livepilot 1.26.2 → 1.27.1

package/mcp_server/memory/technique_store.py

@@ -31,6 +31,19 @@ class TechniqueStore:
         self._lock = threading.Lock()
         self._initialized = False
         self._data: dict = {"version": 1, "techniques": []}
+        # Signature (mtime_ns, size) of the file as we last loaded it. Lets
+        # multiple TechniqueStore instances pointing at the same file pick up
+        # each other's writes (reload-on-read) instead of caching stale data
+        # for the life of the process.
+        self._loaded_sig: Optional[tuple] = None
+
+    def _file_signature(self) -> Optional[tuple]:
+        """Return (mtime_ns, size) of the backing file, or None if absent."""
+        try:
+            st = self._file.stat()
+        except OSError:
+            return None
+        return (st.st_mtime_ns, st.st_size)
 
     def _ensure_initialized(self) -> None:
         """Lazily create directory and load data on first access.
@@ -40,12 +53,14 @@ class TechniqueStore:
         Thread-safe: uses double-checked locking to prevent concurrent
         callers from racing on initialization.
         """
-        if self._initialized:
+        # Fast path: already initialized AND the file on disk has not changed
+        # since we last loaded it (no other instance has written).
+        if self._initialized and self._file_signature() == self._loaded_sig:
             return
         with self._lock:
             # Double-check after acquiring lock — another thread may have
-            # initialized while we were waiting.
-            if self._initialized:
+            # (re)loaded while we were waiting.
+            if self._initialized and self._file_signature() == self._loaded_sig:
                 return
             try:
                 self._base_dir.mkdir(parents=True, exist_ok=True)
@@ -58,10 +73,12 @@ class TechniqueStore:
                 try:
                     with open(self._file, "r") as f:
                         self._data = json.load(f)
+                    self._loaded_sig = self._file_signature()
                 except (json.JSONDecodeError, ValueError):
                     corrupt = self._file.with_suffix(".json.corrupt")
                     self._file.rename(corrupt)
                     self._data = {"version": 1, "techniques": []}
+                    self._loaded_sig = None
             else:
                 self._data = {"version": 1, "techniques": []}
                 self._flush()
@@ -77,6 +94,9 @@ class TechniqueStore:
             f.flush()
             os.fsync(f.fileno())
         os.replace(str(tmp), str(self._file))
+        # Record the signature of our own write so this instance does not
+        # needlessly reload the data it already holds in memory.
+        self._loaded_sig = self._file_signature()
 
     # ── public API ───────────────────────────────────────────────
 

package/mcp_server/mix_engine/state_builder.py

@@ -241,8 +241,10 @@ def build_dynamics_state(
 
     crest = 20 * math.log10(max(peak_linear, 1e-10) / max(rms_linear, 1e-10))
 
-    # Over-compressed when crest factor < 6 dB (flat dynamics)
-    over_compressed = crest < 6.0
+    # Over-compressed band is 3-6 dB crest. Below 3 dB the signal is so flat
+    # that the dynamics critic should report the stronger `flat_dynamics`
+    # issue instead, which only fires when over_compressed is False.
+    over_compressed = 3.0 <= crest < 6.0
 
     # Headroom = distance from peak to 0 dBFS
     if peak_linear > 0:

package/mcp_server/musical_intelligence/detectors.py

@@ -134,9 +134,15 @@ def detect_repetition_fatigue(
         staleness = min(1.0, (reuse_count / total - 1) * 0.3) if total else 0
         report.section_staleness[name] = round(max(0, staleness), 3)
 
-    # Overall fatigue level
+    # Overall fatigue level — saturating combine (probabilistic OR) so that
+    # adding more issues never *reduces* fatigue. A plain mean would let a
+    # cluster of low-severity issues dilute a single serious one.
     if report.issues:
-        report.fatigue_level = min(1.0, sum(i["severity"] for i in report.issues) / max(1, len(report.issues)))
+        remaining_freshness = 1.0
+        for issue in report.issues:
+            severity = max(0.0, min(1.0, issue["severity"]))
+            remaining_freshness *= (1.0 - severity)
+        report.fatigue_level = min(1.0, 1.0 - remaining_freshness)
 
