livepilot 1.27.1 → 1.27.2

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v1.27.2 — 2026-06-23
+
+Maintenance release: M4L bridge response-correlation + chunk-reassembly hardening, plan-routing fixes, a Python 3.11 floor with clearer install diagnostics, and a Remote Script Group-track crash guard. No change to the tool surface (467 tools / 56 domains). Re-frozen LivePilot_Analyzer.amxd (analyzer reports 1.27.2).
+
+### Fixed — M4L bridge
+- Correlate responses by request id across batched reads (`get_params` / `get_hidden_params` / `get_auto_state`): the id is captured per command in the analyzer JS and echoed on both single-packet and chunked responses, so an interleaved or timed-out command can no longer resolve another command's future.
+- Chunk reassembly buckets per request id, bounds-checks the chunk index, and requires every index present before reassembling — fixes a `KeyError` / silent-loss + full-timeout path on duplicate or out-of-range chunks.
+- Non-blocking UDP socket so the miditool response path cannot stall the asyncio event loop; clear the capture future after completion.
+
+### Fixed — routing & Remote Script
+- `compressor_set_sidechain` now classifies as an MCP tool (TCP Remote Script path) instead of being mis-routed to the M4L JS bridge; `get_master_rms` is now dispatchable in plans; removed the dead duplicate `get_simpler_file_path` bridge entry.
+- `get_track_info` no longer crashes on Group/Return tracks (guards the LOM-fragile arm/input properties).
+- `reload_handlers` reports per-module reload errors instead of silently swallowing them.
+- Connection retry tears down the stale socket under the lock.
+
+### Changed — install & docs
+- Raised the Python floor to 3.11 (numpy/scipy publish no wheels for 3.9/3.10) with a clear pre-flight message; pip failures surface captured output + a version hint, and the expected grpcio-tools resolver warning is pre-announced.
+- `consult_ableton_knowledge` docstrings corrected; fast brief now notes the `mcp__Ableton_Knowledge__` prefix and that the knowledge MCP is optional; fixed an over-permissive tool-name test.
+
+
 ## v1.27.1 — 2026-06-21
 
 Maintenance release: 35 verified fixes from a deep multi-agent audit, recursive installed-plugin scanning, and Windows-CI hardening. No change to the tool surface (467 tools / 56 domains).

package/README.md

@@ -751,7 +751,7 @@ npx livepilot --version    # Show version
 | Requirement | Minimum |
 |-------------|---------|
 | Ableton Live | **12** (any edition). Suite required for Max for Live bridge and stock instruments |
-| Python | 3.9+ |
+| Python | 3.11+ (numpy/scipy ship no wheels for 3.9/3.10) |
 | Node.js | 18+ |
 | OS | macOS / Windows |
 | Splice | Desktop app with downloaded samples (optional — enables SQLite metadata search) |

package/bin/livepilot.js

@@ -15,6 +15,13 @@ const REQUIREMENTS = path.join(ROOT, "requirements.txt");
 // Python detection
 // ---------------------------------------------------------------------------
 
+// Minimum Python is 3.11, NOT 3.9: numpy>=2.4.6 and scipy>=1.17.1 (see
+// requirements.txt) publish no wheels and declare requires-python ">=3.11".
+// A 3.9/3.10 interpreter passes a looser gate, the venv is created, then
+// `pip install` aborts with a cryptic "no matching distribution" — the exact
+// install failure users hit. Gate here so we fail early with a clear message.
+const MIN_PY_MINOR = 11;
+
 function findPython() {
   // On Windows, also try the "py -3" launcher which avoids the
   // Microsoft Store stub that "python3" resolves to.
@@ -22,6 +29,7 @@ function findPython() {
     ? ["python", "python3", "py"]
     : ["python3", "python"];
 
+  let tooOld = null; // highest 3.x below the floor we saw, for a clear error
   for (const cmd of candidates) {
     try {
       const args = cmd === "py" ? ["-3", "--version"] : ["--version"];
@@ -33,17 +41,26 @@ function findPython() {
       if (match) {
         const major = parseInt(match[1], 10);
         const minor = parseInt(match[2], 10);
-        if (major === 3 && minor >= 9) {
+        if (major === 3 && minor >= MIN_PY_MINOR) {
           // For "py" launcher, the actual command to use is "py -3"
           const actualCmd = cmd === "py" ? "py" : cmd;
           const actualArgs = cmd === "py" ? ["-3"] : [];
           return { cmd: actualCmd, version: out, prefixArgs: actualArgs };
         }
+        // Found Python 3 but below 3.11 — remember the newest for diagnostics.
+        if (major === 3 && (!tooOld || minor > tooOld.minor)) {
+          tooOld = { version: out, minor };
+        }
       }
     } catch {
       // command not found or failed — try next
     }
   }
+  // Signal "present but too old" distinctly from "absent" so callers can give
+  // an actionable message instead of a misleading "not found".
+  if (tooOld) {
+    return { tooOld: true, version: tooOld.version };
+  }
   return null;
 }
 
@@ -84,6 +101,41 @@ function findOtherLiveClient(host, port) {
 // Virtual environment bootstrap
 // ---------------------------------------------------------------------------
 
