address review: grid fallback stays on snap positions and bars; thumbnail positions in f64

AGENTS.md

@@ -53,8 +53,8 @@ User-visible behaviour = a command in `crates/engine/src/cmd/*` (id, label, menu
 Parity is measured, not guessed: `crates/engine/catalog/menus.txt` lists the incumbent's menu leaves (names only). `cargo xtask parity` writes `docs/parity-checklist.md` (generated; the hand-written assessment is `docs/target-app-parity.md`); a test enforces a floor that only rises.
 
 ## Running and looking at the app
-- `cargo run --release -p soundcraft -- --demo --control 0` (demo session + control channel on a free port; the port and the launch's `SOUNDCRAFT_CONTROL_TOKEN` are printed, or export the token first so both sides share it).
-- Drive it: JSON lines over TCP, e.g. `{"id":1,"method":"engine.execute","params":{"command":"track.new","params":{"count":2,"format":"stereo"}},"token":"…"}`, then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"},"token":"…"}`. Methods: `crates/ui-egui/src/control.rs`, docs: `docs/control-protocol.md`.
+- `cargo run --release -p soundcraft -- --demo --control 0` (demo session + control channel on a free port; the port is printed).
+- Drive it: JSON lines over TCP, e.g. `{"id":1,"method":"engine.execute","params":{"command":"track.new","params":{"count":2,"format":"stereo"}}}`, then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`, docs: `docs/control-protocol.md`.
 - Offscreen UI render (no window, no focus stealing): `cargo run -p soundcraft-ui-egui --example ui_shot -- out.png [script.jsonl]`.
 - Headless: `soundcraft-cli run --demo --cmd 'mix.volume={"track":"Kick","db":-6}' --bounce out.wav`; MCP: `soundcraft-cli mcp [--connect PORT]`.
 - **For UI work, look at the result** (render, read the PNG) and compare with `plan/protools/screenshots/`.

Cargo.lock

@@ -4304,7 +4304,6 @@ dependencies = [
  "craft-update",
  "eframe",
  "egui",
- "getrandom 0.3.4",
  "log",
  "muda",
  "objc2 0.6.5",

README.md

@@ -214,8 +214,7 @@ soundcraft-cli run --demo \
   --cmd 'mix.insert={"track":"Bass","plugin":"eq_7band"}' \
   --bounce mix.wav
 
-# Drive the running app (the token keeps other local accounts off the loopback port).
-export SOUNDCRAFT_CONTROL_TOKEN=$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')
+# Drive the running app.
 soundcraft --demo --control 7801 &
 soundcraft-cli app --port 7801 transport.play
 soundcraft-cli app --port 7801 ui.screenshot '{"path":"shot.png"}'

apps/soundcraft/Cargo.toml

@@ -26,8 +26,6 @@ egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"
 serde_json.workspace = true
 log.workspace = true
 chrono.workspace = true
-# The per-launch control token (already in the graph through egui's ahash).
-getrandom = "0.3"
 
 [target.'cfg(all(unix, not(any(target_os = "macos", target_os = "linux"))))'.dependencies]
 winit = { version = "0.30", default-features = false, features = ["x11"] }

apps/soundcraft/src/control_server.rs

@@ -3,13 +3,8 @@
 //!
 //! Lines are bounded ([`MAX_LINE`]): a longer one is refused and the connection closed, without
 //! buffering the rest. So is the number of connections served at once ([`MAX_CONNECTIONS`]).
-//!
-//! Every request carries the launch's secret as `"token"` (`SOUNDCRAFT_CONTROL_TOKEN`, or one made
-//! here and printed after the port): the port is loopback, which any local account can reach, and
-//! a request acts with this process's authority.
 
 use serde_json::{Value, json};
-use soundcraft_automation::CONTROL_TOKEN_VAR;
 use soundcraft_ui_egui::ControlRequest;
 use std::io::{BufRead, BufReader, Read, Write};
 use std::net::{TcpListener, TcpStream};
@@ -33,20 +28,9 @@ const MAX_CONNECTIONS: usize = 16;
 const MAX_QUEUED_REQUESTS: usize = MAX_CONNECTIONS;
 
