OPM.js is a client-side, four-operator FM synthesis library. It processes voice definitions, DX7 SysEx and PCM buffers, and runs real-time DSP in an AudioWorklet. It has no application server or authentication system and has zero runtime dependencies. The host application remains responsible for website security, untrusted downloads, resource budgets and safe audio presentation.

For installation, browser deployment, and API examples, start with the README or the English / Traditional Chinese usage guide.

Contents: Supported versions · Reporting a vulnerability · Safe embedding · Threat model · Security review mechanism · Non-goals

The current checkout requires Node.js 22 or newer for Node usage and development. Browser applications require ES modules, AudioWorklet and a secure context (HTTPS or localhost). The Node requirement does not provide a browser sandbox or replace browser updates.

Use a complete distribution from a known checkout or package, not individual modules from unrelated builds. Check CHANGELOG for observed verification; an advertised feature or configured CI job is not proof that every runtime or platform has passed.

Report exploitable problems privately to the repository maintainer. Use the GitHub private vulnerability reporting form when it is enabled. If a private reporting route is unavailable, request a private contact method without publishing exploit details, sensitive files or a proof of concept.

Include enough information to reproduce the issue safely:

• The affected OPM.js version or commit, and whether the behavior uses src/, committed dist/, or an installed package.
• Node/browser version, operating system, sample rate and relevant deployment or routing configuration.
• A minimal input and sequence of API calls or worklet messages, including expected and observed behavior.
• The apparent impact: code execution, validation bypass, excessive CPU/memory use, processor failure, unexpected audio, or data exposure.
• Relevant errors, diagnostics and whether the issue reproduces with a freshly built, matching distribution.
• Any proposed fix or mitigation, and whether the report may be credited publicly.

Do not include credentials, private voice banks, personal recordings or unrelated user data. Use a synthetic input when possible. Minimize denial-of-service examples; do not test against other people's websites or production audio sessions.

The acknowledgement target is 72 hours, on a best-effort basis, not a guaranteed response or remediation deadline. Coordinate public disclosure with the maintainer so affected users can receive an actionable fix or mitigation. Ordinary usage questions may use public issues; exploitable details should remain private.

• Serve the complete, matching dist/ tree over HTTPS or localhost, preserving worklet and imported-module paths. A configurable worklet URL must stay same-origin, use HTTPS/loopback HTTP, contain no credentials/fragment, and retain CSP/MIME enforcement. Do not load through file://, and retain LICENSE.
• The root index.html, examples/ pages, favicon.ico and this policy are public website assets. Publish the build-generated doc/ HTML, stylesheet and search assets together with the matching documentation sources.
• The Python development server is for local checks, not a hardened public host. A production server should not expose .git/, .dev/, node_modules/, development tooling, credentials or directory listings.
• Serve JavaScript with a JavaScript MIME type. Use X-Content-Type-Options: nosniff; do not return an application's HTML fallback for a missing worklet/module URL.
• Apply a host-specific Content Security Policy that allows only reviewed module origins, restricts framing and base URLs, and disables unnecessary object embedding. Check the script and worklet/worker directives applicable to each supported browser.
• The checkout examples use external module scripts and a local stylesheet. They need no unsafe-eval. Do not weaken CSP, TLS or browser permission/autoplay controls to suppress a deployment error.
• WAV Blob URLs are data downloads, not executable modules. Do not broaden script origins simply because downloads use blob: URLs.
• Only enable browser features that the host needs. Synthesis does not require microphone, camera or location access. Test playback, worklet loading and download behavior after changing hosting headers.

Use loadVoice(), normalizeVoice(), validateVoice() or parseVoiceBank() at the appropriate documented boundary; do not send unchecked definitions straight into the DSP or raw worklet protocol.

Single-voice APIs reject out-of-range fields. Bank validation clamps finite numeric fields to documented bounds, but still rejects malformed types, non-finite numbers and invalid version/algorithm/feedback values. Clamping is not a substitute for validation.

Keep allowlisted, own-data copying at trust boundaries. Do not merge untrusted objects into prototypes, invoke getters to inspect them, or treat a valid voice name as authorization to construct a URL or filesystem path. Engine bank parsing does not load paths or fetch voice URLs.

Independent note gain and expression are both bounded to 0..1 and multiply before stereo mix saturation. Layer fades do not bypass control validation, note ownership, worklet queue limits or rejection reporting.

Versioned score-project parsing accepts only the documented own-data schema, detached validated voices, bounded beat events and synthesis settings. Loading a project does not fetch assets, execute code or start playback. Compilation converts note gate endpoints through the complete tempo map; offline resource budgets still apply after conversion.

The separate version-1 Arrangement project uses the same own-data beat/voice/settings boundaries and one pure definition validator shared with live arrangements. Bounds include 8 MiB serialized input/output, 128 voices/256 KiB voice JSON, 16 layers, 32 sections and 65,536 total events. Parsing is inert; persisted musical definitions do not include live IDs, permissions, pending commands or DSP state. Host replay must explicitly load validated voices and start from a gesture.

The independent Standard MIDI file adapter validates native bytes, bounded chunks, PPQN timing and event framing. It does not provide a native MIDI driver, transmit SysEx or interpret uploaded bytes as executable content. Hosts must check file size before buffering, choose explicit channel-to-voice mappings, expose import warnings and reject unsupported export semantics instead of silently changing a score.

Opt-in expressive SMF conversion separately bounds generated per-note fanout to 65,536 events. Frozen loss summaries separate omitted content, approximations and recognized source-message counts. Channel expression after a closed gate reports possible patch-dependent release-tail loss; strict unsupported policy rejects it. Export rejects incompatible channel ownership, unsupported controls and after-gate semantics rather than guessing. Explicit pitch-range policy is not RPN support.

The engine does not provide a voice-download API. Host loaders must validate the source and enforce an input budget before buffering or parsing. Engine checks cannot recover memory already consumed by an oversized download.

• Check HTTP status and permitted origins before accepting a response; do not derive destinations from an untrusted voice name.
• Treat declared MIME type, file extension and Content-Length as hints, not evidence that the payload is valid or bounded. Chunked and decoded/compressed responses still need a real byte budget.
• Bound streamed response bytes and cancel an oversized transfer before assembling the complete buffer. Set host-appropriate cancellation and time limits.
• Check a local file's size before arrayBuffer() or text decoding, then validate its actual contents. A picker selection is not a trust guarantee.
• Do not insert filenames, imported descriptions or error messages into HTML. The examples display them as text; retain that separation in host UIs.
• Apply application-level limits to repeated uploads, repeated parsing and simultaneous synth instances. A per-call limit is not a whole-page resource quota.

importDX7() and describeDX7() accept one Uint8Array containing a standard 163-byte single-voice or 4104-byte 32-voice bank message. Length, framing, checksum and seven-bit payload checks reject malformed input. The playground checks the maximum file size before buffering.

This is approximate six-to-four-operator voice conversion, not a DX7 emulator or an arbitrary SysEx interpreter. Conversion does not execute the payload. Review the returned descriptions and warnings before auditioning a patch; keep descriptions outside the strict voice schema.

encodeWav() encodes PCM; it does not decode/play uploaded audio. Own-data arguments are left, optional right, sampleRate and optional format (pcm16, pcm24, float32). Native Float32 samples must be finite in −1–1; stereo lengths match, with at most 4,000,000 frames per channel for this full-buffer convenience API.

Project render results onto those fields rather than forwarding diagnostics or other metadata. Reject encoding/rendering errors visibly instead of substituting a fake result.

Core rendering authenticates native Float32Array kind/length instead of overridable properties. Validate offset before deriving the default length; numeric coercion, proxies, forged channels and out-of-bounds ranges reject without advancing sound. Idle clearing uses the native fill method. Hosts still own the actual PCM storage and must not mutate it concurrently.

Offline rendering allocates output buffers and executes synchronously. The host should limit duration, sample rate, envelope tails, concurrent requests and export frequency to suit its device and UI. Valid input may still consume significant time and memory; no universal deadline or whole-page memory guarantee is made.

Long-score rendering and incremental createWavEncoder() use bounded reusable PCM/encoded chunks, not unlimited aggregate buffers. Consume borrowed PCM before advancing; declare an exact encoder frame count and finalize only after all frames. Encoder chunks are 1–65536 frames and RIFF32 files remain <4 GiB; convenience rendering/encodeWav retain their 4,000,000-frame bound. Hosts must bound cumulative duration/work, retained bytes, concurrent renders and export frequency.

renderSequenceInWorker() validates before Worker allocation, transfers at most one unacknowledged encoded chunk and awaits sink writes before advancing. Capture intrinsic byte counts before handing ownership to a sink; storage workers may transfer/detach the buffers. Progress/abort callbacks are untrusted host behavior. Native AbortSignal cancellation terminates/rejects immediately without waiting for hung writes/abort/close. The sink owns invalidation and rollback; cancellation cannot retract persisted bytes. Acquire file sinks from trusted gestures, retain lifetime cancellation across picker/writable awaits, and clean up acquisition failures before starting a Worker. Never replace a long-file sink with unbounded Blob accumulation.

Create download URLs only for successfully encoded bytes. Replace/revoke obsolete Blob URLs and release them when the owning page or component is disposed. Treat filenames and rendered audio as potentially private application data.

• Await start() in a user interaction and monitor onEvent or independent subscribe() listeners. A note ID is not admission; handle rejections, terminal states and processor errors. waitForCommand() is bounded, timed/cancellable and resolves admission only, not future execution; reset/close/failure invalidate pending waits.
• The worklet bounds pending events and tracked note IDs to 256 each. Schedule bounded batches rather than flooding the port with distant-future events.
• The optional effects worklet (worklet/fx-processor.js) has a separate strict own-data update/reset/close protocol. Chorus/reverb numbers and voice counts validate again before entering DSP; no command queue is retained and at most 32 commands are admitted per audio-frame boundary. Error replies are bounded and close remains available under flooding. MessagePort buffering before dispatch and many host-created instances remain host resource concerns.
• Effects module loading uses the same secure same-origin URL rules and native CSP/MIME enforcement as synthesis; deploy the full matching tree. Effects never resume, suspend or close a borrowed context. Processor/decode failures surface through onEvent; dispose disconnects/stops only the insert.
• Effects preallocate bounded seconds-scaled Float64 delay state (under 866 KiB at 192 kHz), sanitize NaN/Infinity PCM to zero, clamp internal state and flush tiny values. Offline tail-extended copies obey the existing 4,000,000-frame budget. Wet headroom is not a limiter for over-unity input or a host mix of many buses.
• Each synth limits logical voices to configured 1–32 (default eight), with up to eight bounded stealing fades. Immutable eco/standard/high profiles change fixed internal sampling/filter work, not these bounds. These limits do not constrain an attacker creating many instances.
• DSP state and terminal notification buffers are preallocated. Ended/error callbacks run after stable frame traversal; callback-admitted replacements start next frame, and recursive rendering rejects rather than extending a frame's work.
• Named/prepared worklet registrations use 128 content-keyed LRU slots. Replacement revalidates before committing; queued/active notes own immutable old snapshots. Raw objects still validate freshly.
• Absolute start/stop/control times are safely framed with a 60-second future horizon; stop precedes onset and controls. Command rejection is correlated by commandId; accepted means admission, not guaranteed future execution. Global allNotesOff/panic bypass full scheduled queues. Bound sequences and lookahead rather than flooding messages.
• Immediate stop(id, { cancelControls: true }) removes only that ID's queued automation/onset/off before natural release; it cannot be combined with at. Musical Transport retains release-tail controls during ordinary playback but cancels its own future automation on pause/seek/loop rebuilding. Seeking is a musical restart, not an exact DSP snapshot.
• Performance cleanup is part/helper scoped, not global panic. Repeated equal-pitch keys retain separate identities; stealing/reset cannot resurrect stale held/pedal state.
• Handle rejected diagnostics promises and failed node initialization. Do not hide failure behind mock audio nodes or a fallback engine.
• A shared AudioContext is borrowed: OPM disconnects its node but never closes/suspends the host context. close() is restartable; terminal dispose() clears owned helpers/subscriptions without taking ownership of a borrowed context. Hosts own downstream routing and permissions.
• Clear host gate bookkeeping on global reset; close/failure need not reply with every terminal note. Default cancel removes old gates/automation on suspension/interruption; preserve is opt-in. Both policies stop lookahead and require gesture-driven explicit restart.
• The recovery harness bounds local events/attempts and captures explicit device metadata, observations and manual scenario status. It uploads nothing. Automated desktop checks cannot certify physical phones or listening continuity; support-matrix cells without physical evidence remain unverified.
• Provide obvious play/stop controls and begin at a comfortable, low host gain, especially with headphones. Finite samples and synthesis headroom do not guarantee safe listening volume.

Every distribution JS has a matching source map with embedded TypeScript and a compiler-generated declaration. Publishing maps intentionally makes the implementation source readable; minification is not secrecy. Never place credentials or private configuration in source that will be built or deployed.

OPM.js does not provide an account, storage or telemetry service. Hosting providers and applications can still record request metadata or persist voices/audio. Document those host-specific behaviors separately and do not claim this library prevents data collection by the surrounding page.

Keep each deployment's JS, maps and declarations from the same build. Review exact development dependency versions, build plugins, CI actions, package contents and license compatibility before changing the supply chain.

An AudioWorklet separates real-time processing from the main thread, but is not a security boundary against a compromised host page. Malicious host JavaScript can create nodes, spam messages, fetch data or manipulate the UI independently of OPM.js. Input validation and per-instance limits reduce accidental or adversarial input damage; they do not sandbox XSS or guarantee availability under arbitrary page load.