+/**
+ * Run `pip install -r requirements.txt` with captured stderr so a failure
+ * yields an actionable message instead of an opaque "Command failed".
+ */
+function pipInstall(venvPy) {
+  // One pip resolver warning about grpcio-tools / protobuf<7 is EXPECTED and
+  // harmless: LivePilot imports only the pre-generated Splice stubs at runtime,
+  // never grpcio-tools. Pre-announce it so it doesn't read as a failure.
+  console.error("  (a single grpcio-tools/protobuf resolver warning is expected and safe)");
+  try {
+    execFileSync(venvPy, ["-m", "pip", "install", "-q", "-r", REQUIREMENTS], {
+      cwd: ROOT,
+      stdio: ["pipe", "pipe", "pipe"],
+      encoding: "utf-8",
+      timeout: 120000,
+    });
+  } catch (err) {
+    const stderr = (err && err.stderr ? String(err.stderr) : "").trim();
+    console.error("");
+    console.error("LivePilot: dependency installation failed.");
+    if (/No matching distribution|requires-python|Could not find a version/i.test(stderr)) {
+      console.error("  Most likely your Python is too old — LivePilot needs Python >= 3.11");
+      console.error("  (numpy/scipy ship no wheels for 3.9/3.10). Install 3.11+, delete the");
+      console.error("  .venv folder, and retry.");
+    }
+    const tail = stderr.split("\n").filter(Boolean).slice(-12);
+    if (tail.length) {
+      console.error("");
+      console.error("  pip output (last lines):");
+      for (const line of tail) console.error("    " + line);
+    }
+    throw err;
+  }
+}
+
 /**
  * Ensure a local .venv exists with dependencies installed.
  * Returns the path to the venv Python binary.
@@ -104,11 +156,7 @@ function ensureVenv(systemPython, prefixArgs) {
     } catch {
       // venv exists but deps missing — reinstall
       console.error("LivePilot: reinstalling Python dependencies...");
-      execFileSync(venvPy, ["-m", "pip", "install", "-q", "-r", REQUIREMENTS], {
-        cwd: ROOT,
-        stdio: ["pipe", "pipe", "inherit"],
-        timeout: 120000,
-      });
+      pipInstall(venvPy);
       return venvPy;
     }
   }
@@ -122,11 +170,7 @@ function ensureVenv(systemPython, prefixArgs) {
   });
 
   console.error("LivePilot: installing dependencies...");
-  execFileSync(venvPython(), ["-m", "pip", "install", "-q", "-r", REQUIREMENTS], {
-    cwd: ROOT,
-    stdio: ["pipe", "pipe", "inherit"],
-    timeout: 120000,
-  });
+  pipInstall(venvPython());
 
   return venvPython();
 }
@@ -262,11 +306,15 @@ async function doctor() {
 
   // 1. Python
   const pyInfo = findPython();
-  if (pyInfo) {
+  if (pyInfo && !pyInfo.tooOld) {
     console.log("  Python: %s (%s)", pyInfo.version, pyInfo.cmd);
+  } else if (pyInfo && pyInfo.tooOld) {
+    console.log("  Python: %s found, but LivePilot needs >= 3.11", pyInfo.version);
+    console.log("    Fix: install Python 3.11+ (numpy/scipy ship no wheels for 3.9/3.10)");
+    ok = false;
   } else {
-    console.log("  Python: NOT FOUND (need >= 3.9)");
-    console.log("    Fix: install Python 3.9+ and add to PATH");
+    console.log("  Python: NOT FOUND (need >= 3.11)");
+    console.log("    Fix: install Python 3.11+ and add to PATH");
     ok = false;
   }
 
@@ -686,10 +734,15 @@ async function setup() {
   // 1. Python
   console.log("Step 1/5: Checking Python...");
   const pyInfo = findPython();
-  if (pyInfo) {
+  if (pyInfo && !pyInfo.tooOld) {
     console.log("  ✓ %s", pyInfo.version);
+  } else if (pyInfo && pyInfo.tooOld) {
+    console.log("  ✗ %s found, but LivePilot needs Python >= 3.11", pyInfo.version);
+    console.log("    (numpy/scipy ship no wheels for 3.9/3.10 — pip would fail)");
+    console.log("    Install: brew install python@3.12 (macOS) or python.org (Windows)");
+    ok = false;
   } else {
-    console.log("  ✗ Python >= 3.9 not found");
+    console.log("  ✗ Python >= 3.11 not found");
     console.log("    Install: brew install python@3.12 (macOS) or python.org (Windows)");
     ok = false;
   }
@@ -722,7 +775,7 @@ async function setup() {
   // 3. Bootstrap Python venv
   console.log("");
   console.log("Step 3/5: Setting up Python environment...");
-  if (pyInfo) {
+  if (pyInfo && !pyInfo.tooOld) {
     try {
       ensureVenv(pyInfo.cmd, pyInfo.prefixArgs);
       console.log("  ✓ Virtual environment ready");
@@ -730,6 +783,8 @@ async function setup() {
       console.log("  ✗ Failed: %s", err.message);
       ok = false;
     }
+  } else if (pyInfo && pyInfo.tooOld) {
+    console.log("  ⊘ Skipped (%s found, need Python >= 3.11)", pyInfo.version);
   } else {
     console.log("  ⊘ Skipped (no Python)");
   }
@@ -917,12 +972,18 @@ async function main() {
 
   // Default: start MCP server
   const pyInfo = findPython();
-  if (!pyInfo) {
-    console.error("Error: Python >= 3.9 is required but was not found.");
+  if (!pyInfo || pyInfo.tooOld) {
+    if (pyInfo && pyInfo.tooOld) {
+      console.error("Error: found %s, but LivePilot requires Python >= 3.11.", pyInfo.version);
+      console.error("  numpy>=2.4.6 and scipy>=1.17.1 publish no wheels for Python 3.9/3.10,");
+      console.error("  so dependency installation would fail. Install Python 3.11 or newer.");
+    } else {
+      console.error("Error: Python >= 3.11 is required but was not found.");
+      console.error("  Install Python 3.11+ and ensure 'python3' or 'python' is on your PATH.");
+    }
     console.error("");
-    console.error("Install Python 3.9+ and ensure 'python3' or 'python' is on your PATH.");
     console.error("  macOS:   brew install python@3.12");
-    console.error("  Ubuntu:  sudo apt install python3");
+    console.error("  Ubuntu:  sudo apt install python3.12");
     console.error("  Windows: https://www.python.org/downloads/");
     process.exit(1);
   }

package/livepilot/.Codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "livepilot",
-  "version": "1.27.1",
+  "version": "1.27.2",
   "description": "Agentic production system for Ableton Live 12 \u2014 467 tools, 56 domains, 44 semantic moves, device atlas (5264 devices, 120 enriched, 7 indexes), Splice intelligence (gRPC + GraphQL describe-a-sound + preview + collections + presets), 9-band spectral perception auto-loaded via ensure_analyzer_on_master, Creative Director skill, technique memory, neo-Riemannian harmony, Euclidean rhythm, species counterpoint, MIDI I/O",
   "author": {
     "name": "Pilot Studio"