     # Recommendations
     if report.fatigue_level > 0.5:
@@ -337,6 +343,9 @@ def infer_section_purposes(
         if position < 0.15 and density < 0.5:
             purpose = "setup"
             confidence = 0.7
+        elif density >= 0.8 and density_delta >= 0:
+            purpose = "payoff"
+            confidence = 0.65
         elif density_delta > 0.2:
             purpose = "tension"
             confidence = 0.6

package/mcp_server/musical_intelligence/tools.py

@@ -215,8 +215,21 @@ def compare_phrase_renders(
 
     critiques = []
     for path in file_paths:
-        # Try to get cached analysis or run fresh
-        critique = phrase_critic.analyze_phrase(target=target)
+        # Run offline analysis per file so each render gets a real critique
+        loudness_data = None
+        spectrum_data = None
+        try:
+            from ..tools._perception_engine import compute_loudness
+            loudness_data = compute_loudness(path, detail="full")
+        except Exception as exc:
+            logger.debug("compare_phrase_renders loudness failed for %s: %s", path, exc)
+        try:
+            from ..tools._perception_engine import compute_spectral
+            spectrum_data = compute_spectral(path)
+        except Exception as exc:
+            logger.debug("compare_phrase_renders spectral failed for %s: %s", path, exc)
+
+        critique = phrase_critic.analyze_phrase(loudness_data, spectrum_data, target)
         critique.render_id = path.split("/")[-1] if isinstance(path, str) and "/" in path else str(path)
         critiques.append(critique)
 

package/mcp_server/preview_studio/engine.py

@@ -33,6 +33,35 @@ def store_preview_set(ps: PreviewSet) -> None:
         del _preview_sets[oldest_key]
 
 
+# Statuses that represent work a user (or caller) has already invested in:
+# a compared ranking or a committed pick. A fresh request that hashes to the
+# same set_id must NOT clobber these — it branches to a distinct id instead.
+_PROTECTED_STATUSES = {"committed", "compared"}
+
+
+def _resolve_set_id(base_id: str) -> str:
+    """Return a set_id that won't clobber a protected (committed/compared) set.
+
+    The base_id is a deterministic hash of request_text + kernel_id, so a
+    re-request reuses it by design. That reuse is fine while the existing set
+    is still 'pending'/'discarded' (nothing of value to lose). But if the
+    existing set under base_id has been compared or committed, overwriting it
+    would silently drop its rankings / committed pick. In that case we branch
+    to a distinct, still-deterministic id (base_id + a monotonic suffix) so the
+    protected set survives and the new set gets its own slot.
+    """
+    existing = _preview_sets.get(base_id)
+    if existing is None or existing.status not in _PROTECTED_STATUSES:
+        return base_id
+    suffix = 2
+    while True:
+        candidate = f"{base_id}_b{suffix}"
+        occupant = _preview_sets.get(candidate)
+        if occupant is None or occupant.status not in _PROTECTED_STATUSES:
+            return candidate
+        suffix += 1
+
+
 # ── Creation ──────────────────────────────────────────────────────
 
 
@@ -58,7 +87,7 @@ def create_preview_set(
         flags the resulting PreviewSet with ``degradation.is_degraded=True``
         so callers can tell a synthesized compile from a real one.
     """
-    set_id = _compute_set_id(request_text, kernel_id)
+    set_id = _resolve_set_id(_compute_set_id(request_text, kernel_id))
     now = int(time.time() * 1000)
 
     moves = available_moves or []

package/mcp_server/project_brain/tools.py

@@ -84,17 +84,41 @@ def build_project_brain(ctx: Context) -> dict:
         except Exception as exc:
             logger.debug("build_project_brain failed: %s", exc)
 