Ordinary properties or accessors installed on Object.prototype or Array.prototype must not forge trusted snapshots, substitute data after validation, defeat ownership checks, redirect filesystem paths, or make a capacity check disagree with its copy loop. Validated copies therefore define their own data: array elements, optional object fields (object-literal spreads, which define rather than assign), descriptor literals (null prototype, because Object.defineProperty also reads inherited descriptor fields) and the state of the Synth, OPM and worklet-processor classes (real class fields, not declared ones assigned in the constructor). Reads of an omitted optional field are own-property reads (Object.hasOwn, a static method that no Object.prototype hook can intercept) at note admission, live note controls, engine options (null-prototype result), effects sections, MIDI export controls, Performance baselines, loaded-voice freezing, the sequence release-tail bound, the reserved layer gain check and Transport seek reconstruction, so an inherited value cannot reach those consumers without passing validation. Bookkeeping objects whose optional fields are assigned or read later (Transport and Arrangement gates, Arrangement commands, MIDI-import held notes, MIDI-adapter controller mappings) start with own undefined slots, so an inherited setter cannot swallow the write and an inherited getter cannot answer the read. Not covered, and listed in the review record below: a latent GainChange.activation read in Arrangement (no reachable path found), tempo-point curve/endBpm reads that stableTempoContext already guards, internal bookkeeping arrays (which use push), and several ownership candidates (Performance part updates, MIDI-adapter ownership, arrangement reserved gain, asset-inventory paths) that remain unresolved. None is waived merely because the hook runs in the same realm, and downstream numeric validation does not establish part ownership, reserved-control policy or path containment. Replacing native intrinsics remains outside this review's assumptions; OPM.js does not sandbox compromised host code.

This policy addresses the library and checkout examples. Authentication, authorization, cookies, cross-origin access, backend storage, upload endpoints and rate limiting belong to the application deploying them.

A security review is required before:

• Any release tag (vX.Y for zero patch versions, vX.Y.Z otherwise)
• Merging a PR that touches: src/worklet/, src/core/, or voice parsing (src/voices/, src/api/ loaders)
• Adding any dependency, build plugin, or CI action
• Supporting a new voice-bank source (file import, URL, user paste)

A. Untrusted data (voice banks, config)

• Voice JSON/key scaling, score projects, SMF/DX7 binary input, and WAV arguments validate type, shape, length, numeric bounds, and own-data properties before use
• Explicit allowlisted copying; no spreading/merging untrusted objects into prototypes; no accessor invocation
• Numeric bounds cover ADSR/live reanchoring, ratio/fixed-Hz controls, rate scaling, pitch envelope, LFO waveform/delay/sync/phase/targets and independent depth/rate, feedback, velocity/pan, levels and ramps; tuning/score/Transport/performance/encoder limits remain bounded and legacy shapes exclude later fields
• Prepared identity cannot be forged, trusted patches stay deeply immutable, and public map snapshots cannot change stored patches
• Application file/URL loaders bound sources, content type, and payload before buffering; engine does not fetch URLs
• DX7 rejects invalid length/framing/checksum/seven-bit payload; conversion descriptions remain outside strict voice schema

B. Worklet boundary

• Every raw message is checked for strict own-data shape before reads, enqueueing, or rendering
• No eval/Function execution or nonliteral dynamic imports in source/generated JS; configurable worklet/Worker URLs require secure same-origin assets and cannot weaken CSP/MIME validation
• Duplicate IDs reject before enqueueing; tracked IDs/events remain bounded; ended/stolen/error notes remove obsolete off events
• Held-note cancellation/release, bounded allNotesOff/panic, command admission/rejection, context/reset and processor failure propagate safely; teardown does not promise impossible per-note acknowledgements
• Registration replacement, controls, tuning, score IDs/times and absolute scheduling validate own-data shape; queued snapshots, ordering and cleanup preserve bounds
• Encoded Worker chunks require ordered acknowledgements, intrinsic byte accounting before sink ownership transfer, exact frame/file completion and termination on cancellation/failure; host sinks own rollback

C. DSP loop safety

• Output is finite: any NaN/Infinity in the render loop snaps to silence and increments an error counter (Synth.errorCount or renderNote()'s diagnostics.errors)
• Fixed work ceiling: configured 1–32 logical voices (default eight) and at most eight fades, deterministic priority-aware admission/stealing, authenticated native output lengths and numeric ranges before work
• Slot reset/recycling preserves identity and numerical state under callback admissions; terminal callbacks cannot replenish a frame's traversal or recursively render it
• Determinism and chunk-independent output preserved; live/offline LFO, timing, filtering, stereo, velocity, and saturation parity
• Deadline statistics exclude warmup and expose p95/p99/worst/misses without universal performance promises; spectral acceptance is controlled, not arbitrary FM alias-free proof

D. Supply chain

• Zero runtime dependencies still holds (npm ls --omit=dev is empty)
• Dev dependencies and CI actions pinned to exact versions/commit SHAs
• package.json files whitelist ships only intended dist/ assets, usage docs, and legal/project files
• Standalone deployment retains the installed LICENSE alongside complete matching worklet/module assets; CSP/MIME/404 failures stay visible
• Any npm publication requires separate maintainer authorization, protected approval, matching tag/version/commit/release and independent A/B/C/D/package evidence, plus a reviewed provenance-bearing publishing path; post-publication checks compare exact tarball bytes, validate source provenance and cryptographically verify signatures before registry-installed consumer acceptance. This checkout has no npm publishing workflow; local verification is not publication.

Run development commands from a source checkout after npm ci; installed npm packages do not contain the development tooling.

• npm run build then npm test — source/distribution behavior, malformed-input, deterministic rendering, and spectral regression coverage
• npm run typecheck — strict source, development tools/tests/demos, and NodeNext consumer against generated public declarations
• npm run security -- --package-smoke — TypeScript compiler AST gate over source and Acorn gate over generated JS, exact development pins, zero runtime dependencies, isolated installed exports/type smoke
• npm audit and npm audit --omit=dev — record actual tooling/runtime audit results; runtime dependency tree must be empty
• npx --no-install playwright install --with-deps chromium then npm run browser-smoke -- chromium — real AudioWorklet smoke; Firefox/WebKit alternatives are configured separately
• Headless Linux Firefox requires a running native audio server. CI starts PulseAudio and a null sink before real worklet smoke; it does not mock audio or relax browser permission/autoplay controls. Consult the usage guides for setup and stage diagnostics.
• npm run benchmark — host-dependent 128-frame render deadlines, with optional explicit budget environment variables
• npm run sound-quality / npm run voice-quality — numerical/register/velocity matrices and controlled spectral reports, not perceptual/hardware-fidelity proof
• npm run browser-stress -- chromium — real bounded worklet contention/lifecycle/queue checks; timer/round-trip data are not CPU, GC or glitch counters
• npm run vite-smoke — installed artifact, non-root production base, license, actual audio, CSP and negative MIME/404 scenarios; audit standalone tooling from examples/vite too
• Follow publishing prerequisites before any authorized npm upload; source review cannot establish external environment protections, registry authentication or provenance

Each release notes in the CHANGELOG which checklist sections were exercised (A/B/C/D) and by whom. Checklist failures block release; waivers require a written reason in the CHANGELOG.

Unreleased idle-render/tempo/input-boundary review: IdleSecurity found no remaining supported-input checklist A/C blocker in the drained-FIR history-scan shortcut (filtering still advances), post-callback remainder clearing, immutable tempo prefix cache and effects offset validation before arithmetic. Its initial shared-array length-coercion finding was reproduced, fixed and rechecked: primitive safe-integer length validation precedes comparisons/traversal, retaining the 1024-point/8192-byte prefix ceiling. Review also covered mirrored histories, DC tails, callback bounds, native overlapping/subrange fills, exact frame accounting, prefix addition order, weak cache lifetime and rejected effects calls preserving delay/ramp state. It ran no runtime gates; this is scoped static inspection, not release approval or physical-device/listening acceptance.

The follow-up public tempo-conversion review also found no A/C blocker in reusing exact privately registered multi-point snapshots after BPM validation. Raw arrays, copies and proxies still validate; immutable data may share identity, now documented in the exported normalizer comment and README. This was read-only applied-source review, not runtime or release approval.

The follow-up incremental WAV review found no A/C regression in reusing private dither working storage with a success-only scalar seed commit. Rejected chunks retain accounting/noise continuity; metadata-triggered nested admission commits before the outer transaction begins. Native samples are still captured once, emitted bytes retain separate ownership, and channel/chunk/RIFF32 bounds are unchanged. IdleSecurity performed read-only applied-source inspection; runtime gates are recorded separately in CHANGELOG, not asserted by this review.

The sequence lower-bound follow-up found no scoped A/C regression. IdleSecurity confirmed that negative descriptor lengths reject before array traversal/snapshot allocation, while Number.isInteger short-circuiting still prevents object coercion and valid zero/upper bounds remain unchanged. This closes silent malformed-input acceptance, not a demonstrated resource-budget bypass. Review was read-only and ran no gates; the integration owner separately exercised all five public preparation/capacity/render entrypoints.

The unchanged-LFO-rate follow-up found no scoped A/C regression. IdleSecurity confirmed that only a genuine first rate change enables accumulated phase; controls still validate before application, other supplied fields are not skipped, and requesting the current rate during an existing live ramp still cancels it. No render-loop work, allocation, message shape or input bound was added. This was read-only applied-source inspection, not runtime or release approval.

The prepared-sequence-voice follow-up found no scoped A/C blocker. IdleSecurity confirmed that reuse is restricted to exact members of the existing private WeakSet after deep freezing, including separately frozen LFO target tuples. Raw values, frozen copies and proxies still normalize freshly; named lookup retains native Map operations. Shared patch data does not share slot-local oscillator/control state, and all short/long/render admission bounds remain unchanged. The weak registry does not keep unused patches alive. Review was read-only applied-source inspection and ran no runtime gates; it is not release approval.

The terminal-sequence-queue follow-up found no scoped A/C blocker. IdleSecurity confirmed per-renderer queue ownership, final clearing only after PCM rendering and frame accounting, unchanged cursor-based diagnostics/capacity, idempotent cancellation and unchanged return/abort dispatch. Completion invokes no new public cancellation hook or user callback; caller events, other iterators, shared patches and PCM are not mutated. Cleanup releases bounded queue-only references, not necessarily immediate GC or patches retained by callers/pooled slots. This was read-only applied-source inspection without runtime gates or release approval.

The JSON-byte-check follow-up found no scoped A/C blocker. IdleSecurity confirmed that the three-bytes-per-UTF-16-unit upper bound only skips certainly bounded inputs; larger text retains exact UTF-8 checking and oversized code-unit counts still reject before parsing. Canonical v1–v8 bank conversion validates ASCII names/enums, fixed keys and finite numbers before export; the null-prototype copier still excludes inherited JSON hooks. Exact-limit inclusion, byte ceilings, detached ownership and schemas remain unchanged. Review covered the applied guards, canonicalization and new/existing boundary and export-hook regression sources. It was read-only inspection without runtime gates or release approval.

The default-note-options follow-up found no scoped A/C blocker. IdleSecurity confirmed that the validation bypass requires strict identity with the module-private frozen complete default; caller objects, frozen copies and proxies retain their descriptor boundary. Admission immediately destructures primitive values without exposing or retaining the shared object. Defaults, ID/admission ordering and voice/fade bounds are unchanged, with no new per-frame work. Review was read-only applied-source inspection without runtime gates or release approval.

The subscription-ownership follow-up found no scoped lifecycle/input-boundary blocker. IdleSecurity confirmed clearable private callback records, idempotent unsubscribe, success/failure disposal clearing the shared Set, and restartable close preserving subscriptions. Dispatch retains ordered snapshots, skips removals, defers additions, preserves plain-call receiver/legacy ordering and isolates exceptions; the empty-registry guard does not change nonempty dispatch. Lookahead stop removes its record without clearing the callback needed for restart. Review was read-only applied-source inspection without runtime gates or release approval; executing callbacks may remain live until return.

The designer-file-ownership follow-up found no scoped UI blocker. IdleSecurity confirmed generation/lifetime checks after reading but before parsing or retriggering, stale error suppression, current-only chooser cleanup, and pagehide invalidation that survives pageshow. File size still rejects above 16 KiB before buffering; the model retains separate exact UTF-8 and strict schema checks. Independent audio generations and DSP are unchanged. Started reads are ignored rather than cancelled, without a new aggregate in-flight quota. This was read-only UI inspection without runtime gates or release approval.

The playground-DX7 follow-up found no scoped UI/input-boundary blocker. IdleSecurity confirmed that merged candidates commit through whole-bank validation before local lookup/option changes, preserving prior voices on rejection and the distinct default brass during initialization. Generation/lifetime checks suppress stale commits, errors and chooser cleanup; the 4104-byte pre-read bound remains, without cancelling started reads. The FrozenVoice input declaration adds no runtime trust: frozen entries still undergo full validation and detached copying, while CompleteVoiceInput remains unchanged. This was read-only applied-source inspection, not runtime or release approval.

The command-cancellation follow-up found no scoped cancellation/input/lifecycle blocker. IdleSecurity confirmed intrinsic signal authentication and shadow-accessor bypass, exact abort-reason preservation including null, and fallback allocation only when the native reason getter is absent. The private omitted-outcome marker is used only by cancellation; acknowledgement, timeout and lifecycle settlement still supply defined outcomes. Idempotent settlement, shared timer/listener cleanup, waiter/counter bounds and registration-race checks remain intact. Cancellation still affects only its waiter, not sibling waits or command receipt outcomes. This was read-only applied-source inspection without runtime gates or release approval.

