this whole phase exists to clear.

**For deferring it:** CI is infrastructure, not product, and this phase is already the
largest thing in the plan. A runner also forces Λ-F4 (the support floor) to be answered
immediately, because the runner image *is* the declared floor. And CI's value is highest
*after* the first Linux build works, not before — a red pipeline on day one teaches nothing
the Λ-W3 sweep is not already teaching.

**What closing it unblocks:** whether Λ-W5-T1 writes a pipeline paragraph or a
"deferred to dev-ops" paragraph, and whether Λ-F4 must be closed in this phase or can be
carried. Nothing is gated on it before Λ-W5.

### Λ-F2 — The dialog-resource route: resource-id-0, or resgen? *(audit D7, unruled)*

**This is the only fork that gates a track.** Both audits now carry the evidence.

**Route A — the resource-id-0 escape hatch.** SWELL documents it in
`swell-functions.h:606–608`: a `CreateDialog` creating a child window may pass resource id
0, which creates an opaque child window, provided a `WNDPROC` returning `LRESULT` (cast to
`DLGPROC`) is passed instead of a real `DLGPROC`. The implementation confirms both halves —
`swell-dlg-generic.cpp` skips the resource lookup entirely when `resid` is 0. And
`IDD_BANK_PANEL` is precisely the case it was written for: `src/resource.rc`'s `IDD_BANK_PANEL` dialog block is a
`WS_CHILD` dialog with an empty `BEGIN`/`END` body and zero controls, whose own header
comment says "the bank_panel shell owns every pixel and draws the sample grid with LICE in
`WM_PAINT`". **Taking this route deletes the entire resgen pipeline from the non-Windows
builds** — the PHP dependency, the generated-file-in-the-source-tree problem, the
per-platform regeneration story, and the three stacked defects in the current commented-out
instructions. Cost: a source change in `panel_window.cpp` and the DLGPROC→WNDPROC return
contract.

**Route B — wire up resgen properly.** `find_program(PHP …)`, an `add_custom_command`
generating into `${CMAKE_CURRENT_BINARY_DIR}` (never the source tree — `.gitignore` has no
pattern for the generated name), a one-line shim TU that includes `swell-dlggen.h` then the
generated file, and that shim added to `target_sources`. This is the M end of Λ-01's band.

**The asymmetry neither audit stated, and it is the reason this is worth ruling rather than
delegating.** L2-07 establishes that SWELL's only opt-in surface for `WS_EX_ACCEPTFILES` is
the **dialog resource** — `swell_resgen` translates a dialog's `WS_EX_ACCEPTFILES` style
into `SWELL_DLG_WS_DROPTARGET`, and `swell-dlg-generic.cpp` sets the ex-style from that flag
at creation time. **Under Route A there is no resource, so that bit can never be set from
one.** L2-07's own analysis says the bit only *suppresses* the unhandled-drop
forward-to-parent and that the drop reaches `dlgProc` anyway via the GDK backend's
`ChildWindowFromPoint` descent — and notes, correctly, that with zero child controls the
descent has nowhere to land but the panel HWND itself. That reasoning is good but it is
**reasoning, not a run**. So:

- Route A is cheaper and structurally simpler, and it stakes the panel's file-drop ingest —
  one of three ingest surfaces — entirely on that unverified descent.
- Route B is more machinery and one more build-time dependency, and it can set the bit
  explicitly if the descent turns out not to be enough.

**What closing it unblocks:** Λ-W2-T3's dispatch, and therefore whether Λ-W3 is one Linux
session or two. **Leaving it open has a real cost and it is the only fork here that does.**

**A third option, if Daniel wants the cheap route without the exposure:** take Route A and
treat the file-drop check as a hard gate in Λ-W3's sweep — if the drop does not arrive,
Route B becomes a follow-up track rather than a rewrite, because the panel is already
rendering by then and the resgen work is additive. That is the option I would take, and it
is stated as an option rather than a recommendation because it spends a second Linux session
in the bad case.