 /// Bind the loopback control listener and return the request receiver. Port 0 picks a free one and the actual port is
-/// printed; bind or spawn failures are logged instead of panicking. Requests must carry `token`; with `None` one is
-/// made for this launch and printed after the port, so only the launching process learns it.
-pub fn start(port: u16, token: Option<String>, ctx: egui::Context) -> Receiver<ControlRequest> {
+/// printed; bind or spawn failures are logged instead of panicking.
+pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = sync_channel::<ControlRequest>(MAX_QUEUED_REQUESTS);
-    let (token, made) = match token {
-        Some(t) => (t, false),
-        None => match new_token() {
-            Ok(t) => (t, true),
-            Err(e) => {
-                log::error!("control server not started: no {CONTROL_TOKEN_VAR} and no random token: {e}");
-                return rx;
-            }
-        },
-    };
     let listener = match TcpListener::bind(("127.0.0.1", port)) {
         Ok(l) => l,
         Err(e) => {
@@ -57,29 +41,13 @@ pub fn start(port: u16, token: Option<String>, ctx: egui::Context) -> Receiver<C
     let actual = listener.local_addr().map(|a| a.port()).unwrap_or(port);
     log::info!("control server listening on 127.0.0.1:{actual}");
     println!("SOUNDCRAFT_CONTROL_PORT={actual}");
-    if made {
-        println!("{CONTROL_TOKEN_VAR}={token}");
-    }
-    let spawned = std::thread::Builder::new().name("soundcraft-control".into()).spawn(move || accept_loop(listener, tx, ctx, Arc::from(token)));
+    let spawned = std::thread::Builder::new().name("soundcraft-control".into()).spawn(move || accept_loop(listener, tx, ctx));
     if let Err(e) = spawned {
         log::error!("control thread failed: {e}");
     }
     rx
 }
 
-/// 32 random bytes as hex, from the OS.
-fn new_token() -> Result<String, getrandom::Error> {
-    let mut bytes = [0u8; 32];
-    getrandom::fill(&mut bytes)?;
-    Ok(bytes.iter().map(|b| format!("{b:02x}")).collect())
-}
-
-/// `token` equals `expected`, compared in time that doesn't depend on where they differ.
-fn token_matches(token: Option<&str>, expected: &str) -> bool {
-    let Some(token) = token else { return false };
-    token.len() == expected.len() && token.bytes().zip(expected.bytes()).fold(0u8, |acc, (a, b)| acc | (a ^ b)) == 0
-}
-
 /// A connection's place among [`MAX_CONNECTIONS`], given back when the connection ends (also when
 /// its thread can't be started, or panics).
 struct Slot(Arc<AtomicUsize>);
@@ -92,7 +60,7 @@ impl Drop for Slot {
 
 /// Accept until the listener closes, admitting at most [`MAX_CONNECTIONS`] peers; excess peers get one error line.
 /// Each admitted connection is served on its own thread, releasing its slot on exit.
-fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui::Context, token: Arc<str>) {
+fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui::Context) {
     let open = Arc::new(AtomicUsize::new(0));
     for mut stream in listener.incoming().flatten() {
         if open.fetch_add(1, Ordering::SeqCst) >= MAX_CONNECTIONS {
@@ -103,10 +71,9 @@ fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui:
         let slot = Slot(Arc::clone(&open));
         let tx = tx.clone();
         let ctx = ctx.clone();
-        let token = Arc::clone(&token);
         let _ = std::thread::Builder::new().name("soundcraft-control-conn".into()).spawn(move || {
             let _slot = slot;
-            serve(stream, tx, ctx, &token);
+            serve(stream, tx, ctx);
         });
     }
 }
@@ -136,9 +103,8 @@ fn read_bounded_line(reader: &mut impl BufRead, buf: &mut Vec<u8>, max: usize) -
 }
 