package/livepilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "livepilot",
-  "version": "1.27.1",
+  "version": "1.27.2",
   "description": "Agentic production system for Ableton Live 12 \u2014 467 tools, 56 domains, 44 semantic moves, device atlas (5264 devices, 120 enriched, 7 indexes), Splice intelligence (gRPC + GraphQL describe-a-sound + preview + collections + presets), 9-band spectral perception auto-loaded via ensure_analyzer_on_master, Creative Director skill, technique memory, neo-Riemannian harmony, Euclidean rhythm, species counterpoint, MIDI I/O",
   "author": {
     "name": "Pilot Studio"

package/livepilot/skills/livepilot-core/references/overview.md

@@ -1,4 +1,4 @@
-# LivePilot v1.27.1 — Architecture & Tool Reference
+# LivePilot v1.27.2 — Architecture & Tool Reference
 
 Agentic production system for Ableton Live 12. 467 tools across 56 domains. Device atlas (5264 devices, 120 enriched, 47 with aesthetic-tagged `signature_techniques`), spectral perception (M4L analyzer with 9-band FFT — sub_low / sub / low / low_mid / mid / high_mid / high / presence / air), technique memory, automation intelligence (16 curve types, 15 recipes), music theory (Krumhansl-Schmuckler, species counterpoint), generative algorithms (Euclidean rhythm, tintinnabuli, phase shift, additive process), neo-Riemannian harmony (PRL transforms, Tonnetz), MIDI file I/O, **LIVE Splice describe-a-sound + variations via captured GraphQL endpoints (v1.17)**, drum-rack pad-by-pad construction, live dead-device detection via meter sampling, role-aware Simpler defaults, session-record arrangement-automation workaround.
 

package/livepilot/skills/livepilot-evaluation/references/capability-modes.md

@@ -173,7 +173,7 @@ Live 12.4 introduces a new capability tier that unlocks native LOM access for sa
 **Tool signatures:** unchanged. Callers do not need to detect the tier —
 routing is transparent.
 
-**Probe-first 12.4 surfaces in v1.27.1:**
+**Probe-first 12.4 surfaces in v1.27.2:**
 - `probe_link_audio()` reports observed peer/input/routing visibility and
   returns `manual_only`, `readable`, `routable`, or `unavailable`.
 - `probe_stem_workflow()` reports observed callable paths and returns

package/m4l_device/livepilot_bridge.js

@@ -34,7 +34,7 @@ outlets = 2; // 0: to udpsend (responses), 1: to buffer~/status
 // Single source of truth for the bridge version — bumped alongside the
 // rest of the release manifest. Surfaced in the UI via messnamed("livepilot_version", ...)
 // so the frozen .amxd visibly reports which build it was last exported from.
-var VERSION = "1.27.1";
+var VERSION = "1.27.2";
 
 // ── State ──────────────────────────────────────────────────────────────────
 
@@ -45,6 +45,7 @@ var pitch_history = []; // Rolling buffer for key detection
 var MAX_PITCH_HISTORY = 128;
 var detected_key = "";
 var detected_scale = "";
+var current_response_request_id = "";
 
 // Capture state
 var capture_active = false;
@@ -85,9 +86,19 @@ function anything() {
     var cmd = messagename;
     if (cmd.charAt(0) === "/") cmd = cmd.substring(1);
     var args = _decode_arg_strings(arrayfromargs(arguments));
+    var request_id = "";
+    if (args.length > 0 && typeof args[args.length - 1] === "string") {
+        var last_arg = args[args.length - 1];
+        var request_prefix = "__livepilot_request_id:";
+        if (last_arg.indexOf(request_prefix) === 0) {
+            request_id = last_arg.substring(request_prefix.length);
+            args.pop();
+        }
+    }
 
     // Defer to low-priority thread for LiveAPI safety
     var task = new Task(function() {
+        current_response_request_id = request_id;
         try {
             dispatch(cmd, args);
         } catch(e) {
@@ -223,6 +234,11 @@ function cmd_get_params(args) {
 
     var batch_size = 8;
     var current = 0;
+    // Capture the request id now: read_batch reschedules itself via
+    // Task.schedule(20), and an interleaved command arriving in that gap can
+    // overwrite the module-level current_response_request_id before the final
+    // send_response fires. The closure keeps OUR id stable across batches.
+    var captured_request_id = current_response_request_id;
 
     function read_batch() {
         try {
@@ -246,7 +262,7 @@ function cmd_get_params(args) {
                 var next_task = new Task(read_batch);
                 next_task.schedule(20);
             } else {
-                send_response({"track": track_idx, "device": device_idx, "params": params});
+                send_response({"track": track_idx, "device": device_idx, "params": params}, captured_request_id);
             }
         } catch (e) {
             send_response({
@@ -254,7 +270,7 @@ function cmd_get_params(args) {
                 "track": track_idx,
                 "device": device_idx,
                 "partial_params": params
-            });
+            }, captured_request_id);
         }
     }
 
@@ -275,6 +291,9 @@ function cmd_get_hidden_params(args) {
     var params = [];
     var current = 0;
     var batch_size = 8;
+    // See cmd_get_params: capture the request id so the closure survives the
+    // Task.schedule(20) gaps without being clobbered by an interleaved command.
+    var captured_request_id = current_response_request_id;
 
     function read_batch() {
         try {
@@ -307,7 +326,7 @@ function cmd_get_hidden_params(args) {
                     "device_name": device_name,
                     "total_params": param_count,
                     "params": params
-                });
+                }, captured_request_id);
             }
         } catch (e) {
             send_response({
@@ -316,7 +335,7 @@ function cmd_get_hidden_params(args) {
                 "device": device_idx,
                 "device_name": device_name,
                 "partial_params": params
-            });
+            }, captured_request_id);
         }
     }
 