-    # 5b. Build notes_map for role inference.
-    # Shape: {section_id: {track_index: [notes]}}. Without this, role_graph
-    # falls back to "assume all tracks active in every section" which destroys
-    # section-scoped role confidence.
+    # 5b/5c. Single combined grid sweep for notes (role inference) and clip
+    # automation envelopes. Previously these were two separate
+    # N_tracks x N_scenes loops, each issuing a remote round-trip per slot —
+    # including empty slots. We now consult the get_scene_matrix presence grid
+    # (already fetched at step 3 as clip_matrix) and skip slots that are
+    # positively empty, collapsing both sweeps into one pass over the grid.
     #
     # BUG-E1: section_id must match what build_section_graph_from_scenes emits.
     # The composition engine emits `sec_{i:02d}` using the RAW enumerate index
     # of the scene — it skips unnamed scenes (gap-preserving), so e.g. scenes
     # ["Intro", "", "Verse"] become sections sec_00 and sec_02, not sec_01.
-    # Our notes_map must mirror that or keys won't align.
+    # Both maps mirror that or keys won't align.
+    #
+    # clips_scanned is the denominator for coverage_pct (BUG-D2): it counts
+    # the slots we actually probed for envelopes. Slots skipped as empty are
+    # not counted, so coverage_pct stays "fraction of present clips automated".
+    def _slot_is_empty(s_idx: int, t_idx: int) -> bool:
+        """True only when the presence grid positively reports no clip.
+
+        Unknown / out-of-range / malformed cells return False so we still
+        issue the round-trip (safe fallback — never skip on ambiguity).
+        """
+        try:
+            cell = clip_matrix[s_idx][t_idx]
+        except (IndexError, TypeError, KeyError):
+            return False
+        if not isinstance(cell, dict):
+            return False
+        if cell.get("has_clip"):
+            return False
+        return cell.get("state") in ("empty", "missing")
+
     notes_map: dict[str, dict[int, list[dict]]] = {}
+    clip_automation: list[dict] = []
+    clips_scanned = 0
     try:
         for scene_idx, scene in enumerate(scenes or []):
             scene_name = str(scene.get("name", "")).strip()
@@ -105,6 +129,11 @@ def build_project_brain(ctx: Context) -> dict:
             per_track: dict[int, list[dict]] = {}
             for track in tracks:
                 t_idx = track.get("index", 0)
+                if _slot_is_empty(scene_idx, t_idx):
+                    continue  # no clip in this slot — skip both round-trips
+                clips_scanned += 1
+
+                # Notes for role inference.
                 try:
                     notes_resp = ableton.send_command("get_notes", {
                         "track_index": t_idx,
@@ -115,39 +144,9 @@ def build_project_brain(ctx: Context) -> dict:
                         if notes:
                             per_track[t_idx] = notes
                 except Exception as exc:
-                    logger.debug("build_project_brain failed: %s", exc)
-                    # Individual note fetch failing is fine — continue with others
-                    continue
-            if per_track:
-                notes_map[section_id] = per_track
-    except Exception as exc:
-        logger.debug("build_project_brain failed: %s", exc)
-        # Overall failure: empty map, degrade to "all tracks active" fallback
-        notes_map = {}
+                    logger.debug("build_project_brain notes fetch failed: %s", exc)
 