 /// Answer newline-delimited JSON requests for one connection: bound each line, forward it to the UI thread with a 90
-/// s reply deadline, and stop at EOF, invalid UTF-8, a closed request queue or a wrong `token`. Bad JSON still gets
-/// an error reply.
-fn serve(stream: TcpStream, tx: SyncSender<ControlRequest>, ctx: egui::Context, token: &str) {
+/// s reply deadline, and stop at EOF, invalid UTF-8 or a closed request queue. Bad JSON still gets an error reply.
+fn serve(stream: TcpStream, tx: SyncSender<ControlRequest>, ctx: egui::Context) {
     let Ok(read) = stream.try_clone() else { return };
     let mut out = stream;
     let mut reader = BufReader::new(read);
@@ -160,11 +126,6 @@ fn serve(stream: TcpStream, tx: SyncSender<ControlRequest>, ctx: egui::Context,
         let reply = match serde_json::from_str::<Value>(line) {
             Ok(msg) => {
                 let id = msg.get("id").cloned().unwrap_or(Value::Null);
-                if !token_matches(msg.get("token").and_then(Value::as_str), token) {
-                    let error = format!("unauthorized: the request's `token` is not this app's {CONTROL_TOKEN_VAR}");
-                    let _ = writeln!(out, "{}", json!({"ok": false, "id": id, "error": error}));
-                    break;
-                }
                 let method = msg.get("method").and_then(Value::as_str).unwrap_or("").to_string();
                 let params = msg.get("params").cloned().unwrap_or(json!({}));
                 let (req, rrx) = ControlRequest::new(method, params);
@@ -224,14 +185,12 @@ mod tests {
         assert!(state + request.to_string().len() <= MAX_LINE);
     }
 
-    const TOKEN: &str = "s3cret";
-
     /// The control server on a loopback port, with a stand-in UI that echoes each method.
     fn serve_echo() -> std::net::SocketAddr {
         let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
         let addr = listener.local_addr().unwrap();
         let (tx, rx) = sync_channel::<ControlRequest>(MAX_QUEUED_REQUESTS);
-        std::thread::spawn(move || accept_loop(listener, tx, egui::Context::default(), Arc::from(TOKEN)));
+        std::thread::spawn(move || accept_loop(listener, tx, egui::Context::default()));
         std::thread::spawn(move || {
             for req in rx {
                 let _ = req.reply.send(json!({"ok": true, "method": req.method}));
@@ -245,7 +204,7 @@ mod tests {
         let addr = serve_echo();
         let mut c = TcpStream::connect(addr).unwrap();
         c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
-        c.write_all(b"{\"id\":3,\"method\":\"ping\",\"token\":\"s3cret\"}\r\n\n{\"id\":4,\"method\":\"pong\",\"token\":\"s3cret\"}\n").unwrap();
+        c.write_all(b"{\"id\":3,\"method\":\"ping\"}\r\n\n{\"id\":4,\"method\":\"pong\"}\n").unwrap();
         let mut r = BufReader::new(c);
         for (id, method) in [(3, "ping"), (4, "pong")] {
             let mut line = String::new();
@@ -255,29 +214,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn a_request_without_the_token_is_refused_and_the_connection_closed() {
-        let addr = serve_echo();
-        for request in [r#"{"id":1,"method":"ping"}"#, r#"{"id":1,"method":"ping","token":"s3cre"}"#, r#"{"id":1,"method":"ping","token":"S3CRET"}"#]
-        {
-            let mut c = TcpStream::connect(addr).unwrap();
-            c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
-            writeln!(c, "{request}").unwrap();
-            let mut r = BufReader::new(c);
-            let mut line = String::new();
-            r.read_line(&mut line).unwrap();
-            let v: Value = serde_json::from_str(&line).unwrap();
-            assert_eq!((v["id"].as_i64(), v["ok"].as_bool()), (Some(1), Some(false)), "{line}");
-            assert!(v["error"].as_str().unwrap_or("").starts_with("unauthorized"), "{line}");
-            assert!(v.get("method").is_none(), "the request was not forwarded: {line}");
-            line.clear();
-            assert_eq!(r.read_line(&mut line).unwrap(), 0, "the connection is closed after a refusal");
-        }
-        assert!(token_matches(Some(TOKEN), TOKEN));
-        assert!(!token_matches(None, TOKEN));
-        assert_eq!(new_token().unwrap().len(), 64);
-    }
-
     #[test]
     fn extra_connections_are_refused() {
         let addr = serve_echo();