The Worker-handoff follow-up found no scoped handoff/lifecycle/input blocker. IdleSecurity confirmed release of captured payload bindings after native cloning and on cleanup, with readiness/settlement guards preventing reuse. Chunk bytes clear in finally before awaiting, including synchronous throws, only from the private mutable own-data copy; incoming messages and sink-owned buffers remain unchanged. Intrinsic accounting precedes handoff, while metadata, backpressure, post-await cancellation checks, error propagation and no-wait abort behavior remain intact. This removes identified library references, not independently held sink data or a guarantee of immediate GC. Review was read-only applied-source inspection without runtime gates or release approval.

The Worker caller-input/observer follow-up found no scoped lifecycle/input/reentrancy blocker. IdleSecurity confirmed that inner closures capture validated settings rather than the complete options copy, and terminal paths drop private sink-copy, receiver and observer bindings only after rollback invocation and terminal notification. Local callback snapshots preserve executing notifications under reentrant cancellation; settlement guards prevent resumed async paths from accessing cleared bindings. Original objects/receivers, first-failure identity and non-awaited rollback remain unchanged. This was read-only applied-source inspection without runtime gates or release approval; reference clearing is not an immediate-GC guarantee.

The terminal-stream follow-up found no scoped lifecycle/input/reentrancy blocker. IdleSecurity confirmed eager score/density checks, cancellation before cleared-score access, and queue construction before snapshot release. Stop drops private score/normal-observer bindings without weakening ID/queue teardown; failure handling snapshots its observer before cleanup. Only an in-flight startup retains the separate final error observer, cleared before rejection notification or on successful/cancelled settlement. Existing callback-throw propagation and first-error identity for nonthrowing observers remain. This was read-only applied-source inspection without runtime gates or release approval; release of host references does not guarantee immediate GC.

The lookahead-disposal follow-up found no scoped lifecycle/input/reentrancy blocker. IdleSecurity confirmed that stop retains restart callbacks, while idempotent disposal clears only its private callback/observer bindings in finally, including when reporting throws. Context/stop/pump snapshots preserve an executing operation's final failure notification under reentrant disposal. Existing exception boundaries, input validation and batch/gate limits remain; disposed/generation checks prevent late startup from restoring the cleared observer, and post-callback running checks prevent admission after self-disposal. This was read-only applied-source inspection without runtime gates or release approval.

The inactive-targeted-LFO follow-up found no supported-input A/C blocker. IdleSecurity confirmed eager finite/bounded depth and target validation even when inactive, exact-unity scratch refresh before pitch glides read targeted factors, and unchanged delay/analytic/global/live-rate clocks. Unconditional live-clock advancement, numerical guards and bounded work remain; only redundant inactive-factor arithmetic is skipped, with no allocation, parser, protocol or signature change. Direct mutation of internal target arrays was outside this supported-input scope. This was read-only applied-source inspection without runtime gates or release approval.

The unity/zero-weight target-mask follow-up found no supported-input A/C blocker. IdleSecurity confirmed complete validation of detached frozen tuples before classification, reset/copy of all four weights on every admission, shared-factor selection for all-unity masks in static/dynamic pitch and AM, and continued unity refresh for nonuniform masks. Depths, modulation and targets remain eagerly finite/bounded even when inactive; clocks, work bounds and numerical-containment checks remain unchanged, without new allocation or persistent state. Caveat: direct nonfinite injection into internal LFO/target state can be masked by zero weights or shared-factor paths rather than counted; internal mutation is unsupported, and these checks are not comprehensive corruption detection. This was read-only applied-source review, without runtime gates or release approval.

The musical error-callback follow-up found no scoped lifecycle/input/reentrancy blocker. IdleSecurity confirmed that only private Transport/Arrangement error bindings clear on permanent disposal, including through gate-stop failures; pause/stop and natural completion retain restart callbacks. Failure paths snapshot their listener before normalization/cancellation, preserving plain-call receivers, existing exception behavior and the executing notification under reentrant disposal. Public snapshots/caller objects remain unchanged; eager own-data validation and generation/disposed guards preserve bounds, stale-start suppression and rejection propagation. This was read-only applied-source review without runtime gates or release approval; reference clearing is not an immediate-GC guarantee.

The Performance/MIDI callback-ownership follow-up cleared only private bindings while retaining listeners for entered observations, pending port opens and failed forced-release retries. Scoped review identified intermediate notification losses across channels/inputs; entry/disposal-wide snapshots resolved them. Review also found pre-existing refresh continuation after error-callback disposal; a terminal cutoff now prevents later input attachment/opening instead of retaining invalid post-disposal work. IdleSecurity's final read-only review found no remaining lifecycle/input/reentrancy blocker, with eager validation, scoped ownership, receiver and exception boundaries intact. It performed no runtime gates and is not release approval.

The zero-pitch-factor follow-up found no supported-input A/C blocker. IdleSecurity confirmed unconditional start/end evaluation in the original order, equivalent positive unity for both signed-zero exponents, and the unchanged exponential path for nonzero/nonfinite starts. Substep progression still computes/advances when a zero start has a nonzero end; validation, containment, all clocks and frequency/glide/envelope ramps remain unchanged. No allocation/state was added, and default static voices do not enter the dynamic-pitch path. This was read-only applied-source review without runtime gates or release approval.

The lazy fixed-Hz ratio follow-up found no supported-input A/C blocker. IdleSecurity confirmed that only unused, side-effect-free interpolation becomes lazy in frequency sampling/retuning; voice/control validation remains eager for both ratios and fixed Hz. Ratio timelines, logical tuning updates for voices/fades, used-branch arithmetic, frequency/pitch/substep progression, caps and containment remain unchanged. No allocation/cache/traversal was added. Unused corrupted internal ratio state was already excluded from fixed-Hz arithmetic; this is not a broader internal-state validation guarantee. The review was read-only without runtime gates or release approval.

The zero-swing chorus follow-up found no supported-input A/C blocker. IdleSecurity confirmed the same centred delay for both signed zeros, unchanged nonzero-swing arithmetic, and continued phase, delay, feedback and reverb progression even during dry bypass. Eager own-data/range validation, bounded ramps, buffer authentication and sanitation remain intact; no state/allocation/work-bound expansion was added. Caveat: directly corrupting private phase to NaN now avoids invalid delay reads while swing is zero; it is not publicly reachable, FX has no error counter, and output sanitation remains. This was read-only source review without runtime gates or release approval.

The effects API observer-ownership follow-up found no scoped ownership/lifecycle/input blocker. IdleSecurity confirmed that first disposal clears only the private observer before all node/no-node cleanup, while terminal paths snapshot it before cleanup or potentially reentrant error conversion. Entered notifications/original thrown values and synchronous callback isolation remain intact; stale handlers cannot revive the cleared binding, and recoverable replies keep the observer active. Validation, message allowlists, secure same-origin URLs and borrowed-context ownership are unchanged. The deterministic regression covers terminal notifications, frozen events, strict receiver and teardown-before-callback with throwing/reentrant observers. This was read-only review without runtime gates or release approval; clearing references does not imply immediate GC.

The invariant WAV-format follow-up found no supported-input A/C blocker. IdleSecurity confirmed that per-call flags derive from a private validated three-format Layout that is neither exposed nor mutated, so they cannot become stale during encoding. Sample capture remains once per value with finite [-1,1] validation before writing; quantization/endian order, Float32's 58-byte header and unaligned data offset, PCM24 sign/padding bytes, frame/channel/RIFF limits, output allocation and success-only frame/dither commit are unchanged. Existing format, split-parity, late-rejection, dither and hostile-metadata regressions remain applicable. Caveats: forged private Layout mutation violates internal preconditions, and shared PCM is captured per sample, not as a whole-buffer atomic snapshot. This was read-only scoped review without runtime gates or release approval.

The terminal chunk-render ownership follow-up found no supported-input A/C blocker. IdleSecurity confirmed error snapshots precede release of private Synth/buffer/signal references, repeated cancellation preserves diagnostics, and terminal guards prevent cleared-reference access. Stack-local live buffers preserve final returned arrays/views; capacity/frame/event/error metadata remain available to Worker/full-buffer callers. Natural completion uses private cleanup, while existing return() and observed-abort dispatch through the public method remains intact. Validation, render/work bounds and numerical containment are unchanged, including empty scores' positive 10 ms tail. Caller PCM and signal listeners are untouched, and the regression covers all four terminal paths. This was read-only scoped review without runtime gates or release approval.

The live-edited positive-sustain follow-up found no supported-input A/C blocker. IdleSecurity confirmed that the shortcut requires a held, post-attack/decay envelope with no sustain-rate decay and dB strictly above the floor; every substep therefore uses the identical edited fastExp2 expression, not the bit-distinct unedited sustain gain. Static-zero classification remains earlier, while floor, moving, sustain-rate and release paths stay unchanged. Release, later ADSR edits and pooled admissions invalidate steady gains; eager validation, numerical containment and traversal ceilings remain intact. No fields/allocation were added. Direct mutation of private envelope fields without invalidation can leave caches stale and remains unsupported. This was read-only applied-source review without runtime gates or release approval.

The priority-pruning follow-up found no supported-input A/C blocker. IdleSecurity confirmed that the selected voice already has the lowest eligible priority encountered, so a strictly higher-priority candidate cannot replace it under any policy. Equal/lower-priority comparisons, quietest bookkeeping, release/age ties and refusal stay unchanged. Skipped audibility/envelope/ramp helpers perform only reads/math, with no clock advancement, mutation, callback or containment check omitted. Eager validation/refusal still precede ID consumption and pool mutation; victim lifecycle, fade bounds and render-time numerical containment remain intact. No allocation/state/traversal was added. Directly corrupted internal voices remain unsupported; audibility was never an input-validation boundary. This was read-only applied-source review without runtime gates or release approval.

The steady-audibility-gain follow-up found no supported-input A/C blocker. IdleSecurity confirmed that only gainsSteady permits reuse of constant Float64 frame gains; otherwise evaluation uses the current admission time. Admission/release/ADSR invalidation stays complete, including normal sustain's precomputed arithmetic and edited sustain's distinct exponential. Static-zero carriers contribute the same finite zero, while operator/expression/layer ramps, carrier order, tie-breaking, bounds and render containment remain unchanged. No state, explicit allocation or traversal was added. Direct corruption of private gain arrays or validity flags remains unsupported; they are not public validation boundaries. This was read-only applied-source review without runtime gates or release approval.

The expressive-MIDI quantization follow-up found no scoped A/C blocker. IdleSecurity confirmed that validated CC7×CC11 candidates are exact integers in 0..16129: an error below half a unit cannot improve, and exact half-unit ties retain the first winner through descending CC7 order and strict improvement. The IEEE-rounded target, signed-zero handling, full own-data/finite validation, wire serialization and export budgets remain unchanged. Unavailable nearest products still use the bounded full search. No state or allocation was added, and work remains capped at 127 iterations. This was read-only applied-source review of quantization, validation, serialization/bounds and boundary regressions, without runtime gates or release approval.

The pooled-sustain admission follow-up found no supported-input A/C blocker. IdleSecurity confirmed that sustain is validated, detached and deeply frozen before private prepared identity grants trust. Fresh/null or different slot identities recompute canonical dB/gain; identical identity reuses only operators not marked live-ADSR-edited. Edits mark dirty before writing, and admission inspects flags before clearing them. Release, normal/error retirement, fade recycling and panic preserve these constants/flags; admission completes before reentrant callbacks. Note-, velocity- and rate-dependent state remains fresh, with no new fields, retention, allocation or unbounded work, and existing render containment stays intact. Direct internal array/flag corruption can invalidate reuse but no supported public-input path was found. This was read-only applied-source/identity/lifecycle/bounds/regression review without runtime gates or release approval.

The pooled-envelope-coefficient follow-up found no supported-input A/C blocker. IdleSecurity confirmed reuse requires identical privately prepared identity, pristine operator state and exactly zero/omitted rate key scaling; every positive value, including Number.MIN_VALUE, recomputes. Zero and negative-zero scaling produce an exact unit multiplier, leaving canonical durations note-independent. The owning Synth has no supported sample-rate/oversampling mutation, and rendering/recycling do not modify cached coefficients. Live ADSR marks dirty before writing; admission checks flags before clearing them. Original arithmetic/caps, signed-zero results, timeline/gain/release/history reset and callback ordering remain unchanged. Extreme coefficients retain original IEEE results, including possible overflow; this does not promise universally finite internal coefficients. Existing finite-output/error containment remains intact, with no new fields, allocation or retention. Direct readonly/internal-state mutation is unsupported. This was read-only applied-source/identity/lifecycle/bounds/regression review without runtime gates or release approval.

The Worker-cloned-patch follow-up found no supported-input A/C blocker. IdleSecurity confirmed that the sole production caller supplies owned native-message clones to synchronous preparation: no caller aliases, Proxy traps or callbacks can mutate accepted cloned fields between occurrences. First encounters still fully normalize, deeply freeze and privately brand a new snapshot before cache insertion; invalid data cannot populate it. Accepted voice parameters are detached scalar/plain-array data, not SAB-backed mutable values. The invocation-local WeakMap follows array-budget/key validation, is bounded by distinct note voices and is not retained by the renderer. Distinct identities remain distinct. All public factories retain the uncached raw path, preserving per-occurrence and cross-call mutation/Proxy semantics. No protocol marker, option, budget, parser or render-control relaxation was added. The owned-clone factory is internal, absent from the public core facade/package subpath exports, and requires its documented provenance precondition. This was read-only applied-source A/C review without runtime gates or release approval.