@@ -334,6 +353,9 @@ function cmd_get_auto_state(args) {
     var results = [];
     var current = 0;
     var batch_size = 8;
+    // See cmd_get_params: capture the request id so the closure survives the
+    // Task.schedule(20) gaps without being clobbered by an interleaved command.
+    var captured_request_id = current_response_request_id;
 
     function read_batch() {
         try {
@@ -362,7 +384,7 @@ function cmd_get_auto_state(args) {
                     "total_params": param_count,
                     "automated_params": results,
                     "automated_count": results.length
-                });
+                }, captured_request_id);
             }
         } catch (e) {
             send_response({
@@ -372,7 +394,7 @@ function cmd_get_auto_state(args) {
                 "total_params": param_count,
                 "automated_params": results,
                 "automated_count": results.length
-            });
+            }, captured_request_id);
         }
     }
 
@@ -689,22 +711,37 @@ function correlate(a, b) {
 
 // ── Response Encoding ──────────────────────────────────────────────────────
 
-function send_response(obj) {
-    var json = JSON.stringify(obj);
+function send_response(obj, explicit_id) {
+    var response = obj || {};
+    // Async/batched handlers (cmd_get_params et al.) capture the request id in
+    // a closure and pass it explicitly here, because the module-level
+    // current_response_request_id can be clobbered by an interleaved command
+    // that arrives during a Task.schedule() gap between batches.
+    var rid = (typeof explicit_id === "string" && explicit_id !== "")
+        ? explicit_id
+        : current_response_request_id;
+    if (rid) {
+        response._livepilot_request_id = rid;
+    }
+    var json = JSON.stringify(response);
     var encoded = base64_encode(json);
 
     // Check if chunking needed (Max OSC packet limit ~8KB)
     if (encoded.length < 1400) {
         outlet(0, "/response", encoded);
     } else {
-        // Split into chunks
+        // Split into chunks. The request id rides the chunk header (first arg)
+        // so the Python side buckets chunks per-response and never mixes two
+        // commands' chunks — the id inside the JSON can't be read until the
+        // chunks are reassembled.
         var chunk_size = 1400;
         var total = Math.ceil(encoded.length / chunk_size);
         for (var i = 0; i < total; i++) {
             var piece = encoded.substring(i * chunk_size, (i + 1) * chunk_size);
-            outlet(0, "/response_chunk", i, total, piece);
+            outlet(0, "/response_chunk", (rid || ""), i, total, piece);
         }
     }
+    current_response_request_id = "";
 }
 
 function base64_encode(str) {

package/mcp_server/__init__.py

@@ -1,2 +1,2 @@
 """LivePilot MCP Server — bridges MCP protocol to Ableton Live."""
-__version__ = "1.27.1"
+__version__ = "1.27.2"

package/mcp_server/composer/fast/brief_builder.py

@@ -1402,8 +1402,12 @@ def build_creative_brief(
             "   — those are filtered out before the brief reaches you.\n"
             "5. **TIER-1: Fire each search in `recommended_searches` BEFORE designing\n"
             "   that role.** Each entry gives you a (tool, query) pair — call the named\n"
-            "   Ableton Knowledge MCP tool. Most queries hit the Live manual or video\n"
-            "   tutorials; capture 1 useful snippet per role and apply it.\n"
+            "   Ableton Knowledge MCP tool with the `mcp__Ableton_Knowledge__` prefix\n"
+            "   (e.g. search_live_manual → mcp__Ableton_Knowledge__search_live_manual).\n"
+            "   Most queries hit the Live manual or video tutorials; capture 1 useful\n"
+            "   snippet per role and apply it. The Ableton Knowledge MCP is OPTIONAL —\n"
+            "   if any mcp__Ableton_Knowledge__* tool is unavailable or returns nothing,\n"
+            "   skip it and proceed using the creative guidance alone.\n"
             "6. **TIER-2: If `reference_artist` is set**, also fire each search in\n"
             "   `reference_searches` and design USING that artist's signature techniques.\n"
             "7. For each layer: pick ONE uri from instruments_by_role[role], design\n"

package/mcp_server/composer/tools.py

@@ -378,12 +378,18 @@ def consult_ableton_knowledge(
     template, and surfaces sources alongside the answer.
 
     Examples:
-      consult_ableton_knowledge("how do I make my kick punchier?")
-        → plan: [search_live_manual("Saturator"), search_transcripts("kick punch"),
-                 search_videos("kick design tutorial")] + synthesis template
-      consult_ableton_knowledge("what's the difference between Operator and Wavetable?")
-        → plan: [search_live_manual("Operator"), search_live_manual("Wavetable"),
-                 search_transcripts("Operator vs Wavetable")]
+      consult_ableton_knowledge("what does the Saturator Drive knob do?")
+        → intent: device
+        → plan: [search_live_manual("what does the Saturator Drive knob do?"),
+                 search_videos("what does the Saturator Drive knob do?"),
+                 search_transcripts("what does the Saturator Drive knob do?")]
+                 + synthesis template
+      consult_ableton_knowledge("how do I make my kick punchier?", {"current_genre": "techno"})
+        → intent: sound_design
+        → plan: [search_transcripts("techno how do I make my kick punchier?"),
+                 search_videos("techno how do I make my kick punchier? tutorial"),
+                 search_knowledge_base("how do I make my kick punchier?")]
+                 + synthesis template
 
     session_context (optional): {
         "current_genre": "techno",

package/mcp_server/connection.py

@@ -258,7 +258,8 @@ class AbletonConnection:
             needs_retry = fresh_connect and _is_single_client_state_error(response)
 
         if needs_retry:
-            self.disconnect()
+            with self._lock:
+                self.disconnect()
             time.sleep(SINGLE_CLIENT_RETRY_DELAY)
             with self._lock:
                 self.connect()

package/mcp_server/m4l_bridge.py

@@ -30,6 +30,7 @@ import socket
 import struct
 import threading
 import time
+import uuid
 from typing import Any, Callable, Optional
 
 
@@ -477,7 +478,10 @@ class SpectralReceiver(asyncio.DatagramProtocol):
         /rms f                     — RMS level
         /pitch f f                 — MIDI note, amplitude
         /response s                — base64-encoded JSON (single packet)
-        /response_chunk i i s      — chunked response (index, total, data)
+        /response_chunk [s] i i s  — chunked response. New builds prefix the
+                                     per-response request id so chunks of
+                                     different commands never share a bucket;
+                                     legacy builds omit it: (index, total, data)
     """
 