apps/soundcraft/src/main.rs

@@ -3,9 +3,8 @@
 //! Usage: `soundcraft [--demo] [--control <port>] [--no-audio] [session.scraft | audio files…]`; `soundcraft --help` lists the flags and `SOUNDCRAFT_CONTROL_PORT`.
 //!
 //! `--control <port>` (or `SOUNDCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server
-//! (`0` picks a free port and prints it): `{"id":1,"method":"ui.inspect","params":{},"token":"…"}` →
-//! `{"id":1,"ok":true,"result":…}`, where `token` is `SOUNDCRAFT_CONTROL_TOKEN` (or the one made for
-//! this launch, printed after the port). See `soundcraft_ui_egui::control` for the methods.
+//! (`0` picks a free port and prints it): `{"id":1,"method":"ui.inspect","params":{}}` →
+//! `{"id":1,"ok":true,"result":…}`. See `soundcraft_ui_egui::control` for the methods.
 //!
 //! `log` records go to standard error and `<settings dir>/logs/soundcraft.log` (`RUST_LOG` sets the
 //! levels); see [`logging`].
@@ -261,7 +260,7 @@ fn main() -> eframe::Result {
             app.extra.ui_scale = prefs.ui_scale;
             app.ui = prefs;
             if let Some(port) = control_port {
-                let rx = control_server::start(port, soundcraft_automation::control_token(), cc.egui_ctx.clone());
+                let rx = control_server::start(port, cc.egui_ctx.clone());
                 app = app.with_control(rx);
             }
             for f in &files {

crates/automation/src/lib.rs

@@ -151,31 +151,18 @@ impl RemoteError {
 
 type Connection = (TcpStream, BufReader<TcpStream>);
 
-/// The variable carrying the control channel's secret: the app refuses every request whose
-/// `token` differs from it, so another local account can't drive the app through the loopback
-/// port. The app makes one per launch when the variable is unset (printed after the port line).
-pub const CONTROL_TOKEN_VAR: &str = "SOUNDCRAFT_CONTROL_TOKEN";
-
-/// [`CONTROL_TOKEN_VAR`] from the environment; a blank value counts as unset.
-pub fn control_token() -> Option<String> {
-    std::env::var(CONTROL_TOKEN_VAR).ok().map(|t| t.trim().to_owned()).filter(|t| !t.is_empty())
-}
-
 /// A TCP client for a running app's control channel.
 pub struct Remote {
     /// The target as `host:port`, for connecting and for messages.
     addr: String,
-    /// Sent with every request; without one the app refuses, naming the variable.
-    token: Option<String>,
     conn: Option<Connection>,
     next_id: u64,
 }
 
 impl Remote {
-    /// A client for the app at `target`, authenticating with [`control_token`]; it connects on the
-    /// first request.
+    /// A client for the app at `target`; it connects on the first request.
     pub fn new(target: &ControlTarget) -> Self {
-        Remote { addr: target.to_string(), token: control_token(), conn: None, next_id: 1 }
+        Remote { addr: target.to_string(), conn: None, next_id: 1 }
     }
 
     /// The open connection, connecting first when there is none.
@@ -191,7 +178,7 @@ impl Remote {
     fn roundtrip(&mut self, method: &str, params: &Value) -> Result<Value, (RemoteError, bool)> {
         let id = self.next_id;
         self.next_id += 1;
-        let line = json!({"id": id, "method": method, "params": params, "token": self.token}).to_string();
+        let line = json!({"id": id, "method": method, "params": params}).to_string();
         let (w, r) = self.connection().map_err(|e| (e, false))?;
         writeln!(w, "{line}").map_err(|e| (e.into(), false))?;
         let mut buf = String::new();