-    # 5c. Scan clip automation across the session (BUG-E2).
-    # Device-parameter is_automated flags only reflect whether a parameter
-    # is mapped somewhere — they don't reveal clip envelopes. Ableton's
-    # automation actually lives on each clip (session + arrangement). We
-    # walk every clip slot that has a clip and ask get_clip_automation, then
-    # aggregate into a flat list keyed by section.
-    #
-    # clips_scanned is the denominator for coverage_pct (BUG-D2) — it
-    # counts how many (track, scene) slots we probed, regardless of
-    # whether an envelope came back. Without this, a session with zero
-    # automation would be indistinguishable from a session where we
-    # failed to probe, which is exactly the ambiguity BUG-D2 flagged.
-    clip_automation: list[dict] = []
-    clips_scanned = 0
-    try:
-        for scene_idx, scene in enumerate(scenes or []):
-            scene_name = str(scene.get("name", "")).strip()
-            if not scene_name:
-                continue
-            section_id = f"sec_{scene_idx:02d}"
-            for track in tracks:
-                t_idx = track.get("index", 0)
-                clips_scanned += 1
+                # Clip automation envelopes (BUG-E2).
                 try:
                     auto_resp = ableton.send_command("get_clip_automation", {
                         "track_index": t_idx,
@@ -156,22 +155,27 @@ def build_project_brain(ctx: Context) -> dict:
                 except Exception as exc:
                     # No clip in slot, or remote script rejected — skip
                     logger.debug("build_project_brain automation skip: %s", exc)
-                    continue
-                if not isinstance(auto_resp, dict):
-                    continue
-                envs = auto_resp.get("envelopes") or []
-                for env in envs:
-                    clip_automation.append({
-                        "section_id": section_id,
-                        "track_index": t_idx,
-                        "track_name": track.get("name", ""),
-                        "clip_index": scene_idx,
-                        "parameter_name": env.get("parameter_name", ""),
-                        "parameter_type": env.get("parameter_type", ""),
-                        "device_name": env.get("device_name"),
-                    })
+                    auto_resp = None
+                if isinstance(auto_resp, dict):
+                    for env in (auto_resp.get("envelopes") or []):
+                        clip_automation.append({
+                            "section_id": section_id,
+                            "track_index": t_idx,
+                            "track_name": track.get("name", ""),
+                            "clip_index": scene_idx,
+                            "parameter_name": env.get("parameter_name", ""),
+                            "parameter_type": env.get("parameter_type", ""),
+                            "device_name": env.get("device_name"),
+                        })
+
+            if per_track:
+                notes_map[section_id] = per_track
     except Exception as exc:
-        logger.debug("build_project_brain automation scan failed: %s", exc)
+        logger.debug("build_project_brain grid sweep failed: %s", exc)
+        # Overall failure: empty maps, degrade to "all tracks active" fallback
+        notes_map = {}
+        clip_automation = []
+        clips_scanned = 0
 
     # 6. Probe capabilities (direct SpectralCache access, not TCP)
     analyzer_ok = False

package/mcp_server/reference_engine/tools.py

@@ -71,14 +71,18 @@ def _fetch_project_snapshot(ctx: Context) -> dict:
 
             spec_data = spectral.get("spectrum")
             if spec_data:
-                snapshot["spectral"] = {"bands": spec_data["value"]}
+                # gap_analyzer.analyze_gaps reads proj_spectral["band_balance"]
+                # and the reference profile stores its bands under the same
+                # key, so the project spectrum MUST go under band_balance too
+                # (writing it under "bands" made every band read as 0.0).
+                snapshot["spectral"] = {"band_balance": spec_data["value"]}
                 key_data = spectral.get("key")
                 if key_data:
                     snapshot["spectral"]["detected_key"] = key_data["value"]
     except Exception as exc:
         logger.debug("_fetch_project_snapshot failed: %s", exc)
 
-    # Try to get session info for pacing / density
+    # Try to get session info for pacing / density / stereo width
     try:
         session_info = ableton.send_command("get_session_info", {})
         track_count = session_info.get("track_count", 0)
@@ -86,6 +90,22 @@ def _fetch_project_snapshot(ctx: Context) -> dict:
         # Rough density estimate
         snapshot["density"] = min(1.0, track_count / 20.0)
         snapshot["pacing"] = [{"label": f"scene_{i}", "bars": 8} for i in range(scene_count)]
+
+        # Estimate project stereo width from track pans (mirrors the
+        # pan-spread estimate in translation_engine/tools.py). Without this,
+        # snapshot["width"] stayed 0.0 and the width gap always reported the
+        # full reference width.
+        tracks = session_info.get("tracks", [])
+        if tracks:
+            def _get_pan(t: dict) -> float:
+                mixer = t.get("mixer")
+                if isinstance(mixer, dict):
+                    return abs(mixer.get("panning", 0.0))
+                return abs(t.get("pan", 0.0))
+
+            pan_values = [_get_pan(t) for t in tracks if not t.get("muted", False)]
+            if pan_values:
+                snapshot["width"] = min(1.0, sum(pan_values) / max(len(pan_values), 1))
     except Exception as exc:
         logger.debug("_fetch_project_snapshot failed: %s", exc)
 