     # Band names keyed by how many bands the .amxd emits. 8 bands is the v1.x
@@ -499,6 +503,12 @@ class SpectralReceiver(asyncio.DatagramProtocol):
         self._chunk_id = 0
         self._chunk_key: Optional[str] = None  # Key of the single active reassembly bucket
         self._response_callback: Optional[asyncio.Future] = None
+        self._response_request_id: Optional[str] = None
+        # Set True the first time a response arrives carrying a request id.
+        # Once the analyzer build is known to stamp ids, a response that
+        # arrives with NO id (or a mismatched one) while a future is live is a
+        # stale straggler and must be dropped — see _handle_response.
+        self._seen_request_id = False
         self._capture_future: Optional[asyncio.Future] = None
         self._miditool_handler: Optional[Callable[[str, dict, list], None]] = None
 
@@ -653,7 +663,16 @@ class SpectralReceiver(asyncio.DatagramProtocol):
             self._handle_response(str(args[0]))
 
         elif address == "/response_chunk" and len(args) >= 3:
-            self._handle_chunk(int(args[0]), int(args[1]), str(args[2]))
+            # New builds prefix the request id (string): (rid, index, total, data).
+            # Legacy builds send (index, total, data). Distinguish by the type
+            # of the first arg — OSC ints decode to int, the id to a str.
+            if len(args) >= 4 and isinstance(args[0], str):
+                self._handle_chunk(
+                    int(args[1]), int(args[2]), str(args[3]),
+                    request_id=str(args[0]),
+                )
+            else:
+                self._handle_chunk(int(args[0]), int(args[1]), str(args[2]))
 
         elif address == "/miditool/request" and len(args) >= 1:
             self._handle_miditool_request(str(args[0]))
@@ -665,24 +684,52 @@ class SpectralReceiver(asyncio.DatagramProtocol):
     def _handle_response(self, encoded: str) -> None:
         """Decode a single-packet base64 response.
 
-        Resolves _response_callback exactly once, then clears it. Without the
-        clear, a second late packet could overwrite a future belonging to a
-        different in-flight command. The protocol has no request id yet
-        (livepilot_bridge.js:666 emits bare /response), so correlation relies
-        on the single-command-in-flight invariant enforced by M4LBridge._cmd_lock
-        plus this one-shot clear.
+        Updated analyzer JS echoes ``_livepilot_request_id`` on every response
+        (single-packet here, and on the chunk header for chunked responses).
+        Correlation rules, once this device is known to stamp ids:
+          * a response whose id does NOT match the in-flight future is dropped;
+          * a response with NO id at all is also dropped — it is a stale
+            straggler (e.g. a batched read that outlived its timeout), not a
+            pre-request-id build.
+        Pre-request-id builds (which never stamp an id) stay supported: until
+        the first id is ever seen, no-id responses are accepted.
         """
         try:
             # URL-safe base64 decode (- and _ instead of + and /)
             padded = encoded + "=" * (-len(encoded) % 4)
             decoded = base64.urlsafe_b64decode(padded).decode('utf-8')
             result = _normalize_bridge_payload(json.loads(decoded))
+            response_request_id = None
+            if isinstance(result, dict):
+                response_request_id = result.pop("_livepilot_request_id", None)
+
+            if response_request_id is not None:
+                # This analyzer build stamps request ids — remember it so a
+                # later no-id straggler is recognised as stale rather than
+                # mistaken for an old build that never sends ids.
+                self._seen_request_id = True
+
             cb = self._response_callback
+            expected_request_id = self._response_request_id
+            if cb and not cb.done() and expected_request_id is not None:
+                mismatched = (
+                    response_request_id is not None
+                    and str(response_request_id) != str(expected_request_id)
+                )
+                missing_but_expected = (
+                    response_request_id is None and self._seen_request_id
+                )
+                if mismatched or missing_but_expected:
+                    # Stale/uncorrelated reply — drop it and keep waiting for
+                    # the response that actually matches this command.
+                    return
+
             if cb and not cb.done():
                 cb.set_result(result)
             # Clear regardless — either we consumed it, or it was already
             # done/abandoned. Future packets with no owner get dropped.
             self._response_callback = None
+            self._response_request_id = None
         except Exception as exc:
             import sys
             print(f"LivePilot: failed to decode bridge response: {exc}", file=sys.stderr)
@@ -718,49 +765,62 @@ class SpectralReceiver(asyncio.DatagramProtocol):
                 import sys
                 print(f"LivePilot: miditool handler error: {exc}", file=sys.stderr)
 
-    def _handle_chunk(self, index: int, total: int, encoded: str) -> None:
+    def _handle_chunk(
+        self,
+        index: int,
+        total: int,
+        encoded: str,
+        request_id: Optional[str] = None,
+    ) -> None:
         """Reassemble chunked responses.
 