The immutable-score preflight follow-up found no supported-input A/C blocker. IdleSecurity confirmed that only newly created, successfully validated frozen output arrays become private weak keys; raw/frozen-lookalike/Proxy/cloned/independent-module arrays cannot inherit membership. Options and native Map branding validate before lookup; hits enforce event/horizon and short note/slot limits, while ineligible conversions fall through the original rejection path. Snapshot values contain immutable scalars, frozen wrappers, deeply frozen prepared voices and copied/frozen control tuples/ADSR objects. Engine, tuning, frame, chunk and signal validation stays fresh; no render plan, queue, DSP, callback or PCM state is cached. The root-to-array backreference creates no independent strong key registry. Caller-held arrays may intentionally retain the metadata wrapper; otherwise-unheld cycles remain eligible for collection. Cancellation's private-state release is unchanged. This was read-only applied-source A/C review without runtime gates or collection-timing verification, not release approval.

The immutable-control dispatch follow-up found no supported-input A/C blocker. IdleSecurity confirmed that only successfully validated, fully copied/frozen output roots enter the private WeakSet; raw inputs, frozen lookalikes, Proxies, clones and independent-module snapshots cannot forge membership. Own-data/accessor checks, scalar/tuple/ADSR bounds and empty/glide/ramp dependencies remain intact. Native message clones validate before Worklet admission/queueing; only local dispatch reuses their immutable data. Validation still precedes inactive-note lookup, context-specific MIDI restrictions still run, and current per-note clocks, ramps, envelope anchoring and coefficients are never cached. Weak membership stores no strong payload values. This scoped static review ran no runtime gates, verified no GC timing and is not release approval.

The scalar-ADSR-bound follow-up found no supported-input A/C blocker. IdleSecurity confirmed that replacing temporary bound tuples with scalar ternaries preserves inclusive a/d/r 0–10, s 0–1 and sr 0.01–100 limits. Signed zero and positive subnormals retain their previous acceptance; sr below its minimum still rejects. Non-numbers, NaN and infinities reject without coercion. Optional-sr presence, the single ownKeys snapshot, descriptor/accessor checks, read/error order, copying, deep freezing and private snapshot registration are unchanged. No supported-input validation bypass was found. This scoped static inspection ran no runtime gates and makes no allocation, GC or release-approval claim.

The final-Performance-composition follow-up found no supported-input A/C blocker. IdleSecurity confirmed that the private values builder only composes owned part/key data; public controls still validate before entering that state. Final retarget validation, including original-gate baseline resets, precedes ownership mutation. Final admission validation precedes dispatch within existing failure cleanup. Key and part updates retain complete preflight and rollback. Registry replacement does not replace a held gate's baseline; foreign-module consumers still receive ordinary fully validated data without a cross-module trust assumption. No cache, retained live-state alias, callback opportunity or unbounded work was added. This scoped static inspection ran no runtime gates and is not release approval.

The fixed-shape-Performance follow-up found no supported-input A/C blocker. IdleSecurity confirmed that supported patch-loading paths produce four dense immutable operators; explicit baseline literals retain fresh tuple/root ownership and the same immutable ADSR children. Retargeting mutates only its fresh owned temporary, preserving glide precedence/property order before the original reset/final-validation and gate-mutation boundary. Original-gate defaults, rollback, reentry guards, cleanup and foreign-module validation remain intact. The final adjustment preserves the original first feedback dereference when a configured named patch has been removed. No cache, shared mutable tuple or exported contract was added. This scoped static inspection ran no runtime gates, excludes arbitrary built-in corruption and is not release approval.

The Worker-owned cloned-controls follow-up received a final-source scoped A/C review with no findings. Successful full validation precedes local identity-table insertion; only detached deeply frozen outputs are reused, with no raw-clone branding or serialized trust marker. The controls table is lazy, bounded by the existing event budget and synchronous preparation lifetime, and does not escape into rendering. Public raw/frozen-lookalike/foreign inputs retain per-occurrence validation/detachment; event descriptors, contextual/resource checks, error precedence, current-clock DSP application, ramps and ADSR reanchoring remain fresh. Existing validator freezing makes the removed outer freeze redundant. No exported contract, protocol, dependency or global raw-input cache was introduced. This static review ran no runtime checks and is not release approval.

The static sequence-event schema follow-up received a final-source scoped A/C review with no findings. Four private readonly field-name lists preserve the original allowed/required contents, order and branch selection. The validator only reads them and never exposes references to callers or input callbacks; reentry cannot mutate shared validation state. as const is compile-time only, but no supported reference-escape or mutation path exists. Initial/later type-descriptor behavior, rejection precedence, raw freshness, existing immutable-score/Worker-clone identity boundaries and fresh DSP application are unchanged. Added module lifetime is fixed string metadata, not caller data. This static review ran no runtime gates, excludes arbitrary built-in corruption and is not release approval.

The private preparation-default/options-schema follow-up received a final-source scoped A/C review with no findings. Only an exact unexported frozen complete library default bypasses redundant option normalization, following the existing Synth convention; no reference escapes. Its own voices: undefined prevents inherited registry access. Caller objects, empty/frozen/lookalike/Proxy/foreign inputs retain full validation, and native Map checks plus applicable score limits still precede metadata reuse. Settings, frame budgets, signal and DSP boundaries remain fresh. Shared schema lists are private/read-only in use and contain no caller data. The consumer regression restores any prior prototype descriptor in finally before assertions/rendering, with no asynchronous gap while modified. This static inspection ran no runtime gates and is not release approval.

The owned-absent-registry/render-schema follow-up received a final-source scoped A/B/C review with no findings. IdleSecurity confirmed that only strict undefined, taken from already-inspected own-data options or the beat helper's registry argument, selects the existing private complete preparation default; nonundefined registries retain fresh schema/native Map checks. Outer caller/sink/signal/settings validation and exact error order remain intact. Private readonly render field lists preserve contents/order and both full-render scans, without escaping references or retaining caller data. Event, score/context, frame and signal limits remain fresh. Secure same-origin Worker loading, ready/start/ACK validation, exact byte/frame accounting, sink backpressure, cancellation and cleanup are unchanged. The reviewer inspected the three final changed files and supporting Worker entry, ran no runtime/build/test gates, excluded arbitrary built-in corruption and did not grant release approval.

The beat-event schema follow-up received a final-source scoped A/B/C review with no findings. IdleSecurity confirmed exact private list contents/order, unchanged initial/later type-descriptor behavior, invalid-type fallback, required-field/error precedence and numeric/context/registry checks. sequenceOwnData only reads schema arrays and does not expose them, so identical allowed/required control/stop lists may share references safely. Fixed module-lifetime string metadata retains no caller data; frozen output ownership remains unchanged. Worker-host schema/progress experiments did not establish reliable whole-export allocation gains and were rejected; original per-message literals and double-conditional validation were restored. Host state/progress/byte accounting, ACK/backpressure and lifecycle remain intact. The only retained host edit documents that imports create no Worker. The final recheck inspected retained beat schemas, restored host validation and supporting validator/lifecycle locations, superseding the earlier candidate-host disposition. It ran no runtime/build/test gates, excluded arbitrary built-in corruption and did not grant release approval.

The owned-default-tempo follow-up received a final-source scoped A/C review with no findings. IdleSecurity confirmed that unconditional scalar BPM validation still precedes both omitted-map construction and private metadata lookup. Only strict undefined selects the directly constructed point containing fixed beat zero and that validated BPM. Every call still returns a fresh frozen array and point with identical own values and absent optional fields; no identity sharing, new trust gate, cache or single-point offset registration was introduced. Provided maps retain full own-data, ordering, curve/slope, numeric and ownership checks, with private offsets only for multi-point outputs. Query arithmetic, uncached single-map behavior, inherited optional-field reads and existing error precedence remain unchanged. The reviewer inspected normalization, offset lifecycle, conversion helpers and caller references, ran no runtime/build/test gates and did not grant release approval.

The owned-default-meter follow-up received a final-source scoped A/C review with no findings. IdleSecurity confirmed that the private complete frozen 4/4 marker never escapes: omitted normalization returns a fresh frozen two-own-field copy, while omitted conversion helpers only borrow its fixed scalar values internally. Every provided signature, including previous normalized outputs and frozen/proxy/foreign lookalikes, retains full own-data/numeric validation and copying. Beat validation still precedes meter inspection in beat-to-bar conversion; provided-meter validation still precedes position inspection in the inverse. Position bounds, ordered arithmetic, signed-zero behavior and fresh bar/beat ownership remain unchanged. Fixed module metadata captures no caller data; no cache, caller-output brand, output sharing or DOM/Worker side effect was introduced. The reviewer inspected marker references, normalization/conversions, supporting validators and caller references, ran no runtime/build/test gates and did not grant release approval.

The transport-schema follow-up received a final-source scoped A/C review with no findings for the retained meter/position slice only. IdleSecurity confirmed exact private readonly field names/order and required fields, and that sequenceOwnData only reads these lists without mutation, storage or reference escape; using one list for identical allowed/required slots is safe. Descriptor inspection, rejection precedence, meter/position bounds, arithmetic, private-default non-exposure, fresh frozen outputs and full provided-input copying remain unchanged. The two fixed string-name lists retain no caller data and introduce no trust brand, cache or DOM/Worker side effect. Tempo-point schema experiments were not retained; their original per-point literals, offsets and validation remain untouched. The reviewer inspected the retained source, supporting validator and checklist A/C, ran no runtime/build/test gates and did not grant release approval.

The immutable-tuning-table follow-up received a final-source scoped A/C review with no supported-input findings (src/core/tuning.ts SHA256 158a888f2561fa6ca405a3deae85bbf562c647eb0aedf810a566aa80c6f161af). Root/prototype/unknown-field/own-data/reference-Hz validation always precedes table membership. A private WeakSet initially recognizes the existing frozen zero table; all other entries are copied, fully validated output tables registered only after freezing. Raw inputs, externally frozen arrays, Proxies, foreign-instance arrays and structured clones cannot inherit membership; unknown tables retain dense shape, all 128 own descriptors and finite cents bounds. Known tables still copy into fresh frozen arrays and roots remain fresh/frozen. Weak metadata retains no caller roots or live DSP state; interpolation, frequency arithmetic, tuning application, protocols and DSP clocks are unchanged. A consumer regression protects caller mutation and invalid roots carrying known leaves; independent Node/Chrome PCM/WAV and genuine trusted-click Worklet/Worker evidence is recorded in CHANGELOG. Arbitrary built-in corruption is outside this scoped review. No release, device/listening or general runtime-speed approval is implied.

The bounded-MIDI-VLQ follow-up received a final-source scoped A/C review with no supported-input findings (src/core/midi-file.ts SHA256 3bb7d192df3a88e1fe02f94fe272dbaf7a86ec51e00dd69944dd001168e5ed1d). The unchanged safe-integer/nonnegative/28-bit guard precedes &127 and unsigned seven-bit shifts, which operate only on relative deltas; cumulative ticks, including above signed 32-bit, remain ordinary numbers. Original event/byte budgets, size preflight, allocation, ordering, normalization and native result.set payload copying remain intact. A generic payload-copy experiment passed correctness proofs but regressed actual expressive-export timing and was rejected; the final disposition covers bitwise-only source. Public width/max/overflow/cumulative-tick regressions and independent full-byte Node/Chrome/project/PCM/WAV/original-Worker proof are recorded in CHANGELOG, with existing expressive warning and reexport behavior preserved. The reviewer ran no runtime/build/test gates; arbitrary built-in corruption is excluded. This is not release, physical-device/listening or whole-API-speed approval.

The noncenter-stereo-pan follow-up received a final-source scoped A/C review with no supported-input findings (src/core/synth.ts SHA256 4c74245bf5f07576793dba887bcb4b6b93e32384b7c024050c3862916d2ee4e4). Three private per-slot scalars retain only a last noncenter effective-pan key and raw trig, initialized with NaN to force required first computation. Center ±0 neither reads nor changes cache fields; endpoints never read unused factors. Returning to the same last noncenter key is safe across centered intervals, note/voice-pan decompositions, pooling, detached fades and sample rates. Fresh gain, literal-zero branches and left-associative products remain unchanged, as do admission/automation writers, validation, clocks and bounded voice storage. No caller references, trust brand or unbounded registry were introduced. Final Node/browser/Worker/worklet proofs, package gates, consumer regression and the measured moving-pan cost are recorded in CHANGELOG; the first center-key candidate was superseded rather than its regression hidden. Arbitrary private-state/built-in corruption is excluded. The reviewer ran no runtime gates; this is scoped static review, not release approval.

The tempo-prefix-context repair received a final-source scoped A/C review with no supported-input findings (src/core/transport.ts SHA256 4acc4dc447fda9bc5e97e89d1e814965a5edc978971444623e288e71daf9afa0). Frozen own point data does not make inherited optional fields or an inherited terminal array index immutable. Eligibility is established after input/slope callbacks, before unchanged prefix additions; dirty construction writes a permanent private NaN marker only after those additions, preserving normalization getter/error behavior and identity reuse. Queries require private membership, an eligible marker and a clean current context before any cached prefix read; the marker cannot enter output arithmetic. Own-property presence checks invoke no accessors, cover both terminal-index prototypes, and reject changed Array.prototype parent identity. Raw/proxy queries gain no extra length reads, and original fallback/inverse formulas, BPM-validation precedence, bounds, output prototypes/own-field shape and default behavior remain intact. No new registry, caller reference, message surface, dependency or metadata allocation was added. Node compiled/dist context and full-payload proofs, native Chrome context/Worker/Transport proof, public prototype-transition regression and full behavioral/type/security gates were run by the integration owner or explicitly delegated runtime owners, not the static reviewer. An initial cross-context Proxy fixture failure was preserved and corrected without changing valid baselines. The inverse-span proposal was rejected and is not covered as an applied feature. This is scoped static review with runtime evidence recorded in CHANGELOG, not release approval or physical-device/listening acceptance.

