feat(playback): deliver automation to hosted plugins

[shipyard-local]

Delivers RT-exact timeline device automation into hosted plugin nodes (last piece of Gate 5). Stacks on #6474 (rebased onto main after it landed).

What it does

A claimed plugin node receives sample-accurate automation via an owner-claimed, exact-generation parameter mailbox that is distinct from the live host/UI mailbox. The claimed node is excluded from anticipation (must run live to observe the real playhead) and rejects live injection while the timeline binding owns it.

Task fixes

• B1 (Add planning as private submodule, codify planning workflow #11) ramp collapse — delivery now pushes events at the ramp start offset with ramp_duration_sample_frames preserved, instead of collapsing to a zero-duration endpoint step. A hosted adapter that consumes the ramp duration glides instead of stepping.
• B2 (Add compute pipeline, CI failover, SDK commands #12) passkeys, not raw friends — SnapshotParameterIngressPasskey + ExactParameterNodeClaimPasskey (private ctor, friended to the timeline files, taken by value) replace the two raw friends in the generic headers. ExactParameterIngressOwner's definition moved into the signal-graph TU via a factory (header keeps a forward decl). Zero Timeline identity hardcoded into the generic layer.
• B3 (Phase 1: Core Foundations — SIMD, platform utils, XML/ZIP, networking #13) configurable limits — TimelineGraphBindingConfig::automation_limits added (defaults to AutomationPlaybackLimits::platform_defaults()), wired to the renderer at build/adopt.

Coverage-preserving design

Rather than repurposing #6474's generic public ExecutionSnapshot::inject_parameter_events (live mailbox), this adds a separate passkey-gated inject_exact_parameter_events (exact mailbox, claimed-only) for delivery. #6474's two test_host_signal_graph tests are preserved byte-identical and pass unchanged.

Hardening

• A one-line invariant comment at the exact-append site documents the sole-writer guarantee.
• A compile-time static_assert(AutomationPlaybackLimits::kMaximumEventsPerDevicePerBlock <= ParameterEventQueue::kCapacity) couples the two constants the no-retry-starvation proof depends on.

Should-fixes (in-file, binding not split)

• fail_closed() helper extracted from the 5 near-identical process() cleanup blocks (preserves "both cleanups always run").
• reconcile_track_connections() seam extracted from build_candidate().

Validation

Full all-targets Release build clean. Reviewed twice (author negative-control proving the anticipation exclusion is load-bearing + independent adversarial pass; both clean, no must-fix). Suites on the rebased tree: pulp-test-host-signal-graph 7501 assertions / 113 cases, pulp-test-timeline-graph-binding 1597 / 39 (incl B1 ramp + param-cursor glide + B3 limit-propagation tests), pulp-test-host 878 / 29. gates.sh + docs_noise_lint clean. Version-at-land (no chore: bump commit).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TVQHcnbg3t6TvXsdv6gXhS

---

🔎 Provenance

Agent	claude
Machine	m3
Tab	Timeline v3
Directory	/private/tmp/claude-501/cte-g5pr4
Session	c66f4a64-25ea-42e5-b184-d48611a066a2

Resume

claude --resume c66f4a64-25ea-42e5-b184-d48611a066a2

Jump to this tab

cmux surface focus C0B3DA54-39AF-4DAA-8089-AA08DAB71968

Relaunch (any agent)

cmux surface resume get --surface C0B3DA54-39AF-4DAA-8089-AA08DAB71968

Restore URL — https://claude.ai/code/session_01TVQHcnbg3t6TvXsdv6gXhS

_{stamped 2026-07-23 02:28 UTC}