-        The previous implementation incremented ``_chunk_id`` only when
-        ``index == 0`` and assumed the first chunk always arrived first.
-        Under UDP reordering (rare on loopback but possible under system
-        load), a chunk with ``index > 0`` arriving before ``index 0`` would
-        be dropped into the PREVIOUS sequence's bucket — silently corrupting
-        that earlier response's payload.
-
-        Until the wire protocol adds an explicit sequence id, the safer
-        behavior is: if we see an out-of-order first-chunk (``index > 0``
-        with no open bucket), start a fresh bucket but log a warning. That
-        way we never poison a prior sequence, and the problem surfaces in
-        logs if it happens.
+        New analyzer builds stamp the per-response request id on every
+        ``/response_chunk`` header, so chunks from different commands land in
+        SEPARATE buckets and can never be interleaved — even if a stale chunk
+        from a timed-out command arrives mid-flight. Legacy builds omit the id
+        (``request_id`` None/""); they fall back to a single rolling bucket,
+        which is safe because ``send_command`` serialises on ``_cmd_lock``.
+
+        Hardening (v1.27.2): an index outside ``[0, total)`` is dropped — a
+        duplicate or malformed packet must never count toward completion — and
+        reassembly only fires once EVERY index ``0..total-1`` is present. The
+        old ``len(parts) == total`` check could KeyError on a duplicate or
+        out-of-range index, silently losing the response and forcing a full
+        timeout.
         """
-        # Only one response is chunked at a time: send_command serialises on
-        # _cmd_lock, so a single active reassembly bucket is sufficient and we
-        # do NOT need the first packet to be index 0. Accepting chunks in any
-        # order fixes the permanent-loss path where an index>0 chunk arriving
-        # before index 0 (UDP loopback reordering under load) used to split
-        # one response across two buckets that never completed.
-        active = self._chunks.get(self._chunk_key)
-        if active is None or active["total"] != total:
-            # No bucket open, OR a chunk with a different `total` arrived,
-            # meaning a new response started (e.g. the previous one timed out
-            # without ever completing). Evict any stale partial and open fresh.
-            if active is not None:
-                self._chunks.pop(self._chunk_key, None)
-                self._chunk_times.pop(self._chunk_key, None)
-            self._chunk_id += 1
-            self._chunk_key = str(self._chunk_id)
-            self._chunks[self._chunk_key] = {"parts": {}, "total": total}
-            self._chunk_times[self._chunk_key] = time.monotonic()
-
-        key = self._chunk_key
-        self._chunks[key]["parts"][index] = encoded
-
-        if len(self._chunks[key]["parts"]) == total:
-            # All chunks received — reassemble
-            full = ""
-            for i in range(total):
-                full += self._chunks[key]["parts"][i]
+        # Drop chunks that cannot belong to a well-formed response.
+        if total <= 0 or index < 0 or index >= total:
+            return
+
+        if request_id:
+            # Collision-free per-response bucket.
+            key = f"rid:{request_id}"
+            active = self._chunks.get(key)
+            if active is None or active["total"] != total:
+                self._chunks[key] = {"parts": {}, "total": total}
+                self._chunk_times[key] = time.monotonic()
+            self._chunk_key = key
+        else:
+            # Legacy single-active-bucket model (no id on the wire). A chunk
+            # with a different `total` means a new response started (e.g. the
+            # previous one timed out without ever completing) — evict + reopen.
+            active = self._chunks.get(self._chunk_key)
+            if active is None or active["total"] != total:
+                if active is not None:
+                    self._chunks.pop(self._chunk_key, None)
+                    self._chunk_times.pop(self._chunk_key, None)
+                self._chunk_id += 1
+                self._chunk_key = str(self._chunk_id)
+                self._chunks[self._chunk_key] = {"parts": {}, "total": total}
+                self._chunk_times[self._chunk_key] = time.monotonic()
+            key = self._chunk_key
+
+        parts = self._chunks[key]["parts"]
+        parts[index] = encoded
+
+        if len(parts) == total and all(i in parts for i in range(total)):
+            # Every chunk present — reassemble in order.
+            full = "".join(parts[i] for i in range(total))
             del self._chunks[key]
             self._chunk_times.pop(key, None)
             self._handle_response(full)
@@ -780,13 +840,22 @@ class SpectralReceiver(asyncio.DatagramProtocol):
             result = _normalize_bridge_payload(json.loads(decoded))
             if self._capture_future and not self._capture_future.done():
                 self._capture_future.set_result(result)
+            # Clear the reference so a completed future isn't retained until the
+            # next capture, and so send_capture's done()-guarded cancel has no
+            # stale object to consider.
+            self._capture_future = None
         except Exception as exc:
             import sys
             print(f"LivePilot: failed to decode capture response: {exc}", file=sys.stderr)
 
-    def set_response_future(self, future: asyncio.Future) -> None:
+    def set_response_future(
+        self,
+        future: Optional[asyncio.Future],
+        request_id: Optional[str] = None,
+    ) -> None:
         """Set a future to be resolved with the next response."""
         self._response_callback = future
+        self._response_request_id = request_id if future is not None else None
 
     def set_capture_future(self, future: asyncio.Future) -> None:
         """Set a future to be resolved when a capture_complete OSC arrives."""
@@ -810,6 +879,12 @@ class M4LBridge:
         self.receiver = receiver
         self.miditool_cache = miditool_cache
         self._sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        # Non-blocking so a momentarily-full send buffer never stalls the
+        # asyncio event loop. The miditool response path sends from inside a
+        # DatagramProtocol callback that runs ON the loop thread — a blocking
+        # sendto there would freeze every pending coroutine. UDP loopback sends
+        # essentially never block; _safe_sendto guards the rare case anyway.
+        self._sock.setblocking(False)
         self._m4l_addr = ("127.0.0.1", 9881)
         self._cmd_lock: Optional[asyncio.Lock] = None
         # BUG-audit-C1: send_capture uses _capture_future, which is
@@ -825,6 +900,22 @@ class M4LBridge:
             if self.receiver.miditool_cache is None and miditool_cache is not None:
                 self.receiver.miditool_cache = miditool_cache
 
+    def _safe_sendto(self, data: bytes) -> None:
+        """Send a UDP packet without ever blocking the event loop.
+
+        The socket is non-blocking; if the OS send buffer is momentarily full
+        (vanishingly rare on loopback) sendto raises BlockingIOError. We drop
+        the packet rather than stall — the caller's timeout/retry handles it.
+        """
+        try:
+            self._sock.sendto(data, self._m4l_addr)
+        except BlockingIOError:
+            import sys
+            print(
+                "LivePilot: M4L UDP send buffer full — packet dropped",
+                file=sys.stderr,
+            )
+
     def _dispatch_miditool_request(
         self, request_id: str, context: dict, notes: list,
     ) -> None:
@@ -869,7 +960,7 @@ class M4LBridge:
         """
         payload = {"tool_name": tool_name or "", "params": params or {}}
         osc = self._build_osc("miditool/config", (json.dumps(payload),))
-        self._sock.sendto(osc, self._m4l_addr)
+        self._safe_sendto(osc)
 
     def send_miditool_response(self, request_id: str, notes: list) -> None:
         """Send transformed notes back to the JS bridge.
@@ -879,7 +970,7 @@ class M4LBridge:
         """
         payload = {"request_id": str(request_id or ""), "notes": list(notes or [])}
         osc = self._build_osc("miditool/response", (json.dumps(payload),))
-        self._sock.sendto(osc, self._m4l_addr)
+        self._safe_sendto(osc)
 
     async def send_command(self, command: str, *args: Any, timeout: float = 5.0) -> dict:
         """Send an OSC command to the M4L device and wait for the response."""
@@ -905,12 +996,14 @@ class M4LBridge:
             # Create a future for the response
             loop = asyncio.get_running_loop()
             future = loop.create_future()
-            self.receiver.set_response_future(future)
+            request_id = uuid.uuid4().hex
+            self.receiver.set_response_future(future, request_id=request_id)
 