package/mcp_server/runtime/capability_probe.py

@@ -73,7 +73,7 @@ def probe_capabilities(
         bridge_ok = bridge is not None and spectral is not None and getattr(spectral, "is_connected", False)
     report["m4l_bridge"] = {
         "status": "ok" if bridge_ok else "unavailable",
-        "detail": "UDP 9880 / OSC 9881 active" if bridge_ok else "Not connected — 30 analyzer tools unavailable",
+        "detail": "UDP 9880 / OSC 9881 active" if bridge_ok else "Not connected — 38 analyzer tools unavailable",
     }
 
     # 4. Offline perception

package/mcp_server/runtime/capability_state.py

@@ -118,6 +118,12 @@ def build_capability_state(
     memory_ok: bool = False,
     web_ok: bool = False,
     flucoma_ok: bool = False,
+    flucoma_device_loaded: Optional[bool] = None,
+    flucoma_reasons: Optional[list[str]] = None,
+    link_audio_mode: str = "manual_only",
+    link_audio_reasons: Optional[list[str]] = None,
+    stem_workflow_mode: str = "manual_only",
+    stem_workflow_reasons: Optional[list[str]] = None,
 ) -> CapabilityState:
     """Build a CapabilityState from simple boolean probes.
 
@@ -200,19 +206,70 @@ def build_capability_state(
     )
 
     # ── flucoma ──────────────────────────────────────────────────────
-    # Optional dependency (the ``flucoma`` Python package).  Emitted
-    # unconditionally so consumers can distinguish "probed and missing"
-    # from "probe not run yet".
-    flucoma_reasons: list[str] = []
-    if not flucoma_ok:
-        flucoma_reasons.append("flucoma_not_installed")
+    # Max/FluCoMa real-time streams. Emitted unconditionally so consumers
+    # can distinguish "not installed" from "installed but bridge/streams
+    # are currently unavailable".
+    resolved_flucoma_device_loaded = (
+        flucoma_ok if flucoma_device_loaded is None else flucoma_device_loaded
+    )
+    resolved_flucoma_reasons = list(flucoma_reasons or [])
+    if not flucoma_ok and not resolved_flucoma_reasons:
+        resolved_flucoma_reasons.append(
+            "flucoma_no_streams"
+            if resolved_flucoma_device_loaded
+            else "flucoma_not_installed"
+        )
     domains["flucoma"] = CapabilityDomain(
         name="flucoma",
         available=flucoma_ok,
-        confidence=0.9 if flucoma_ok else 0.0,
+        confidence=0.9 if flucoma_ok else (0.2 if resolved_flucoma_device_loaded else 0.0),
         mode="available" if flucoma_ok else "unavailable",
-        reasons=flucoma_reasons,
-        device_loaded=flucoma_ok,
+        reasons=resolved_flucoma_reasons,
+        device_loaded=resolved_flucoma_device_loaded,
+    )
+
+    # ── link_audio ────────────────────────────────────────────────────
+    # Live 12.4 exposes Link Audio in the product UX, but LivePilot must
+    # not claim automation support from the version number alone. This
+    # domain only becomes available when runtime probing observes a stable
+    # readable/routable surface.
+    link_mode = link_audio_mode if session_ok else "unavailable"
+    link_reasons = list(link_audio_reasons or [])
+    if not link_reasons:
+        if not session_ok:
+            link_reasons.append("session_unavailable")
+        elif link_mode == "manual_only":
+            link_reasons.append("link_audio_unprobed")
+        elif link_mode == "unavailable":
+            link_reasons.append("link_audio_not_exposed")
+    link_available = link_mode in {"readable", "routable"}
+    domains["link_audio"] = CapabilityDomain(
+        name="link_audio",
+        available=link_available,
+        confidence=0.8 if link_available else (0.2 if session_ok else 0.0),
+        mode=link_mode,
+        reasons=link_reasons,
+    )
+
+    # ── stem_workflow ─────────────────────────────────────────────────
+    # Selected-time stem separation / merge are also probe-first. The
+    # safe default is manual_only; callable only after concrete evidence.
+    stem_mode = stem_workflow_mode if session_ok else "unavailable"
+    stem_reasons = list(stem_workflow_reasons or [])
+    if not stem_reasons:
+        if not session_ok:
+            stem_reasons.append("session_unavailable")
+        elif stem_mode == "manual_only":
+            stem_reasons.append("stem_workflow_unprobed")
+        elif stem_mode == "unavailable":
+            stem_reasons.append("stem_workflow_not_exposed")
+    stem_available = stem_mode == "callable"
+    domains["stem_workflow"] = CapabilityDomain(
+        name="stem_workflow",
+        available=stem_available,
+        confidence=0.8 if stem_available else (0.2 if session_ok else 0.0),
+        mode=stem_mode,
+        reasons=stem_reasons,
     )
 