The voice-ownership/pooled-timing repair received an applied-source scoped A/C review with no supported-input findings (src/core/synth.ts SHA256 82b082da082b019e1dc0a36bf12ae4ef0bf301d9241a79e88b5ae5c4dd91938e; src/voices/normalize.ts SHA256 35e7db1d4558f73d374b63026ac7f808bf770c80f2c622f7f962d02a770c484f). Own-presence freeze checks exclude inherited foreign objects while preserving approved-own validation, detached deep freezing, snapshot shape and private identity registration. One bounded private slot boolean plus sticky per-operator current-context checks prevent inherited sustain/rate changes or earlier context-changing getters from leaving reusable timing. Required-own sustain constants and live envelopeEdited DSP semantics remain separate. The review identified an existing spare leak on inherited getter exceptions, additionally exposed to raw inputs by own-only freezing; actual reproduction confirmed pool exhaustion. Cleanup now covers unpublished initialization only, restores the spare, resets the factory voice-identity sentinel and eligibility, and rethrows the exact original value. Partial coefficient identity cannot survive failure. Stealing/publication/terminal callbacks stay outside cleanup; IDs/sequences remain monotonic because initialization may have invoked user code. No registry, caller reference, protocol surface, dependency or per-note typed-state allocation was added. Independent Node/native context and repeated-failure/partial-initialization proofs, full clean-byte comparisons, consumer regressions and full behavioral/type/security gates are recorded in CHANGELOG; runtime owners, not the static reviewer, executed them. Raw/trusted inherited-glide behavior was measured as equivalent and deliberately left unchanged. Internal pool corruption/native-intrinsic replacement remain excluded. This is scoped static review, not release approval or device/listening acceptance.

The prototype-presence guard follow-up received applied-source scoped A/C review with no supported-input findings (src/core/transport.ts SHA256 9732400b98bde9707f62ec4becbf5d823c993f9a0f9603d9bf1d00a96c71bf69; src/core/synth.ts SHA256 b8d7bcfc84b75ab4704374dec445cec800d08dba590c7da5588b9d3ead5e687e). Native Object.prototype has an immutable null parent, so presence checks remain equivalent to own checks and invoke no getters; exact array-parent verification precedes the terminal lookup. The numeric non-positive shortcut requires private multi-point-map membership and returns the original first-segment +0 without optional reads, even for dirty contexts. Explicit type gating preserves unsupported coercion/error ordering and NaN paths. Dirty markers, callback-sensitive sticky eligibility, rollback and publication boundaries are unchanged. Native-intrinsic replacement and private-state corruption remain outside the reviewed assumptions. IdleSecurity performed read-only source review, not runtime verification or release approval; actual output and cost observations are recorded separately in CHANGELOG.

The guarded inverse-span follow-up received applied-source scoped A/C review with no supported-input findings (src/core/transport.ts SHA256 e687714e11e9a489fdee54f2f667707576b951049851456efa55e040176dcdd3). One existing private vector holds N unchanged prefixes and N−1 exact full spans, bounded by 1024 points / 2047 cells / 16,376 logical bytes; single-point/default paths still allocate no vector. Private identity, clean construction marker, numeric input and clean current prototype context gate reuse. Dirty or observable inherited/coercive/proxy cases retain original traversal. Prefix addition and successive inverse subtraction retain their original order; the shared helper computes slope before reading point.beat, preserving raw getter/error/coercion ordering. Only immutable own-data/verified-absent reads can remain when the eligible terminal integral is omitted. Exceptional normalization cannot register incomplete metadata; no query buffer, extra registry or caller reference was added. Constructor interception observes logical capacity only, not native heap/GC behavior. Native-intrinsic replacement/private-state corruption remain excluded. IdleSecurity performed read-only applied-source review, not runtime gates or release approval; actual full-output, cost and storage tradeoffs are recorded separately in CHANGELOG.

The inherited-index-accessor repair received applied-source scoped A/C review in two passes. The first pass found additional tuning-table/default, arrangement score-collection and lookahead-length trust-anchor defects; these were repaired and exercised before the round's 517-test/type/static gates passed. The second pass also reported candidates involving Performance part ownership, MIDI-adapter ownership, arrangement reserved gain controls and asset-inventory copy paths. They remain unresolved pending consumer reproduction and repair; the earlier same-realm/internal-bookkeeping rationale was not evidence that those invariants hold and is withdrawn. Optional-key output writes and uncached terminal-index reads were separately recorded. This is scoped review, not release approval; CHANGELOG records the runtime coverage and the round's reconstructed BEFORE provenance.

The own-data repair for optional fields, descriptor literals, class state and event literals received two applied-source scoped A/C reviews. The first (SnapshotSecurity69, intermediate source) found that Object.defineProperty descriptor literals inherit get, set, configurable, writable, enumerable and value from Object.prototype; the integration owner reproduced it (an inherited configurable getter replaced a validated control with Infinity in a frozen, privately registered snapshot) before every descriptor literal became null-prototype and a six-key regression was added. The second (OwnDataFinalReview69, final source) found no write-side defect in the rewritten sites, no change to key or evaluation order beyond the corrected LFO case, freeze-before-registration intact and no weakened limit; it also reported further assignment sites (core/index.ts and core/sequence.ts engine options, worklet event literals), which were then repaired together with other sites found by a wider scan (named patches, prepared envelopes, OPM text import, Transport seek reconstruction, arrangement gain changes, render-worker diagnostics). Its inherited-read table — noteOn/updateNote reads of omitted optional fields, MIDI export controls, effects, engine-option and Performance-baseline objects — was open at that review and is repaired in the next round (below). The Performance/MIDI/arrangement/asset candidates above remain unresolved. Review was read-only and ran no gates; observed Node, Chrome and Worker evidence is recorded separately in CHANGELOG. This is scoped review, not release approval.

The omitted-field read repair received an applied-source scoped A/C review (OmittedReadReview70, read-only, no commands) with no supported-input defect in the changed sites: note admission, live controls, engine options, effects sections, Performance baselines, MIDI export controls and loaded-voice freezing read only own properties or null-prototype results, Object.hasOwn cannot be defeated by an ordinary prototype hook, and no exported API returns the null-prototype option or MIDI-control objects. The reviewer reported four further sites of the same class, none reproduced at runtime in that round: MIDI import (controls.modulation === undefined on {pitch}/{pan}/{expression} literals and held.modulation reads/writes in core/midi-file.ts), the original.voice ?? 'brass' default in core/arrangement-definition.ts, omitted-field reads on event.controls snapshots in arrangement-definition.ts, sequence.ts (release-tail bound) and api/transport.ts, and omitted Command.at / Gate fields in api/arrangement.ts and api/transport.ts. The reviewer did not exhaustively open normalize.ts, schema.ts, worklet/processor.ts, worker/render.ts or project.ts. This is scoped static review, not release approval.

The follow-up repair of those sites was reproduced first (an inherited operatorADSR inflated a planned render from 10,560 to 168,160 frames; an inherited gain rejected a valid arrangement layer; inherited id, at, offAt, cutAt and cutBeat changed Arrangement traces; 14 of 18 names changed Transport seek audio; an inherited modulation setter swallowed a MIDI-import write) and then received an applied-source scoped A/C review (OwnSlotReview71, read-only, no commands) with no supported-input defect in the changed sites. It reported one further reachable site, the MIDI-adapter controller mapping read of an inherited operator (a valid controllerMap was rejected with RangeError: controls.pan must be finite and in -1..1), which was reproduced and repaired with an own operator slot; a latent GainChange.activation read in Arrangement (api/arrangement.ts, no reachable path found, unchanged); tempo-point curve/endBpm reads that stableTempoContext already guards; and a policy note that internal bookkeeping arrays use push and are not hardened against Array.prototype hooks. It judged worklet/processor.ts and worker/render.ts reads of structured-cloned messages to run in a realm that page scripts cannot reach. This is scoped static review, not release approval.

The effects delay-tap indexing follow-up received integration-owner scoped A/C review (src/core/fx.ts SHA256 b1d2e328b32b2f5b48781a05cbfcdce73bddd53540754bf0a66b85b5da3f0a02). Chorus taps lie between 0.002 and 0.018 times the admitted integer sample rate, inside ceil(0.02 * rate) + 2 cells; pre-delay taps lie between 1 and 0.1 times the rate, inside ceil(0.1 * rate) + 2 cells. Parameter smoothing remains within those finite convex bounds. With the private position in [0, length), the first index is valid and only its successor can equal the ring length, making the conditional wrap equivalent to the former remainder. No input admission, arithmetic order, allocation or worklet protocol changed. The 110.25-frame independent impulse reference, 100 applied-source differential cases and four native Chrome effects-Worklet cases preserved PCM; 549 tests, type checks and package/static gates passed. This is owner review, not an independent release or device/listening approval.

The one-shot dry-effects follow-up received integration-owner scoped A/C review (src/core/fx.ts SHA256 b3b1b41370ec98eb85bce793019685126d4ef37422f459e38cf91b33f1760ce4). A newly constructed engine has a zero tail bound only when both normalized wet mixes are zero: every positive chorus/reverb mix contributes a strictly positive bound independently of its magnitude. The fast path therefore cannot suppress a tiny wet mix. Native-channel/rate/options validation, delay-state allocation and the 4,000,000-frame output check still precede it. It sanitizes the already detached Float32 outputs exactly as the old dry bypass did, without clipping finite values, flushing finite subnormals or losing signed zero; no observable engine history is returned. The stateful process/worklet path is unchanged. Ninety-six applied-source and 36 native Chrome cases, the numeric-boundary regression, 550 tests, types and package/static gates passed. This is owner review, not independent release approval.

The dry-helper state-allocation follow-up received integration-owner scoped A/C review (src/core/fx.ts SHA256 7a1cf6c422b750b7140055ee9db5a75d68868df4d4b5c882927602eea18293b9). Both supported construction paths share integer sample-rate admission followed by the existing strict option normalizer; the unexported engine consumes their fresh, deeply frozen snapshot without a second raw-object read. Wholly dry classification uses own chorus/reverb sections and exact positive-mix tests, so prototype fields and tiny positive mixes cannot select a false bypass. Stateful construction and updates preserve their bounded preallocation, normalization, smoothing and warmed histories. The helper still authenticates native channels before options, enforces the original output cap and uses native typed-array copies before scrubbing non-finite samples; admission-time buffer growth/detachment retains the former native error behavior. The built graph matched 44 reflection/admission traces, 96 helper cases and 900,000 stateful stereo frames. Chrome separately exercised helper/native-copy boundaries and the actual AudioWorklet. No new dependency, export, message protocol or trust token was introduced; this owner review and the passing 552-test/type/package gates do not constitute independent release approval.

The PCM24 payload-view follow-up received integration-owner scoped A/C review (src/core/wav.ts SHA256 11a4f0e57b7bf3089814152dc998b1dfb6c025395b1399a26a440f5f0012c1f9). The private layout admits exactly PCM16, PCM24 or float32; immutable local format flags allocate a DataView precisely for the two branches that use it. PCM24 writes native output bytes directly, without a new format, unchecked path or additional sample read. Header construction, native-channel authentication, finite/unit-range checks, frame/RIFF caps, little-endian packing, deterministic dither and successful-chunk-only state commits are unchanged. Exact byte/reference checks covered 80 files and 1,982,040 samples, including invalid-chunk recovery, while 60 boundary cases retained their behavior. Chrome exercised native decoding, direct constructor counts and 20 actual Worker/sink-transfer jobs against the old complete WAV output. The decoder probe allows the observed one-LSB PCM16 normalization difference; file-byte comparisons remain exact. Existing format/padding/rollback tests, all 552 tests, types and package/static gates passed. No public interface, worklet/Worker protocol or dependency changed; this owner review is not independent release approval.

The deployment-manifest read follow-up received integration-owner scoped A/D review (src/tools/assets.ts SHA256 2da049acc6432cf093ba9b206ddec29682f124744b7c5fa0fede470a19b5f224). A private scalar retains the regular manifest file's size from the existing symlink-rejecting walk; after the complete expected file set is verified, a known UTF-8 size mismatch returns false before loading that file. Matching size still leads to exact canonical-text comparison and all existing per-asset size/hash checks, so size alone grants no reuse. No extra filesystem stat, path authority, overwrite policy, transport option, public signature or dependency was introduced. Fixed-tree native observation avoided the malformed fixture's complete body read while preserving valid reuse and the rejection error. Thirteen old/built boundary cases preserved results and host/package bytes, and the actual CLI exercised fresh/reused/stale copies plus HTTP/gzip and negative MIME/nosniff/hash/redirect checks. Eight asset tests, all 552 tests, types and package/static gates passed. This is an early check of inspected metadata, not an atomic snapshot or a hard cap if a hostile writer changes a file after inspection; it is owner review, not independent release approval.

The deployment-publication follow-up reproduced the final-rename boundary with a real child process. Non-empty host content kept its inode and bytes and staging was removed, but macOS/Node 26 replaced a different process's newly created empty directory; no renameat2-style exclusive directory publication is exposed. This is retained as a documented limitation for hosts that allow unrelated writers into the deployment parent, not a path-containment, symlink, source-copy or hash-verification bypass. Source, public API and dependencies were unchanged. The added regressions cover non-empty preservation before the source's final check and at native rename, plus staging removal; the first catches unconditional replacement, while the second depends on operating-system behavior. Linux/Windows platform behavior remains unverified.

