StemDeck Stage 1 — Quality Gate

- **Target**: `crates/audio-engine/src/stem_deck.rs` (1643 lines) + the `fx.rs` SVF coefficient-caching change. - **HEAD**: `749408de` on `feat/femto-only-bar` (21 prior meta-review findings already fixed). - **Baseline**: `cargo test -p audio-engine` — 67 pass, 0 fail, 3 ignored. - **Method**: Layer 1 meta-review (6 parallel domain passes + contrarian) → Layer 2 meta:amr (6-domain adversarial debate) → Layer 3 meta:adversarial (Codex gpt-5.3-codex, read-only). The Hydra quality gate (0 critical AND 0 high) does **not** pass as-is — the 2 High findings block. Both are small, well-localized fixes. Codex's structural finding: the sample-locked playhead model and the `render()` path are sound; Stage 2 (`StemConductor`) can be built on `StemDeck` once the 2 Highs (and ideally the 4 Mediums) are fixed. The chain earned its cost: it found **QG-A** — a reachable panic in the audio worker — and **QG-FX1** — reverb default-state incoherence. Both were missed by the original 21-finding meta-review. It also killed 8 false or overstated findings under adversarial pressure. | ID | File:Line | Finding | Fix | |----|-----------|---------|-----| | QG-A | fx.rs:170, 184, 210, 214 / fx.rs:515, 564, 570 / stem_deck.rs:319 | No sample-rate validation at the construction boundary. `DelayFx::new`/`FlangerFx::new` size their ring buffers as `(sample_rate * N) as usize`, which is `0` for a zero/tiny `sample_rate` → empty `Vec`. Then `DelayFx::set_delay_ms` does `buffer.len() - 1` (usize underflow) and `process_sample` does `% buffer.len()` (divide-by-zero) → **panic aborts the audio worker**. Zero/non-finite `sample_rate` also yields NaN SVF coefficients. `StemDeck::new` passes `sample_rate` through unchecked. | Validate `sample_rate` once in `StemDeck::new` (finite, `> 0`, `== 48_000.0` per the 48kHz-only contract — return `Result`/`bail!`). Add `.max(1)` to the `DelayFx`/`FlangerFx` buffer sizing as defense-in-depth — mirrors `CombFilter::new(size.max(1))` already in the same file; Delay/Flanger are an inconsistent omission. | | QG-2 | stem_deck.rs:1599 | `loop_seam_is_click_free` tolerance is `filtered_jump <= raw_jump * 1.25 + 1e-4` — it *permits the filter to amplify the seam discontinuity by 25%*. The test guarding the headline click-free guarantee cannot fail for the right reason. | `filtered_jump <= raw_jump + 1e-4` — the filter must dampen the seam, never amplify it. | | ID | File:Line | Finding | Fix | |----|-----------|---------|-----| | QG-1 | stem_deck.rs:179 | `StemFeatureSet::parse` accepts non-finite/negative `bpm` — the `bpm <= 0.0` guard does not catch `NaN` (NaN comparisons are false). Downstream is mostly protected (`bpm()` returns `None` for non-positive), so impact is contained, but a malformed `features.json` should be rejected at parse, not absor