     # ── research (composite) ────────────────────────────────────────

package/mcp_server/runtime/live_version.py

@@ -6,6 +6,7 @@ responses and exposes feature flags for tool routing.
 
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass
 
 
@@ -19,21 +20,39 @@ class LiveVersionCapabilities:
 
     @classmethod
     def from_version_string(cls, version_str: str) -> LiveVersionCapabilities:
-        """Parse '12.3.6' into a capabilities instance."""
-        parts = version_str.split(".")
-        major = int(parts[0]) if len(parts) > 0 else 12
-        minor = int(parts[1]) if len(parts) > 1 else 0
-        patch = int(parts[2]) if len(parts) > 2 else 0
+        """Parse '12.3.6' into a capabilities instance.
+
+        Tolerant of malformed input: extracts the leading integer of each
+        dotted component and falls back to the conservative floor
+        (major=12, minor=0, patch=0) for missing or non-numeric components.
+        Mirrors the Remote Script's degrade-to-(12,0,0) contract
+        (remote_script/LivePilot/version_detect.py) so a junk live_version
+        string never crashes get_capability_state / get_session_kernel /
+        --doctor.
+        """
+        def _component(parts: list[str], index: int, default: int) -> int:
+            if index >= len(parts):
+                return default
+            match = re.match(r"\s*(\d+)", parts[index])
+            return int(match.group(1)) if match else default
+
+        parts = (version_str or "").split(".")
+        major = _component(parts, 0, 12)
+        minor = _component(parts, 1, 0)
+        patch = _component(parts, 2, 0)
         return cls(major=major, minor=minor, patch=patch)
 
     @classmethod
     def from_session_info(cls, session_info: dict) -> LiveVersionCapabilities:
         """Extract version from get_session_info response.
 