The effects-worklet graph follow-up received integration-owner scoped B/C/D review (src/core/limits.ts SHA256 59695cf53969b2451f67c6cd7cbf021f6a6c7b5e4dc458bcb2958381f40a8340, src/core/fx.ts 21c00b2856fb8b8ac60ccc88b5b6589cdeb31e2231a4a6e2577f495c0768fe62, src/core/sequence.ts 2b2f447fa3d11c0438e1b5d082452743f15b03e8ade1a4a050fd47814a6f172e). The leaf contains one immutable numeric export and imports nothing; the sequence module re-exports that identical binding, so the public core export and every existing budget comparison retain their value. The effects processor still validates raw messages through effectsData, normalizeEffectsOptions and its flood bound before enqueueing/rendering, and the offline helper still checks the same output cap. A throwaway fresh-process V8 script-list probe observed the effects worklet's static module closure; its exact-file-list assertion was removed rather than maintained as a wiring test. Native Chrome loaded the worklet and matched the previous effects PCM. No dynamic import, dependency, URL option, message protocol or trust identity changed. The build adds three deployable files, and package/asset checks inventoried them. This is owner review of a dependency edge, not independent release approval or a CDN/device startup guarantee.

The OPM UTF-8-budget follow-up received integration-owner scoped A/D review (src/voices/opm.ts SHA256 eecb52c73680f315d70cfeb402d79f0f85aab0e2007c31fa895bcbc27a73b6c9). Both guards operate only on primitive strings: each UTF-16 code unit contributes at most three UTF-8 bytes (a surrogate pair contributes four across two units; a lone surrogate encodes as three replacement bytes). The shortcut therefore cannot admit an over-budget input or line; candidates above the conservative threshold still take the same exact native encoding check. The original code-unit rejection remains first, NUL checks still follow line-budget checks, and the native Uint8Array/Latin-1 path is untouched. No change to parsing, normalization, warnings, deep copying, name sanitization, voice version or host URL/file authority. Exact-boundary tests and old/new comparisons covered multibyte and lone-surrogate cases; Chrome conversion-to-PCM and package gates passed. This is owner review, not independent release approval or a general parser performance guarantee.

The grouped OPM byte-decoding follow-up received integration-owner scoped A/D review (src/voices/opm.ts SHA256 fbb8d4610a07a3317eff90ee290ae2ccb7da7b42d4f731a2e29b7649d8c826b4). The intrinsic Uint8Array-kind/length checks, 256 KiB bound and native private-copy step still precede conversion. Each eight-byte group runs only when index + 8 <= length, reads the copied view's valid integer indices, and passes exactly eight 0–255 numbers to String.fromCharCode; at most seven bytes use the scalar tail. There is no variable argument list, endian interpretation, decoder remapping, species/subarray access or new external authority. The private text preserves byte order and all final bytes; source/parser/NUL budgets remain unchanged. Old/new consumer comparisons, offset/remainder/NUL regressions and Chrome binary-import-to-PCM observations passed. This is owner review, not independent release approval, a memory-allocation measurement or a non-V8 performance certification.

The separate OPM outputs follow-up received integration-owner scoped A/D review (src/voices/opm.ts SHA256 100c6448acb19fd80b4e9c74bc65b7b9eb9ec30eaa7f23adbf5c46dad932c24c). Both public entry points still execute parse() in full before converting any patch: source/native-view bounds, own copied bytes, decimal syntax, every section's field count/ranges, SLOT mask, complete sections and patch count/name handling are unchanged. Description reads only those private validated patch records, not caller objects, and no longer builds a voice whose normalizer result would be discarded. Voice import still invokes normalizeVoice; its operator/ADSR/noise construction and own-data spreads are preserved. Both paths share the identical raw LFO/noise rate expressions, and metadata warnings retain their original label order, clamp thresholds and Set de-duplication. The expanded existing regression rejects out-of-range voice-only fields through description too; seeded/binary old/new comparisons and native Chrome PCM passed. No new cache, trust identity, dependency, accessor, URL authority, public signature or voice-format change. This scoped owner review is not independent release approval or a claim of measured GC/device improvement.

The DX7 topology-mask follow-up received integration-owner scoped A/C/D review (src/voices/dx7.ts SHA256 f4410e701db7a5aa6127580549c4cbbcd50b83f83cd105dd6637a5b449132b48). Source framing, intrinsic length/type admission, private byte copy, 7-bit data, checksum, reserved bits and all parameter ranges still validate before selection. The new private table derives only from existing immutable ALGORITHMS; its four carrier bits occupy positions 16–19 and its sixteen edge bits positions 0–15. Source/target indices remain 0–3; the signed -1 lazy sentinel is initialized to zero before any XOR, whose operands are bounded to 0xffff. The fixed integer population count returns exactly the 0–16 edge mismatch count. Original rank, permutation/algorithm order, carrier identity test and strict-less-than update preserve deterministic ties; four-carrier selection still returns early. No cache of input patches, native-code dependency, third-party emulator source, new trust path or DSP math was introduced. Exhaustive strict-loudness-order comparisons, consumer routing ties, malformed-source regressions and Chrome PCM passed. This owner review is not independent release approval, measured GC savings or a non-V8/device performance certification.

The packed SMF message follow-up received integration-owner scoped A/D review (src/core/midi-file.ts SHA256 50117a677b9391206529a5645ebf91bf6d5f020c4cff02655a8f71f9f0391936). The helper reads only private validated/quantized numeric fields and defines every event field as own data. Each lane is masked to eight bits before packing; the positive low-24-bit word is written through native Uint8Array stores in the original byte order. Ticks, order and indices remain separate full-precision numbers; metadata retains its original bounded arrays. All constructors, including expressive messages and EOT, use the same representation consumed by both sizing and serialization. Event/byte/VLQ checks still precede final output allocation; there is no new input path, authority, cache, dependency or real-time DSP/worklet change. The full-byte/error corpus and existing input/ownership regressions passed; runtime evidence is recorded separately in CHANGELOG. This scoped inspection is not independent release approval.

The optional SMF expression-ownership follow-up received integration-owner scoped A/D review (src/core/midi-file.ts SHA256 7dd95e1414353feeaac86414c3bb0e54aedd02efcc3b392aeb3072b1872c43a3). The strict own-data controls policy still produces an immutable local boolean. Only preserve-mode parsing can create an expression wire event; the remaining channel-ownership read is confined to that event branch, and note-on/close mutations now use the same boolean guard as allocation. Legacy mode therefore needs no channel-fanout sets, while preserve mode keeps all sixteen. The independent global live set, pressed-key FIFO queues, sustain sets/pedals, release flags and EOF closure order/count remain unchanged. Binary admission through intrinsic native-view metadata, shared-memory rejection, framing/data-byte checks and file/wire/generated-event/time budgets are untouched. No cache, new input authority, dependency, public type or real-time DSP/worklet change was introduced. This scoped owner inspection is not independent release approval; observed consumer, malformed-input and package evidence is recorded separately in CHANGELOG.

The optional SMF controller-initialization follow-up received integration-owner scoped A/D review (src/core/midi-file.ts SHA256 b106227edf10cb5c8b29dccfabf8b701ca9e238b6ea3ed250743882553b3fa87). Strict own-data configuration and finite 0–48 initial bend-range validation remain unconditional before binary traversal. midiRpnState only constructs private snapshots; it performs no validation that could be lost by skipping it. Only the preserve parser branch can construct expression/RPN wire events; every remaining snapshot read is inside those branches or preserve-only note initialization. Omit mode therefore never reads the empty local arrays, while preserve mode retains its original per-channel defaults and fractional RPN range behavior. Program selection, release flags, gate ownership, global live/FIFO/sustain tracking, EOF ordering, intrinsic native-view admission and all byte/wire/generated-event/time bounds are unchanged. No imports, runtime dependencies, public declarations or permission boundaries changed. Both final compiled/minified modules matched complete results/errors in 3,726 cases each, including malformed range rejection under both policies; 557 tests and strict/public/Node-only type checks passed. Native Chrome's 16 import/compile/render/PCM24/decode cases retained 1,341,760 exact finite samples with zero DSP errors. This is scoped integration-owner review and offline consumer evidence, not independent release approval, physical-device/listening acceptance or a real-time claim.

The single-track SMF ordering follow-up received integration-owner scoped A/D review (src/core/midi-file.ts SHA256 4c9491220e914d809056d62060595a7484b3c2267338f7d7ba497979e27b6d3a). The header's native unsigned track count still validates against format/count limits before parsing. Every accepted delta comes from the existing four-byte nonnegative VLQ reader, cumulative ticks retain the existing beat horizon and each admitted event retains the parser's increasing wire index. A single track therefore yields the same tick/track/order sequence without sorting; omitted records form an ordered subsequence. Multiple tracks still use the unchanged comparator. The sort performs no validation removed by the guard: intrinsic native-view/shared-memory/framing/data-byte checks, metadata bounds, unsupported policies and file/wire/generated-event/time limits remain before or within their original stages. Same-tick note/control ownership, repeated-pitch FIFO, tempo/meter rejection, sustain and EOF count/order were checked through full public results and error classes/messages in 8,050 cases per final compiled/minified target. Existing 557 tests and strict/public/Node-only checks passed; native Chrome's 20 consumer cases retained 1,563,200 exact finite samples and zero DSP errors through native PCM24 decoding. No input authority, imports, runtime dependencies, public declarations or permissions changed. This is scoped integration-owner review and offline evidence, not independent release approval or physical/listening/real-time acceptance.

The owned WAV metadata follow-up received integration-owner scoped A/C/D review (src/core/wav.ts SHA256 616defd0ff2d1e7141740f730d8baf9db9f445b19324351a8bbb72e6d7975719). Public full-buffer/encoder/chunk entry points retain identical allowlisted own-data schemas, required fields and labels; the stream state guard still precedes input inspection. The private channel helper receives only values from those null-prototype snapshots, and intrinsic kind/length, stereo matching and expected channel-count checks remain unconditional. The private layout helper receives either the public encoder's null-prototype snapshot or a private projection defining all five fields as own data, including undefined optional format/dither fields. Every scalar, format/dither, frame/chunk and RIFF32 bound is preserved; no caller-supplied unchecked record, trust tag or new export is admitted. The per-sample single read/range check, separate emitted-byte ownership, header/padding and success-only dither commit are unchanged, as are Worker transfer/ACK and host completion accounting. Expanded inherited optional-field coverage, differential rejection/maximum-frame checks and actual native codec/Worker consumers passed. Packaging gates are recorded separately; this scoped integration-owner review is not independent release approval.

The Worker diagnostic-snapshot reuse follow-up received integration-owner scoped A/B/C/D review (src/worker/render.ts SHA256 ba679386970d77e96fb91bb69d1b3fdf9cb3a3178e1663d9d3f1f588475bfeb7). Only the private sender and its data-chunk caller changed. Each trusted renderer chunk freezes numeric diagnostics after DSP advancement and terminal cleanup; synchronous encoding neither advances the renderer nor yields to another message, so its snapshot equals the previously repeated getter result. Header/final-padding defaults and terminal reporting still request current diagnostics. No caller-provided snapshot, new message field, cross-message cache, shared PCM alias, import, dependency or authority is introduced. Start/options/ACK admission, waiting/index/finalized guards, error paths, frame/byte budgets, native transfer ownership, host progress validation and sink invalidation remain unchanged. Compiled/minified real-thread wire/audio/error parity and actual browser result/progress/decoder/ownership consumers passed; existing behavioral and strict/public/Node-only checks passed. This is scoped integration-owner inspection and runtime evidence, not independent release approval or a real-time performance claim.

The scalar WAV dither follow-up received integration-owner scoped A/C/D review (src/core/wav.ts SHA256 2ceabcd4a28e1e03b13d8f274324a7ba18d5a65982cbbcf3a331c67c3c028ce4). Admission and every format/dither, native-channel/sample, frame/chunk and RIFF32 bound remain unconditional. Enabled state still starts at the fixed seed; disabled state is zero, and no caller seed is admitted. Signed local XOR/shift operations preserve the original Uint32Array word at every sample boundary; both unsigned draw conversions, subtraction before scaling by 2^-32, sample/channel order and saturation are unchanged. Each sample is still captured once before validation and RNG advancement. The stream reads its committed seed after own-data/native metadata admission, processes only a local scalar and assigns the returned unsigned seed only after complete success. Metadata-triggered nested prefixes therefore commit before the outer transaction, while outer rejection preserves both that prefix and its current noise sequence. The new regression exercises both metadata trap positions, formats, channel counts and success/rejection transitions. Native shared/offset sample handling, separate emitted-byte ownership, encoder state guards and Worker protocol/permissions are unchanged; no cache, dependency or public API was added. Compiled/minified byte/error/transaction parity, 558 behavioral tests, strict/public/Node-only checks and native codec/Worker consumers passed. Timings are context-dependent offline evidence, not general performance, heap/GC or independent release approval.

The ordered WAV magnitude-bound follow-up received integration-owner scoped A/C/D review (src/core/wav.ts SHA256 3422a4831b3dcf2bf9ad89266a378d79d34fd2eec1b2ba7885e2ccf975eb47a7). The replacement is confined to the private sample predicate after unchanged intrinsic Float32 kind/length and frame/channel admission. Native indexed reads yield numbers, or undefined for an absent sample; no arbitrary coercible object can reach the predicate. For these values, !(Math.abs(value) <= 1) rejects exactly the former non-finite/out-of-range cases: NaN fails the ordered comparison, either infinity exceeds the bound and undefined becomes NaN. The original captured sample, not its magnitude, is serialized or scaled, preserving sign/negative zero/subnormals. No second sample read or validation/copy pass admits a concurrent shared-buffer race. Error class/message, validation order, RNG advancement, transactional seed/frame commit, bounds, imports and authority are unchanged; no allocation or input backing-store alias was added. Actual compiled/minified graphs matched 1,402,572 sample API cases per target, large/partitioned exports, metadata/native-view boundaries and concurrent native shared-memory mutation. Native Chrome 150 additionally verified real decoding, ordered progress and transfer-detached backpressured Worker sinks; installed-package/static/type gates remain required. This scoped owner review does not replace independent release review or prove physical-device/listening or real-time improvements.