             # Build and send OSC message (no leading / — Max udpreceive
             # passes messagename with / intact to JS, breaking dispatch)
-            osc_data = self._build_osc(command, args)
-            self._sock.sendto(osc_data, self._m4l_addr)
+            request_arg = f"__livepilot_request_id:{request_id}"
+            osc_data = self._build_osc(command, (*args, request_arg))
+            self._safe_sendto(osc_data)
 
             # Wait for response with timeout
             try:
@@ -958,7 +1051,7 @@ class M4LBridge:
             self.receiver.set_capture_future(future)
 
             osc_data = self._build_osc(command, args)
-            self._sock.sendto(osc_data, self._m4l_addr)
+            self._safe_sendto(osc_data)
 
             try:
                 result = await asyncio.wait_for(future, timeout=timeout)

package/mcp_server/runtime/execution_router.py

@@ -66,6 +66,12 @@ MCP_TOOLS: frozenset[str] = frozenset({
     # set_drum_chain_note + insert_device + replace_sample_native. Used by
     # the create_drum_rack_pad semantic move.
     "add_drum_rack_pad",
+    # Routing-correctness (v1.27.2): these have @mcp.tool wrappers that call
+    # the TCP Remote Script / read the SpectralCache in-process. They must
+    # classify as mcp_tool so plan steps take the SAME path as direct callers
+    # — not the M4L JS bridge, and not the "unknown" dead-end.
+    "compressor_set_sidechain",  # was mis-listed in BRIDGE_COMMANDS → JS bridge
+    "get_master_rms",            # was READ_ONLY but unclassified → plan failure
 })
 
 

package/mcp_server/runtime/mcp_dispatch.py

@@ -153,6 +153,25 @@ async def _add_drum_rack_pad(params: dict, ctx: Any = None) -> dict:
     return await _call(add_drum_rack_pad, ctx, params)
 
 
+# ── Routing-correctness (v1.27.2) ─────────────────────────────────────────
+#
+# Both have @mcp.tool wrappers in tools/analyzer.py. compressor_set_sidechain
+# was mis-listed in BRIDGE_COMMANDS, so plan steps silently routed to the M4L
+# JS bridge while direct callers used the TCP Remote Script — divergent paths
+# with different error handling. get_master_rms was tagged READ_ONLY but never
+# classified (classify_step returned "unknown"), so plans could not use it at
+# all. Both now dispatch in-process here, matching their direct @mcp.tool path.
+
+async def _compressor_set_sidechain(params: dict, ctx: Any = None) -> dict:
+    from ..tools.analyzer import compressor_set_sidechain
+    return await _call(compressor_set_sidechain, ctx, params)
+
+
+async def _get_master_rms(params: dict, ctx: Any = None) -> dict:
+    from ..tools.analyzer import get_master_rms
+    return await _call(get_master_rms, ctx, params)
+
+
 def build_mcp_dispatch_registry() -> dict[str, Callable]:
     """Return the canonical registry of MCP-only tools for plan execution.
 
@@ -186,4 +205,7 @@ def build_mcp_dispatch_registry() -> dict[str, Callable]:
         "add_session_memory": _add_session_memory,
         # v1.20 — drum rack pad construction (async orchestrator).
         "add_drum_rack_pad": _add_drum_rack_pad,
+        # v1.27.2 — routing-correctness (see adapters above).
+        "compressor_set_sidechain": _compressor_set_sidechain,
+        "get_master_rms": _get_master_rms,
     }

package/mcp_server/runtime/remote_commands.py

@@ -139,9 +139,11 @@ BRIDGE_COMMANDS: frozenset[str] = frozenset({
     "get_params", "get_hidden_params", "get_auto_state", "walk_rack",
     "get_chains_deep", "get_track_cpu", "get_selected", "get_key",
     "get_clip_file_path", "replace_simpler_sample", "get_simpler_slices",
-    "get_simpler_file_path",  # v1.23.3 — closes the v1.12 follow-up that
-                              # left classify_simpler_slices unable to
-                              # auto-resolve the Simpler's sample path
+    # NOTE: get_simpler_file_path is NOT here — it lives in REMOTE_COMMANDS
+    # (the primary Python LOM path since v1.23.3). classify_step checks
+    # REMOTE first, so listing it here too was dead for dispatch. The
+    # backwards-compat bridge call still exists, but analyzer.py invokes it
+    # directly via bridge.send_command(), bypassing classify_step.
     "crop_simpler", "reverse_simpler", "warp_simpler",
     "get_warp_markers", "add_warp_marker", "move_warp_marker",
     "remove_warp_marker", "capture_audio", "capture_stop",
@@ -152,7 +154,10 @@ BRIDGE_COMMANDS: frozenset[str] = frozenset({
     # only Max JS LiveAPI exposes). See mcp_server/tools/analyzer.py for
     # the matching MCP tools that route through bridge.send_command.
     "simpler_set_warp",
-    "compressor_set_sidechain",
+    # NOTE: compressor_set_sidechain is NOT here — its @mcp.tool wrapper calls
+    # the TCP Remote Script ("set_compressor_sidechain", the BUG-A3 Python
+    # path), so it belongs in MCP_TOOLS. Listing it here routed plan steps to
+    # the M4L JS bridge, a divergent path. Moved to execution_router.MCP_TOOLS.
     # NOTE: load_sample_to_simpler used to live here, but it's actually an
     # async Python MCP tool in mcp_server/tools/analyzer.py, not a bridge
     # command. It has no case in livepilot_bridge.js and no @register handler

package/mcp_server/server.py

@@ -362,7 +362,7 @@ def _get_all_tools():
     to the next path rather than exploding.
 