### Λ-F3 — Does "copy-only is structural" survive as a shipped invariant? *(T2 [Daniel] 4, unruled)*

**Recommendation: keep the invariant, scope the *enforcement* claim to Windows.** The
product promise ("dragging a bank file out of ReaSampler copies it; the bank is never
raided by a drop target") stays; the *mechanism* sentence in `drag_out_win.h` becomes
"structurally enforced on Windows via `DoDragDrop`'s `DROPEFFECT_COPY`-only mask;
advertised, not enforced, on SWELL, which takes no effect mask."

**The counter-argument is real.** An invariant that one platform cannot enforce is arguably
not an invariant, and the tree's house style treats invariants as load-bearing rather than
aspirational. Weakening the *global* wording to "copy-only, best effort" would be the honest
alternative — and it would also correctly warn a Windows reader not to rely on the guarantee
in shared code. What that loses is a genuinely stronger Windows property, stated as weaker
than it is.

**Non-gating.** Λ-W4-T3 makes the edit either way; only the sentence changes. Answerable at
implementation review.

### Λ-F4 — What is the declared support floor? *(new; the audits raised the inputs, not the decision)*

The audits surface three separate manifestations of one unmade decision: Λ-07 (no stated
minimum compiler; GCC 8 needs an explicit `-lstdc++fs` for `std::filesystem`, GCC ≥ 9 does
not), V8 (the same, as a check), and V10 (which `uname -m` values the VST3 bundle must
carry — `module_linux.cpp` keys the bundle directory off exactly that string, and which
architectures REAPER itself ships for Linux is an external fact with no source in this tree).

**Recommendation: declare a narrow floor — current-stable-distro glibc, GCC ≥ 9,
`x86_64-linux` only — and widen it on request.** ReaSampler is a per-project capture tool
for people running a commercial DAW; the audience running a five-year-old toolchain on
armv7 is small, and every architecture in the bundle is a build target someone has to
maintain and verify.

**The counter:** REAPER's own Linux reputation is partly built on running well on modest and
non-x86 hardware, and `aarch64` in particular is no longer exotic. Adding it later means a
second bundle directory and a second verification pass on every future release, which is
cheaper to establish once than to retrofit.

**What closing it unblocks:** Λ-W2-T2's compiler-floor line, Λ-W5-T1's install and README
text, Λ-W6-T1's bundle directory set, and Λ-F1's runner image. **Non-gating for Λ-W2** (a
recorded floor can be widened), **gating for Λ-W5** — a shipped artifact has to say what it
runs on.

---

## Where the audits disagreed, or left a hole

Recorded so a reader knows which parts of this doc are synthesis rather than citation.

1. **The `WS_EX_ACCEPTFILES` / resource-id-0 interaction is a genuine gap between the two
   audits.** T1's Λ-01 recommends the id-0 route and says it makes resgen disappear; T2's
   L2-07 independently establishes that the drop-accept ex-style bit can only come from the
   dialog resource. Neither doc composed the two. §Λ-F2 does, and it is the substantive
   reason that fork is worth ruling rather than delegating to review.

2. **T2 flags its own severity inconsistency and hands it on.** L2-03 is graded Blocker on
   failure-mode quality with no direct evidence; L2-04 is graded Major with a confirmed
   mechanism and an equally severe outcome. T2 says explicitly that resolving the axis is a
   scope call for whoever prioritises the two. This doc **dissolves rather than resolves**
   it — both land in Λ-W2, in different tracks — so the grade never has to be adjudicated.

3. **The absent-`libSwell.so` failure mode was flagged unverified and is, in fact,
   readable.** Both audits treat it as a `[verify — Linux]` question. It is not: the
   vendored `swell-modstub-generic.cpp` calls `exit(2)` on a failed `dlopen` from a static
   constructor, and `exit(1)` on an incomplete API table. That is a fact about a file in
   this tree, and it converts Daniel's Λ-D3 from a defensive precaution into a specific
   design constraint on the ruled route. Filled here, in §"The non-REAPER-host safety
   criterion".