The fractional effects delay-endpoint correction received integration-owner scoped A/C/D review (src/core/fx.ts SHA256 7a274aa4db7ad19ea332c5ef5fcfedde8e06cf7d1d4df6ab60ef6f69c379f02f). Strict own-data parameter admission, finite/range checks, intrinsic Float32 kind/length checks and frame bounds remain unconditional. Private chorus/pre-delay coordinates are finite and inside their allocated rings; subtracting the delay from the write position can produce a tiny negative value whose addition to the ring length rounds to that exclusive endpoint. Only that equality after negative-index adjustment now maps to zero, before either interpolation read. The ordinary arithmetic/read order and following-tap wrap are unchanged. This prevents an undefined read and consequent internal NaN/sample loss without changing clean(), clipping, feedback, phase/ring advancement, ramps or caller validation. No allocation, state, import, dependency, message or authority was added. Two failing-before public regressions and actual native Worklet/core comparisons cover wet chorus, bypass-history activation and reverb pre-delay at 8–192 kHz; ordinary stateful controls remain exact. Scope is this unreleased correction, not independent release/package approval or physical-device/listening certification.

The inactive chorus-tap follow-up received integration-owner scoped A/C/D review (src/core/fx.ts SHA256 b8d3466ab12020c9fcd11258c3fabb2bbf777ca267e60c8395929f06edc56b78). Parameter/frame/native-buffer admission is unchanged and unconditional. Only private current mix/feedback coefficients select the guard; either signed zero selects it, while every nonzero coefficient retains tap calculation. With normalized ring endpoints, clean-written finite delay data, bounded phase/delay/voice weights and a denominator of at least one, skipped taps are finite and have no state or validation side effects. A zero feedback product can change only the sign of zero added to the input; the unchanged push clean() canonicalizes it, preserving stored samples. Input capture, both ring writes, phase progression, target interpolation, order handling, resets, output cleaning and native metadata bounds remain unconditional/unchanged. Nonzero feedback still reads taps even with zero wet mix, and no epsilon prunes positive controls. No storage, import, dependency, protocol, authority or shared backing-store alias was added. Seeded scalar identities, exact four-graph stateful controls, a public activation/reference regression and final native Worklet/core comparisons support the scoped change; this is not independent release approval or a physical-device/listening/deadline certification.

The frame-local reverb damping follow-up received integration-owner scoped A/C/D review (src/core/fx.ts SHA256 f745d7362847de964d8a7565a922fd61207fee80a0ccc085f51bc38668a46f29). The moved expression reads only the private native current-coefficient array after the unchanged per-sample ramp update. That array has its own backing store, separate from low-pass and delay data, and is not exposed by public parameter snapshots. Within the synchronous reverb frame, pre-delay/comb/diffuser operations mutate only their private data/positions and low-pass state, not current coefficients; there is no user callback or task interleaving. The same finite admitted damping value and multiplication are therefore reused for both channels' combs without changing arithmetic order at their use sites. Signed-zero/subnormal values, current/target progression, feedback, reset/tail behavior, intrinsic native-buffer/frame admission, cleaning and all worklet protocols remain unchanged. No allocation, storage, import, dependency, authority or alias was introduced. Exact stateful controls, actual rebuilt boundary/ramp smoke and native Worklet/core comparisons support this scoped source move, not independent release approval or physical-device/listening/deadline certification.

The frame-local chorus coefficient follow-up received integration-owner scoped A/C/D review (src/core/fx.ts SHA256 90dfad9329b7707a449fb2155453d150b8195bca2c4374e66ca663501ba70780). The two captured values come only from the independently allocated private native current array, after unchanged per-sample interpolation, not from caller properties or target values. Private tap reads, delay pushes/cleaning and built-in math do not mutate that array or invoke user callbacks; message tasks do not interleave the synchronous frame. The same primitive coefficients are therefore reused at every original use site without changing floating-point operation order or extending their lifetime across samples. Either signed zero and every positive subnormal retain their original guard/feedback/mix behavior. Both channel inputs, ring writes, phase advancement, clipping/cleaning, history/reset/tail handling, own-data parameter admission, intrinsic native-view/frame bounds and worklet protocols are unchanged. No storage, import, dependency, authority or backing-store alias was introduced. Exact stateful source/minified controls, actual rebuilt coefficient-boundary/ramp smoke and native Worklet/core comparisons support this scoped capture, not independent release approval or physical-device/listening/deadline certification.

The contiguous effects coefficient-target follow-up received integration-owner scoped A/C/D review (src/core/fx.ts SHA256 634ceebd940db8f63ba13f717ec9c4739082624bcd265dbda02b3927e5bb06a7). The removed padding slot was initialized to positive zero, never assigned a target, and never consumed outside its own independent interpolation. Both private arrays and the interpolation bound now have 21 cells; eight gain targets/readers moved together to indices 13–20. All 21 target cells are initialized before use, and used-field interpolation has no cross-cell dependency or callbacks. Own-data/range/native-view/frame checks, scalar indices, delay/filter/phase writes, target replacement, reset, order ramps and tail accounting are unchanged. The logical array payload is 16 bytes smaller; no allocation/GC or deadline guarantee follows. Actual rebuilt modules matched the measured candidate, stateful and repeated-update core probes, and same-runtime native static/automation PCM. Native subnormal pre-delay versus main-thread divergence was separately isolated with a library-free numeric control and an exact explicit-zero counterfactual; no validation, protocol, floating-point threshold or runtime security control was changed to conceal it. Expected invalid-message FIFO fences used the existing bounded validator without processor instrumentation, and all intentional errors were accounted for. This is scoped unreleased integration-owner review, not independent release approval, publication, physical-device or listening acceptance.

The frame-local effects ramp-endpoint follow-up received integration-owner scoped A/C/D review (src/core/fx.ts SHA256 5019c9cb0a2a260359bcfdbae4ac2f960e956629fee7c85cff108a51cf8c47dd). The private remaining count is an integer set from the bounded sample-rate ramp, decremented once per processed frame, and reset to zero by reset; the former per-cell endpoint condition is invariant throughout the synchronous loop. Current/target are independently allocated fixed-size native Float64 arrays of 21 cells, not caller buffers or public parameter snapshots, with no supported detachment, alias or callback interleaving. All target coefficients are finite after unchanged admission/target generation. At remaining one, native same-kind set() copies those exact cells, matching the former finite scalar stores, including signed zero/subnormal bits; constructor/reset already rely on this native operation. Intermediate arithmetic/read order, decrement timing, input/native-view/frame checks, delay/filter/LFO/order/tail writes and protocols are unchanged. No view, storage, dependency, authority or user-controlled metadata read was added. Actual rebuilt core/stateful/update probes, native raw-copy phases and same-runtime static/automation PCM support the cutover. The documented native near-underflow/main-thread boundary was retained and diagnosed separately, with expected validator-error FIFO fences fully counted and no weakened control. This is scoped unreleased integration-owner review, not independent release approval, registry publication, physical-device/listening or deadline certification.

The bounded effects tap-index follow-up received integration-owner scoped A/C/D review (src/core/fx.ts SHA256 631e0365b0f3361826b6d8b15423f517e3ea6d46b053268e80a556f56bbac421). Unchanged integer sample-rate admission (8,000–192,000) bounds independently owned rings to 19,202 cells. Only chorus and pre-delay taps call the private reader; their derived delays are strictly positive and shorter than their ring, while positions start at positive zero and advance/reset within the ring. After the unchanged negative-index wrap and exclusive-endpoint correction, the finite index lies in [0, length) and is not negative zero. Int32 conversion therefore produces exactly the former floor base and fraction, with no modulo overflow or new coercion of caller data. Own-data/numeric/native-view/frame admission, immutable snapshots, interpolation, cleaning, ring writes, phase, reset, order ramps, tail accounting and resource bounds are unchanged. No caller-controlled alias, callback, buffer/view, cache, field, dependency or message protocol was introduced. Actual rebuilt consumer and native-capture proofs are recorded in CHANGELOG; existing native underflow/readback behavior is explicitly distinguished from same-runtime bit parity. This scoped source review is not independent release approval or a new tooling/runtime audit.

The ordered arrangement gain-history follow-up received integration-owner scoped A/C/D review (src/api/arrangement.ts SHA256 0e00c9c154ea9ac9dc8e69a422e66ac243a8919ea8771971d8b7656e83b1894b). Gain records and their dense array are private, not caller snapshots. Initialization/non-running replacement use equal beats; insertion sorts numerically; stable filters preserve order; pause reconstruction places the current beat before strictly later retained changes. OPM admission/update/stop callbacks occur before pruning, and their existing generation/ownership checks remain unchanged; the indexed predicate reads owned primitive fields without introducing a callback or interleaving point. The strict future cutoff preserves the original played + EPSILON boundary, same-layer qualification and stable result order, retaining every future change and the latest played entry for each layer. Existing resource/admission/native-message bounds, gain timing, own bookkeeping slots, cancellation and teardown remain unchanged. No new collection, persistent state, dependency, declaration or public contract was introduced; the existing outer filter allocation remains. Actual compiler/minified consumer traces and raw Float32 output matched in Node and Chrome, and final native public graphs exercised retarget/pause/resume/gain/tempo behavior with zero diagnostic errors and complete context/node cleanup. Build, 562 behavioral tests and strict/public/Node-only type checks passed. This is an unreleased scoped integration-owner review, not independent release approval or physical-device/listening acceptance.

The exact-zero arrangement fade correction received integration-owner scoped A/C/D review (src/api/arrangement.ts SHA256 6f622ac8eaa80abdcee725dd81ac5c059972495f3bbdbdb273b3d91e03e03acd). Only privately constructed gain records are read after the existing layer/boundary checks. An exact fade === 0, including negative zero, now copies the already admitted finite target and reports no remaining ramp; it neither interpolates that target nor derives duration from a rounded onset. All strictly positive fades retain their former clamp/divide/multiply/add order, without an epsilon shortcut or floor. The existing before break, future-entry eligibility, own bookkeeping slots, callbacks, cancellation, stable history pruning and teardown remain intact. No pending-note/command bound, parser or authorization check was weakened to admit the formerly rejected valid chord. There is no new collection, cache, persistent state, dependency or public signature. Both permanent consumer regressions failed before and passed after; all 564 behavioral tests and strict/public/Node-only types passed. Actual compiler/minified positive-fade bit parity and exact-zero offline-oracle proofs ran in Node and Chrome, and actual native dense scheduling reproduced the baseline failure while corrected starts retained bounded voices and clean diagnostics. All native contexts/nodes were cleaned up. This scoped unreleased review is not independent release approval, a tooling audit or physical-device/listening acceptance.

The completed-positive arrangement fade correction received integration-owner scoped A/C/D review (src/api/arrangement.ts SHA256 719cfa0735046307397958f791db0c45eac49727ed15bf7e2bb59720c3b55380). After the unchanged private-record layer/future checks and clamped progress calculation, an exact completed progress now selects the already admitted finite target instead of losing it through affine cancellation. Strictly in-flight arithmetic and the remaining-duration expression are unchanged; the prior exact-zero branch remains intact. No epsilon threshold, input coercion, validation bypass, extra allocation, persistent cache, callback, ownership transfer or resource-limit change was introduced. Existing temporal/getter reentrancy, cancellation and teardown boundaries remain in place. The public PCM regression and independent offline oracle distinguish this intentional endpoint correction from baseline preservation. This scoped review is not an independent release approval.

The sample-frame arrangement fade correction received integration-owner scoped A/C/D review (src/api/arrangement.ts SHA256 6b3661b8b62156dc0ff8c1b85fb36275f4a202077dc5877bf565447e21cc01e3). gainAt now takes the sample rate from the already-validated running context and compares integer rounded frame distance with fade × sampleRate; zero fades, in-flight interpolation, exact endpoint targets, callbacks, ownership, cancellation and capacity checks are unchanged. No new state, dependency or public signature. Scoped review only, not independent release approval.

For v1.2, final A/B/C/D independent review and observed integration verification are recorded in CHANGELOG before release. Configured Node 22/24/26 and Chromium/Firefox/WebKit CI jobs are capabilities, not evidence of an external run. Missing browser binaries/host support or unrun CI must be reported, not represented as passing coverage.

v1.5 feature-completion review: InputBoundaryReview covered A/B; DspSupplyReview covered C/D. The integration owner reproduced and fixed null mixGain/tuning acceptance and overridable render-buffer metadata, then also prevented offset coercion before default-length calculation. Runtime evidence and remaining registry/physical-device prerequisites are recorded separately in CHANGELOG; static review is not a claim of runtime coverage.