crates/ui-egui/src/panels/midi_editor.rs

@@ -265,20 +265,42 @@ fn draw_roll_background(painter: &egui::Painter, g: &Roll<'_>) {
         }
     }
     // Grid.
+    let step = grid_stride(grid_ticks, px_per_tick);
     let mut tick = 0;
     while tick <= len_ticks {
         let bar = tick % (TICKS_PER_QUARTER * 4) == 0;
         let x = g.x_of(tick);
-        if grid_ticks as f32 * px_per_tick > 4.0 || bar {
-            painter.line_segment(
-                [pos2(x, roll.min.y), pos2(x, roll.max.y)],
-                Stroke::new(1.0, if bar { Color32::from_rgb(80, 80, 86) } else { Color32::from_rgb(50, 50, 54) }),
-            );
-        }
-        tick += grid_ticks;
+        painter.line_segment(
+            [pos2(x, roll.min.y), pos2(x, roll.max.y)],
+            Stroke::new(1.0, if bar { Color32::from_rgb(80, 80, 86) } else { Color32::from_rgb(50, 50, 54) }),
+        );
+        tick = tick.saturating_add(step);
     }
 }
 
+/// Closest lines the grid draws, in points.
+const MIN_GRID_PX: f32 = 4.0;
+
+/// Ticks between grid lines: the grid when its lines are more than [`MIN_GRID_PX`] apart, else
+/// as few common multiples of the grid and a bar as keep that spacing (so every line is a snap
+/// position and falls on a bar). The lines drawn are then bounded by the roll's width, however long
+/// the clip, instead of by its length.
+fn grid_stride(grid_ticks: i64, px_per_tick: f32) -> i64 {
+    let bar_ticks = TICKS_PER_QUARTER * 4;
+    if grid_ticks as f32 * px_per_tick > MIN_GRID_PX {
+        return grid_ticks.max(1);
+    }
+    let grid = grid_ticks.max(1);
+    let (mut a, mut b) = (grid, bar_ticks);
+    while b != 0 {
+        (a, b) = (b, a % b);
+    }
+    let common = (grid / a).saturating_mul(bar_ticks);
+    // `as` saturates a huge or NaN quotient; a zero `px_per_tick` gives one common multiple.
+    let n = (MIN_GRID_PX / (common as f32 * px_per_tick)).ceil().max(1.0) as i64;
+    common.saturating_mul(n)
+}
+
 /// The notes, with a drag in progress applied.
 fn draw_notes(app: &SoundApp, painter: &egui::Painter, g: &Roll<'_>, base: Color32) {
     let Roll { sequence, grid_ticks, .. } = *g;
@@ -478,6 +500,24 @@ fn velocity_lane(app: &mut SoundApp, ui: &mut Ui, g: &Roll<'_>, cid: ClipId, bas
 mod tests {
     use super::*;
 
+    #[test]
+    fn grid_lines_are_bounded_by_the_roll_width_not_the_clip_length() {
+        let sixteenth = TICKS_PER_QUARTER / 4;
+        // A 1000 pt roll showing a 4-bar clip: every sixteenth is 16 pt apart and drawn.
+        assert_eq!(grid_stride(sixteenth, 1000.0 / (16.0 * TICKS_PER_QUARTER as f32)), sixteenth);
+        // The same roll over a clip a billion ticks long: at most a line every 4 pt.
+        let (len, px_per_tick) = (1_000_000_000i64, 1000.0 / 1_000_000_000.0f32);
+        let step = grid_stride(sixteenth, px_per_tick);
+        assert_eq!(step % (TICKS_PER_QUARTER * 4), 0, "lines fall on bars");
+        assert!((len / step) <= 251, "{} lines", len / step);
+        // a dotted quarter grid (1440 ticks): every line is also a grid position
+        let dotted = TICKS_PER_QUARTER * 3 / 2;
+        let step = grid_stride(dotted, px_per_tick);
+        assert_eq!((step % dotted, step % (TICKS_PER_QUARTER * 4)), (0, 0), "lines are snap positions on bars: {step}");
+        assert!((len / step) <= 251, "{} lines", len / step);
+        assert!(grid_stride(0, 0.0) >= TICKS_PER_QUARTER * 4, "a zero grid or width still advances");
+    }
+
     #[test]
     fn switching_clip_drops_selection_and_gestures() {
         let mut st = MidiEditorState { selected: vec![0, 2], clip: Some(ClipId(1)), band: Some(pos2(1.0, 2.0)), ..Default::default() };

crates/ui-egui/src/panels/video_window.rs

@@ -115,6 +115,20 @@ fn first_movie_aspect(s: &soundcraft_model::Session) -> Option<f32> {
     s.videos.first().map(|v| v.aspect() as f32)
 }
 