-        Looks for 'live_version' field. Falls back to 12.0.0 if absent
-        (pre-upgrade Remote Script).
+        Looks for 'live_version' field. Falls back to 12.0.0 if absent,
+        null, or empty (pre-upgrade Remote Script). Uses a falsy-guard
+        rather than a key-presence default so a present-but-empty value
+        degrades to the conservative floor, aligning with the sibling
+        readers in runtime/tools.py and runtime/capability_probe.py.
         """
-        version_str = session_info.get("live_version", "12.0.0")
+        version_str = session_info.get("live_version") or "12.0.0"
         return cls.from_version_string(version_str)
 
     @property
@@ -72,6 +91,21 @@ class LiveVersionCapabilities:
         """Stem separation via MFL — 12.3+"""
         return self._version_tuple >= (12, 3, 0)
 
+    @property
+    def has_link_audio(self) -> bool:
+        """Live 12.4 Link Audio UX exists; MCP control remains probe-gated."""
+        return self._version_tuple >= (12, 4, 0)
+
+    @property
+    def has_stem_time_selection(self) -> bool:
+        """Live 12.4 selected-time stem separation UX exists; probe before use."""
+        return self._version_tuple >= (12, 4, 0)
+
+    @property
+    def has_stem_merge_selected(self) -> bool:
+        """Live 12.4 merge-selected-stems UX exists; probe before use."""
+        return self._version_tuple >= (12, 4, 0)
+
     @property
     def has_replace_sample_native(self) -> bool:
         """SimplerDevice.replace_sample(path) — 12.4+"""
@@ -100,5 +134,8 @@ class LiveVersionCapabilities:
             "drum_rack_construction": self.has_drum_rack_construction,
             "take_lanes": self.has_take_lanes,
             "stem_separation": self.has_stem_separation,
+            "link_audio": self.has_link_audio,
+            "stem_time_selection": self.has_stem_time_selection,
+            "stem_merge_selected": self.has_stem_merge_selected,
             "replace_sample_native": self.has_replace_sample_native,
         }

package/mcp_server/runtime/safety_kernel.py

@@ -56,6 +56,15 @@ CONFIRM_REQUIRED_ACTIONS: set[str] = {
     "replace_simpler_sample",
 }
 
+# Names that LOOK read-only by prefix but actually mutate session state.
+# These must NOT be classified as read-only — they are intersected against
+# the prefix matcher below so a mutating verb never slips through a read
+# prefix (e.g. ``find_and_load_device`` starts with ``find_`` but loads a
+# device, a real mutation routed through REMOTE_COMMANDS).
+_MUTATING_OVERRIDES: set[str] = {
+    "find_and_load_device",
+}
+
 # Read-only prefixes — any action starting with one of these is a read.
 _READ_ONLY_PREFIXES = (
     "get_",
@@ -203,6 +212,8 @@ _WIDE_SCOPE_THRESHOLD = 5   # tracks
 
 def is_read_only_action(action: str) -> bool:
     """Return True if *action* is a non-mutating read/query."""
+    if action in _MUTATING_OVERRIDES:
+        return False
     if action in SAFE_ACTIONS:
         return True
     return action.startswith(_READ_ONLY_PREFIXES)

package/mcp_server/runtime/session_kernel.py

@@ -60,6 +60,11 @@ class SessionKernel:
     # may add "sculptor". Empty string = producer picks a default.
     creativity_profile: str = ""
 
+    # v1.27 operation posture. This is intentionally descriptive at the
+    # kernel layer; engines can opt into stricter behavior without forcing
+    # every tool to know every profile immediately.
+    operation_profile: str = "studio_deep"
+
     # Caller-asserted sacred elements. Normally sacred elements come from
     # song_brain; this lets the user or a skill override. Shape matches
     # song_brain.sacred_elements entries: {element_type, description, salience}.
@@ -94,6 +99,7 @@ def build_session_kernel(
     # PR2 — creative controls. All optional; legacy callers unaffected.
     freshness: float = 0.5,
     creativity_profile: str = "",
+    operation_profile: str = "studio_deep",
     sacred_elements: Optional[list] = None,
     synth_hints: Optional[dict] = None,
 ) -> SessionKernel:
@@ -137,6 +143,7 @@ def build_session_kernel(
         protected_dimensions=protected_dimensions or {},
         freshness=freshness,
         creativity_profile=creativity_profile,
+        operation_profile=operation_profile,
         sacred_elements=sacred_elements or [],
         synth_hints=synth_hints or {},
     )