FinalInputsReview (A/B) and FinalDspReview (C/D) rechecked the final hardened source and release controls, with no new evidence-backed findings. Their PASS applies to scoped static inspection only; they ran no build, payload, tests, audit or browser commands.

v1.5 release review: Release15Inputs approved scoped static A/B inspection; Release15DspSupply approved C/D for GitHub distribution of package 1.5.0, with no evidence-backed blockers. Neither reviewer executed runtime gates or certified external npm settings. The integration owner's fresh package, native browser, numerical, audit and report-only benchmark evidence is recorded in CHANGELOG.

v1.5 interruption-repair recheck: Release15Inputs initially found that deferred running notifications could leave deduplication state stale. Both initial and existing-node resume now synchronize successful state observation; repeated fully deferred transitions and pending diagnostics are covered by consumer regressions. Release15Inputs then approved A/B and Release15DspSupply approved C/D without remaining scoped static findings. The original Linux WebKit CI failure blocks publication until repaired-candidate verification; static approval is not a waiver or runtime certification.

v1.6 release review: a security review found two command-waiter boundary issues (abort-signal state/listener shadowing and receipt-eviction handling around correlated panic resets). Both were fixed with regressions and rechecked natively against a borrowed context. No fresh independent A/B/C/D approval was obtained for v1.6; the maintainer explicitly authorized the GitHub release on the integration owner's runtime evidence, recorded as a waiver in CHANGELOG. npm publication still requires the independent review record described in doc/publishing.md.

Unreleased seven-capability checkout review: SecurityDataReview approved scoped A, SecurityProtocolReview B, SecurityDSPReview C, and SecuritySupplyReview D static inspection. Initial findings about release-tail controls, sink-transferred buffer accounting and deferred file-picker/writable teardown were fixed and the affected source rechecked without remaining scoped findings. These reviewers executed no tests, builds, audits or browser commands; their PASS does not certify runtime behavior, deployment permissions, physical devices or registry protections. The integration owner's observed tests, package gates, native browser smoke and report-only CPU measurements are recorded separately in CHANGELOG. This is not a release approval or a new waiver.

v1.7 release review: Release17Data approved scoped static A, Release17Protocol B, Release17DSP C, and Release17Supply D, with no evidence-backed blockers in the final seven-capability source and 1.7.0 release metadata. All four reviews were read-only and executed no runtime gates. Fresh isolated package/build/test/type/audit/quality checks and managed native Chromium AudioWorklet observations are recorded in CHANGELOG. Remote CI must pass before the release tag is published; its run URL and outcome belong in the GitHub release record. No waiver or npm authentication/provenance/external-protection certification is asserted.

v1.8 review record: InputProtocolReview approved scoped static A/B and DspAssetsReview scoped static C/D after the bounded arrangement, MIDI own-data, finite tempo-slope and canonical asset-overlap fixes. Their static approval does not certify runtime or external npm settings. The release commit d793d69056c68a971ede1af988338412687227fd has an observed successful Node 22/24/26 and Chromium/Firefox/WebKit CI run; the separate review record and release package record retain the evidence and tarball digest. This is not registry provenance, physical-device/MIDI or listening acceptance.

v1.8.1 documentation/package patch review: Patch181Inputs approved scoped static A/B and Patch181DspSupply scoped static C/D, with no evidence-backed blockers. Reviewers were read-only and ran no build, tests or external actions. The integration owner confirmed the source diff against v1.8 changes only src/version.ts; runtime validation, protocols and DSP are unchanged. Final regenerated assets, package gates and remote CI are separate release prerequisites, recorded in CHANGELOG and the GitHub release notes. No npm provenance, physical-device/MIDI or listening certification is asserted.

Unreleased integration-quality review: FinalImprovementInputs approved scoped static A/B after the pedal-ownership and applied-workload evidence fixes. FinalImprovementDspSupply approved scoped static C/D specifically for an isolated immutable canonical candidate (47 runtime modules with 141 matching distribution assets), after generated-link validation and the DOM-free core/project/MIDI type boundary were hardened. No surviving scoped findings remain. Both reviewers were read-only and executed no runtime gates or publication. The integration owner separately observed 381 passing behavioral tests, type checks including installed DOM-free Node consumers, numerical/dependency/package checks and native Chromium UI/smoke/stress checks. Unexpected numbered generated-file copies were preserved outside the checkout; live-tree packaging remains blocked by their reappearance and is not covered by the isolated-candidate approval. Desktop automation and numerical analysis do not certify physical devices, physical MIDI or human listening. No release approval, npm authentication/provenance/registry protection, physical-device or listening certification is asserted.

v1.9 release review: Release19Inputs approved scoped static A/B and Release19Supply scoped static C/D for an isolated canonical package 1.9.0 candidate, with no evidence-backed security findings. Reviewers ran no runtime gates. Numbered live-tree generated copies are not approved for packaging and must remain outside the candidate. GitHub publication requires exact clean-commit artifacts, passing remote Node/browser CI and an archive digest retained in the release record. Physical-device/MIDI, human listening and npm provenance remain unverified and are not claimed by this GitHub-only release.

v1.9 deadline repair: Release19Supply rechecked and approved scoped static C/D topology-cache/pooling/render changes after the initial release candidate failed the Node 22 prepared-burst p99 gate. Fixed slot-local caches derive only from the existing validated graphs, overwrite all edges, preserve summation order and retain finite checks, bounded fades and reentrant callback behavior. The reviewer executed no checks; this is not a performance waiver. The repaired exact commit must pass the unchanged remote gates before tagging.

Unreleased readiness review: ExpressionSecurity approved scoped static A/B for final expressive SMF boundaries, ownership and loss accounting; ArrangementCaptureSecurity approved scoped A/C/D for portable/shared arrangement validation, lifecycle, inert imports, pure core contracts and bounded text-only local MIDI capture. No evidence-backed findings remained. Reviewers executed no gates. The integration owner separately observed 403 passing tests, installed package/types/security/audit checks, 108 bit-identical baseline renders, scoped capacity measurements and native isolated Edge UI/worklet checks, recorded in CHANGELOG. Physical phones/controllers and genuine eighteen-preset listening originals remain blocked/unverified. This is not release/publication approval.

v1.10 release review: Release110Inputs approved scoped static A/B and Release110DspSupply scoped static C/D for an immutable canonical package 1.10.0 candidate (48 runtime modules and 144 matching distribution assets), with no evidence-backed blockers. Both approved the final documentation/generated-HTML delta. Reviewers ran no runtime gates. The integration owner separately observed 403 behavioral tests, public/DOM-free core types, numerical matrices, zero-vulnerability development/runtime/Vite audits, isolated installed-package/asset/type gates, expressive MIDI-to-Arrangement PCM/WAV smoke and the unchanged isolated p99 deadline gate. Unexpected numbered live-tree generated copies are preserved and excluded. Publish only exact committed canonical assets after remote Node/browser CI passes; retain the commit, CI URL and archive digest in the GitHub release record. This is not npm provenance or physical-device/MIDI/listening certification.

v1.11 review: SecInputsProtocol approved scoped static A/B (voice v7 validation, .opm parser, MIDI program/RPN boundaries, synth and effects worklet protocols, effects URL/lifecycle) with no evidence-backed vulnerability. SecDspSupply returned approved-with-fixes C/D with low/informational findings only: the deployment inventory now requires worklet/fx-processor.js (with a rejection test), the effects headroom documentation is qualified as a steady-state ceiling (a feedback decrease can briefly exceed 0.7 during its 20 ms ramp), the input table above now covers v7 and .opm, and capacity candidates are documented as sine-operator measurements. Reviewers ran no runtime gates. The integration owner separately observed the typecheck, the full behavioral suite, the npm run security gate, and a real Chromium AudioWorklet smoke of the noise and waveform voices through the effects insert. Physical devices, MIDI hardware and human listening remain unverified; this is not a release, npm publication or deployment record.

v1.11.1 review: SecFastSin approved a scoped static review of the fastSin polynomial and all-sine render fast path (NaN/Infinity containment, |value| ≤ 1 bound, determinism, O(1) cost, state parity with the generic path) with no evidence-backed vulnerability. The reviewer ran no runtime gates; the integration owner ran tests, typecheck, the package-smoke security gates and a Chrome AudioWorklet smoke.

v1.12.0 review: SecPortV112 approved a scoped static review (checklist C plus option intake) of the per-algorithm sine frames, steady-gain and settled-pitch caching, carrier-based retirement, LFO delay fade, fastSin/fastExp2, soft-knee saturation, the DC blocker and saturation/dcBlock intake across Synth, OPM, sequence, Worker and project settings, with no evidence-backed vulnerability. Its informational hardening items were applied (the DC blocker state resets on a non-finite mix; the fastExp2 power-of-two table is built by exact doubling). Remaining low/info notes: the all-sine frames check modulator finiteness at frame end, so a transient non-finite modulator value behind zero downstream gains is not counted (no reachable trigger from validated finite envelopes; output and state are unaffected); renderNote destructures its options rather than reading own data (pre-existing; values are still validated by readSynthOptions); and OPM throws RangeError where the core throws TypeError for an invalid saturation, matching the existing stealing behavior. The reviewer ran no runtime gates; the integration owner ran the build, tests, typecheck, sound-quality, voice-quality, npm run security -- --package-smoke and a headless Chromium OfflineAudioContext smoke of the synth and effects worklets for every quality profile with both output stages.

Unreleased performance review: SecPerfRound2 approved a scoped static checklist C review of half-turn phases and sinPi, Estrin fastExp2, the geometric envelope carry with segment-end and voice-level fast paths, the all-zero-gain silent frame, note-on LFO/kernel/pitch-envelope snapshots and the per-frame decimator API, with no evidence-backed vulnerability. Its hardening items were applied: the LFO waveform code is resolved before a voice slot is taken, and the silent frame also counts non-finite folded amplitudes. The reviewer ran no runtime gates; the integration owner ran tests, typecheck, build, npm run security -- --package-smoke, npm run sound-quality, bit-identity scripts against the previous step and a Chrome core/worklet/Worker smoke.

Unreleased allocation follow-up: SecAllocReview approved a scoped static checklist C review of the 4-slot decimator header with DECIMATOR_OUTPUT, void decimateFrame and dcBlockStep, boolean renderVoice with an internal fade gain, prepareGains/preparePitch without per-frame double arguments, and per-branch generic operator values. All ring offsets stay within DECIMATOR_STATE_SIZE (150); non-finite voices and mixes are still counted as errors and silenced with state reset; fade gain and determinism are unchanged; no loops or allocations were added; and peak/settle/idle logic correctly excludes the derived output slot. Its comment suggestion was applied. A ring-layout assertion was not added because the per-quality bit-identity and impulse tests already exercise every ring. The later change in periodicWaveform, adding unary + to number-valued cases, is an identity on numbers. Its non-finite input guard is unchanged, and bit-identity scripts confirmed the output. The later storeGain wrapper writes gainAt at the same time expression (elapsed / sampleRate, plus subTimes[sub]) into the gain arrays prepareGains already wrote, at in-bounds indices; it adds no state, loops or validation paths. Bit-identity scripts confirmed the output.

Unreleased waveform-frame review: SecWaveFrames approved a scoped static checklist C review of waveFrame0–waveFrame7. These are per-algorithm frames for noise-free voices that mix sine with other periodic shapes. The review also covered the frameKernel selection and rename.

• Each frame keeps the sine frames' per-sample and end-of-frame finiteness checks, and writes state back only after they pass.
• Waveform codes are written only at admission (0 selects sine frames, 1–7 wave frames, 8 the generic loop).
• Per-frame work is fixed and allocation-free.
• Topology and state updates match the generic loop, and the strengthened identity test checks this for all eight algorithms.
• Its comment suggestion, that non-sine operators mask non-finite phases exactly as the generic loop does, was applied.

Unreleased WAV dither review: SecDither reviewed the opt-in dither option.

• Approved on security.
  • Dithered samples are clamped, so neither setInt16 nor 24-bit packing can wrap.
  • The xorshift32 state cannot reach zero.
  • The option is validated through sequenceOwnData, without prototype or getter leaks, and rejected for Float32.
  • The Worker requires an own boolean dither field, as it does format.
  • Undithered output is unchanged.
• Its Low determinism finding was fixed: a chunk rejected midway used to advance the dither state, so later bytes diverged from encodeWav. encode() now dithers a copy of the state and commits it only after the chunk succeeds, and a regression test covers this.

v1.13.0 release: covered by the SecPerfRound2, SecAllocReview, SecWaveFrames and SecDither records above (all approved, findings applied). The release adds no further source changes beyond the version number.

Unreleased voice v8 review: SecVoiceV8 approved a scoped static review of checklist A, C and the B paths that reach voice/control validation, for adsr.sr, voice pan, the noise LFO, the 5-key operatorADSR, the held-decay envelope segment, lfoCycle/lfoNoise, the pan clamp and the .opm/DX7 mappings, with no evidence-backed vulnerability.

• Both validation paths reject accessors, symbol and unknown keys, and legacy versions carrying the new fields; the strict path rejects and the bank path clamps out-of-range values; prepared snapshots stay frozen.
• The smallest key-scaled sustain rate (about 1.9e-9 s) is still positive; its per-substep ratio underflows to exactly zero, never NaN, and the floor clamp keeps every dB value finite.
• Work per frame stays fixed and allocation-free; the new segment uses the existing anchor grid, so output stays chunk independent. lfoCycle over a 24-hour render stays far below 2^53, so the hash inputs are exact.
• Its informational hardening item was applied: each path now probes sr once (one hasOwn or one ownKeys snapshot), so a main-thread proxy cannot answer the version gate and the read differently.
• The reviewer ran no runtime gates; the integration owner's tests, bit-identity A/B and smoke checks are recorded in CHANGELOG.

v1.13.1 release: covered by the SecVoiceV8 record above (approved, hardening applied); the release adds only version numbers and documentation beyond that reviewed source. Commit ae7b5e6 passed Node 22/24/26 and Chromium/Firefox/WebKit CI.

• Sandboxing the host page (OPM.js runs in the page's trust domain; XSS protection is the embedder's job)
• DRM / copy protection of voice banks
• Remote code loading of any kind — never supported