+/// Most thumbnails one clip draws in the Video Universe strip: 8 pt each, so more than the
+/// widest strip holds.
+const MAX_UNIVERSE_THUMBS: usize = 1 << 12;
+
+/// Left edges of the thumbnails of a clip starting at `clip_x` (each `tw` wide) that lie in
+/// `shown_min..shown_max`. The index and position are worked out in `f64`: an `f32` this far from
+/// the origin (a clip starting a billion points left) cannot step by a thumbnail's width.
+fn thumb_xs(clip_x: f32, shown_min: f32, shown_max: f32, tw: f32) -> impl Iterator<Item = f32> {
+    let (origin, tw) = (f64::from(clip_x), f64::from(tw));
+    let first = ((f64::from(shown_min) - origin) / tw).floor().max(0.0);
+    let count = ((f64::from(shown_max) - origin) / tw - first).ceil().max(0.0) as usize;
+    (0..count.min(MAX_UNIVERSE_THUMBS)).map(move |i| (origin + (first + i as f64) * tw) as f32)
+}
+
 fn universe(app: &mut SoundApp, ctx: &egui::Context) {
     app.video.poll(ctx);
     let s = app.engine.session_arc();
@@ -145,8 +159,10 @@ fn universe(app: &mut SoundApp, ctx: &egui::Context) {
             }
             let tw = (cr.height() * v.aspect() as f32).max(8.0);
             let hpx = ((cr.height() * ppp / 16.0).ceil() * 16.0).clamp(16.0, 256.0) as u32;
-            let mut x = cr.min.x;
-            while x < cr.max.x {
+            // Only the thumbnails inside the strip, counted rather than stepped: a clip starting
+            // far left of it has an edge so large that adding a thumbnail's width wouldn't move it.
+            let shown = cr.intersect(r);
+            for x in thumb_xs(cr.min.x, shown.min.x, shown.max.x, tw) {
                 let secs = movie_secs(&s, c.start, offset, strip_position(x, r.min.x, r.width(), end, c.start)).max(0.0);
                 if let Some(tex) = app.video.thumb(ctx, key, &v.path, secs, hpx) {
                     let tr = Rect::from_min_size(pos2(x, cr.min.y), vec2(tw, cr.height()));
@@ -154,7 +170,6 @@ fn universe(app: &mut SoundApp, ctx: &egui::Context) {
                     let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2((vis.width() / tw).clamp(0.0, 1.0), 1.0));
                     painter.image(tex.id(), vis, uv, Color32::WHITE);
                 }
-                x += tw;
             }
         }
         // The Edit window's visible range and the playhead.
@@ -182,7 +197,18 @@ fn universe(app: &mut SoundApp, ctx: &egui::Context) {
 
 #[cfg(test)]
 mod tests {
-    use super::strip_position;
+    use super::{strip_position, thumb_xs};
+
+    #[test]
+    fn thumbnails_of_a_clip_far_left_of_the_strip_are_evenly_spaced() {
+        // 2^30 points left of the strip with 8 pt thumbnails: f32 steps of `first + i` here are 16 apart
+        let xs: Vec<f32> = thumb_xs(-1_073_741_824.0, 0.0, 80.0, 8.0).collect();
+        assert_eq!(xs.len(), 10);
+        assert!(xs.windows(2).all(|w| w[1] - w[0] == 8.0), "{xs:?}");
+        assert_eq!(xs[0], 0.0);
+        // a clip inside the strip starts at its own edge
+        assert_eq!(thumb_xs(10.0, 10.0, 34.0, 8.0).collect::<Vec<_>>(), vec![10.0, 18.0, 26.0]);
+    }
 