4. **Neither audit swept the VST3 SDK's `samples/` tree.** Both enumerate the vendored
   *slice* the build compiles, which is correct for their questions, but
   `public.sdk/samples/vst-hosting/` is on disk under the documented narrow submodule init
   and contains two directly relevant things: `validator/` (a headless non-REAPER host
   harness — the right instrument for Λ-D3's acceptance criteria) and
   `editorhost/source/platform/linux/` (a worked `Linux::IRunLoop` implementation and an
   X11-embed window). Named in Λ-W6-T2, Λ-W7-T1 and Λ-W8-T1. **This does not move the L
   band on L2-08** — the audits' estimate stands; it removes a "we are guessing at the
   contract" risk from it.

5. **The beta channel on Linux is uncosted in both audits.** T1 confirms the channel fork is
   platform-independent by construction and stops there; neither audit builds, installs, or
   coexists two channels on Linux, and neither considers the VST3 bundle's per-channel name
   and UID on that platform. Almost certainly free; assigned to Λ-W5-T1 and Λ-W6-T1 as an
   explicit criterion rather than an assumption.

6. **Two loose ends left as-is, deliberately.** T1's `lice_colorspace.cpp` question (SWELL's
   own Makefile lists a fifth LICE TU our four-TU slice omits; the audit calls it
   "unreconciled but harmless") and the `-Wl,--no-undefined` question are both answered by a
   single successful Linux link. Both are Λ-W3 sweep items, not findings.

---

## Wave map

```
Phase Λ — ReaSampler on Linux                    (extension + ReaSampler 9000; macOS out)
  W1  The audits                                                          [COMPLETE]
      T1 build-toolchain-audit ....... Λ-01..Λ-10, V1..V10, D1..D7
      T2 source-runtime-audit ........ L2-01..L2-12

  W2  Make it buildable, and make it honest             [4 tracks, file-disjoint]
      T1 linux-compile-blockers ...... L2-01, L2-02, L2-03      -> V1, V2
      T2 toolchain-floor ............. Λ-02..Λ-05, Λ-07, Λ-09, Λ-10  -> V5, V6, V8
      T3 panel-dialog-resource ....... Λ-01, L2-06, L2-07       -> V7   [GATED: Λ-F2]
      T4 locale-independent-numerics . L2-04     [the one track verifiable on Windows]

  W3  First light, and the verification sweep           [1 track, deliberately]
      T1 linux-verification-sweep .... V1..V10 + T2 §5's seven; deliverable is a
                                       record, not a fix. V1 / V9 / the API-load count
                                       run first — each reprices what follows.

  W4  Correctness and safety, repriced                  [3 tracks, disjoint by dir]
      T1 prune-deletion-safety ....... L2-05 both halves + the symlink reclaim lie
      T2 linux-font-faces ............ L2-09
      T3 source-partition-and-invariants . Λ-06, L2-10, L2-11 (Linux half)

  W5  Ship the extension                                [1 track]
      T1 linux-packaging-and-install . Λ-08 + Λ-02's shipped half + both channels

  W6  The instrument module, and the host-safety contract   [T1 before T2 — serial]
      T1 vst-linux-module ............ B5 (the D5 reversal, first), B1, B2
      T2 vst-host-safety-contract .... Λ-D3's observable contract; passes with zero params

  W7  The SWELL bootstrap                               [1 track]
      T1 swell-dylib-bootstrap ....... B3 via route B3a, WITHOUT the stub's exit(2)
                                       [prereq: V9 affirmative, else Λ-D2 re-rules]

  W8  The X11 editor                                    [1 track]
      T1 x11-embed-view .............. B4, L2-08. The phase's one L-band source item.

  W6 may run concurrently with W4 and W5 — file-disjoint; the only reason to serialise
  is attention. W2's edits are authored BLIND and their acceptance criteria are
  discharged in W3; W2 is not "done" until W3 runs, and the plan says so rather than
  pretending otherwise.
  Open: Λ-F1 (CI), Λ-F2 (resource route — the only one that gates a track),
  Λ-F3 (copy-only invariant wording), Λ-F4 (declared support floor — gates W5).
```