     WARNING: Accesses FastMCP private internals. Pinned to
-    fastmcp>=3.3.1,<3.4.0 in requirements.txt. The startup self-test
+    fastmcp>=3.4.2,<3.5.0 in requirements.txt. The startup self-test
     (_assert_tool_registry_accessible) will fail loudly if every probe
     returns empty — better than silently returning [] and disabling
     schema coercion.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "livepilot",
-  "version": "1.27.1",
+  "version": "1.27.2",
   "mcpName": "io.github.dreamrec/livepilot",
   "description": "Agentic production system for Ableton Live 12 — 467 tools, 56 domains, 44 semantic moves. Device atlas (5264 devices, 120 enriched, 7 indexes), Splice intelligence (gRPC + GraphQL describe-a-sound + preview + collections + presets), 9-band spectral perception auto-loaded via ensure_analyzer_on_master, Creative Director skill, technique memory, 12 creative intelligence engines",
   "author": "Pilot Studio",

package/remote_script/LivePilot/__init__.py

@@ -5,7 +5,7 @@ Entry point for the ControlSurface. Ableton calls create_instance(c_instance)
 when this script is selected in Preferences > Link, Tempo & MIDI.
 """
 
-__version__ = "1.27.1"
+__version__ = "1.27.2"
 
 from _Framework.ControlSurface import ControlSurface
 from . import router
@@ -98,22 +98,28 @@ def _force_reload_handlers(cs=None):
         except Exception:
             pass
 
+    failures = []
+
     try:
         importlib.reload(router)
     except Exception as exc:
-        _log("reload(router) FAILED — %s: %s" % (type(exc).__name__, exc))
+        msg = "reload(router) FAILED — %s: %s" % (type(exc).__name__, exc)
+        _log(msg)
+        failures.append(("LivePilot.router", "%s: %s" % (type(exc).__name__, exc)))
 
     try:
         importlib.reload(utils)
     except Exception as exc:
-        _log("reload(utils) FAILED — %s: %s" % (type(exc).__name__, exc))
+        msg = "reload(utils) FAILED — %s: %s" % (type(exc).__name__, exc)
+        _log(msg)
+        failures.append(("LivePilot.utils", "%s: %s" % (type(exc).__name__, exc)))
 
     # Invalidate caches so iter_modules sees newly-added files even if
     # an importer cached the previous directory listing.
     importlib.invalidate_caches()
     pkg = _sys.modules.get("LivePilot")
     if pkg is None or getattr(pkg, "__path__", None) is None:
-        return
+        return {"discovered": 0, "reloaded": 0, "first_imported": 0, "failures": failures}
 
     discovered = reloaded = first_imported = 0
     for _finder, modname, _is_pkg in pkgutil.iter_modules(pkg.__path__):
@@ -130,8 +136,9 @@ def _force_reload_handlers(cs=None):
                 importlib.import_module(full_name)
                 first_imported += 1
         except Exception as exc:
-            _log("reload(%s) FAILED — %s: %s" % (
-                full_name, type(exc).__name__, exc))
+            msg = "reload(%s) FAILED — %s: %s" % (full_name, type(exc).__name__, exc)
+            _log(msg)
+            failures.append((full_name, "%s: %s" % (type(exc).__name__, exc)))
 
     # reload_handlers_cmd lives in __init__.py (not a handler module),
     # so the step-3 loop does not cover it. Re-register manually.
@@ -140,15 +147,21 @@ def _force_reload_handlers(cs=None):
     _log("reload complete — %d discovered (%d reloaded, %d first-imported)" % (
         discovered, reloaded, first_imported))
 
+    return {"discovered": discovered, "reloaded": reloaded,
+            "first_imported": first_imported, "failures": failures}
+
 
 def reload_handlers_cmd(song, params):
     """TCP-accessible reload trigger. Lets automation refresh handlers
     without a UI Control Surface toggle — the core dev-loop improvement.
-    Returns the handler count so the caller can assert before/after."""
-    _force_reload_handlers(cs=None)
+    Returns the handler count so the caller can assert before/after.
+    Returns any reload failures so the caller can detect silent errors."""
+    result = _force_reload_handlers(cs=None)
+    failures = result.get("failures", []) if isinstance(result, dict) else []
     return {
         "reloaded": True,
         "handler_count": len(router._handlers),
+        "errors": [{"module": m, "error": e} for m, e in failures],
     }
 
 

package/remote_script/LivePilot/tracks.py

@@ -91,12 +91,18 @@ def get_track_info(song, params):
     if track.is_foldable:
         result["fold_state"] = bool(track.fold_state)
 
-    # Regular tracks have arm and input type; return tracks get null values
+    # Regular tracks expose arm + input type; Group/Return/Master tracks raise
+    # RuntimeError on these LOM properties. hasattr() does NOT catch it (Live
+    # raises rather than omitting the attribute), so a Group track at a positive
+    # index used to crash get_track_info. Guard each access — mirrors the
+    # transport.py get_session_info fix (commit 4aec8e6, closing PR #35).
     if track_index >= 0:
-        result["arm"] = track.arm
-        result["has_midi_input"] = track.has_midi_input
-        result["has_audio_input"] = track.has_audio_input
-        result["current_monitoring_state"] = track.current_monitoring_state
+        for _prop in ("arm", "has_midi_input", "has_audio_input",
+                      "current_monitoring_state"):
+            try:
+                result[_prop] = getattr(track, _prop)
+            except Exception:
+                result[_prop] = None
     else:
         result["arm"] = None
         result["has_midi_input"] = None

package/server.json

@@ -6,7 +6,7 @@
     "url": "https://github.com/dreamrec/LivePilot",
     "source": "github"
   },
-  "version": "1.27.1",
+  "version": "1.27.2",
   "packages": [
     {
       "registryType": "npm",