     // A 1024 px strip over 1_024_000 samples: 1000 samples per point, exact in f32.
     const LEFT: f32 = 100.0;

docs/cli.md

@@ -77,8 +77,6 @@ link stays. An existing file that is not an input is replaced without asking.
 |---|---|---|
 | `SOUNDCRAFT_CONTROL_PORT` | `app --port` (CLI), `--control` (desktop app) | A port or `host:port`, an IPv6 host in brackets (`[::1]:7979`). The desktop app takes the port of a loopback `host:port` (`127.0.0.1`, `localhost`). Its control server listens on `127.0.0.1` only, so it ignores another host from the variable, with a log warning, and starts no control server; given to `--control`, another host is a usage error |
 
-| `SOUNDCRAFT_CONTROL_TOKEN` | none | The secret every control request carries as `token`. The desktop app refuses requests without it; unset, it makes one per launch and prints it after the port line (`SOUNDCRAFT_CONTROL_TOKEN=…`). `app` and `mcp --connect` send the variable's value |
-
 - A flag wins over its variable.
 - An empty variable counts as unset.
 - A bad value is a usage error that names the variable.

docs/control-protocol.md

@@ -6,7 +6,7 @@ input), and every command is reachable from:
 
 | Surface | How |
 |---|---|
-| Desktop app control channel | `soundcraft --control <port>` (`0` = pick a free port; printed as `SOUNDCRAFT_CONTROL_PORT=…`, then the launch's `SOUNDCRAFT_CONTROL_TOKEN=…` unless the variable was set) |
+| Desktop app control channel | `soundcraft --control <port>` (`0` = pick a free port; printed as `SOUNDCRAFT_CONTROL_PORT=…`) |
 | CLI against a running app | `soundcraft-cli app --port <port> <method or command id> [JSON]` (see [cli.md](cli.md)) |
 | Headless CLI | `soundcraft-cli run --demo --cmd 'mix.volume={"track":"Kick","db":-6}' --bounce out.wav` |
 | MCP (headless) | `soundcraft-cli mcp [--demo]` |
@@ -29,17 +29,12 @@ input delivery or screen-reader acceptance. Native screenshots use the presented
 Newline-delimited JSON over TCP on `127.0.0.1`. One request per line, one reply per line:
 
 ```json
-{"id": 1, "method": "engine.execute", "params": {"command": "track.new", "params": {"count": 2, "format": "Stereo"}}, "token": "…"}
+{"id": 1, "method": "engine.execute", "params": {"command": "track.new", "params": {"count": 2, "format": "Stereo"}}}
 {"id": 1, "ok": true, "result": {"tracks": [12, 13]}}
 ```
 
 Errors: `{"id": 1, "ok": false, "error": "bad parameters for `mix.volume`: no track named `Nope`"}`.
 
-`token` is the launch's secret: `SOUNDCRAFT_CONTROL_TOKEN` when the app was started with it, otherwise
-the one the app made and printed after the port line. Any local account can reach the loopback port,
-so a request without the right token is refused (`"error": "unauthorized: …"`) and its connection
-closed. `soundcraft-cli app` and `mcp --connect` read the variable.
-
 ## Methods
 
 | Method | Params | What it does |
@@ -76,7 +71,6 @@ Scripted input (`ui.click`, `ui.drag`, `ui.scroll`, `ui.zoom`, `ui.key`, `ui.tex
 ## Examples
 
 ```sh
-export SOUNDCRAFT_CONTROL_TOKEN=$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')
 P=$(soundcraft --demo --control 0 | sed -n 's/SOUNDCRAFT_CONTROL_PORT=//p')   # or read stderr
 soundcraft-cli app --port $P mix.solo '{"track":"Bass"}'
 soundcraft-cli app --port $P transport.play

docs/mcp.md

@@ -8,7 +8,6 @@ Claude and other agents can make music with it. The server is the `mcp` subcomma
 soundcraft-cli mcp                    # headless engine (no window, no audio device)
 soundcraft-cli mcp --demo             # headless, starting from the demo session
 soundcraft-cli mcp --automation-read-root DIR --automation-write-root DIR   # headless, confined to folders
-export SOUNDCRAFT_CONTROL_TOKEN=…     # the secret both sides share (see control-protocol.md)
 soundcraft --control 7801 &           # the desktop app…
 soundcraft-cli mcp --connect 7801     # …driven over MCP: same tools plus screenshots and clicks
 ```