Stored calibration is used across device restarts that invalidate it — check τ and level per session, refuse when stale

[mkovero]

problem

Stored calibration layers are keyed on configuration (TauConditions: device, backend, rate, period, ports; voltage calibration: the channel pair). Two layers are silently invalidated by events that key does not record. Both were observed on the dedicated rig on 2026-09-15.

τ (interface round trip) re-picks on every device enumeration — #461, measured.

• It lands on 1711 + 16k samples at 96 kHz after a host boot or an interface power cycle: 1711 → 1743 after a reboot, back to 1711 after a power cycle, 1727 on 2026-09-14.
• A stream/JACK restart does not change it.
• Every TauConditions field matched across those events, so a stored τ resolves as valid and is used wrong by 16–32 samples.

Level calibration depends on interface settings that a power cycle resets — documented in docs/rigs/pupu.md (PR #441).

• An interface reset returns line-output/line-input level settings to driver defaults. The note records a −60 dBFS tone on the loopback return reading −51.5 dBFS against a −57.5 dBFS baseline (+6 dB) after such a reset.
• ALSA control readback still showed the baseline values, so no software-visible state changed.
• On 2026-09-15 a power cycle also cleared the interface's stream routing: the return was silent until the host's control service re-applied it.
• A vrms_at_0dbfs stored before such a reset is wrong by the level change, with nothing refused.

Operator's reading of the situation (2026-09-15): "it sounds that one should calibrate before every use, at least some things". The design goal is that this does not depend on the operator remembering to: the instrument checks, cheaply, and refuses stale values.

what the evidence supports (for design, not decided here)

• Where a reference loopback is patched, both checks are cheap and deterministic. Within one session the loopback τ was sample-identical over 49 calibrate runs and 10 IR brackets, and its captured level was −40.6 dBFS on every run (τ must be measured more than once: a single reading can be one period wrong with nothing to detect it #347 record, the onset threshold is referenced to a pre-impulse statistic, which cannot see the DRR term that dominates its distance bias #378 AC6 record).
• τ for plot_ir is being routed to a same-capture loopback reference (estimate_onset's causal bound is unreachable: no producer ever records position.distance_m #460, operator preference 2026-09-15). That makes τ staleness impossible on that path. This issue covers what that does not: stored τ used elsewhere, and level calibration.
• Without a loopback the instrument cannot know either value for the current session. That state should be stated as unknown, not filled from a stored value.

acceptance criteria

• With a loopback configured, a session check measures τ and the loopback's captured level and compares them against the stored calibration. A τ that differs, or a level outside a stated tolerance, is refused with a message naming which layer is stale and what to re-run. It is never silently used. Tolerance provenance: derive it from measured within-session repeatability, not assume it.
• It runs without the operator having to remember: at a defined point (daemon start, first measurement of a session, or before any command that consumes the stored layer; the design chooses) and is visible in output when it ran.
• Without a loopback, a consumer of stored τ or level states that the value is from an earlier session and unverified. The stored number is never presented as current.
• Test against the rejected behaviour: a fake-backend fixture whose loopback delay or gain is shifted between "sessions" (for example AC_FAKE_TAU_DELAY_SAMPLES_OVERRIDE plus a gain override). Assert the stale stored value is refused, and assert the current code path would have used it.
• Rig verification: calibrate, power-cycle the interface, run the check. It must refuse, and name τ (and level, if the settings were not restored).

related

#461 (τ re-pick mechanism), #460 (bound τ source → same-capture reference), #347 (within-run τ agreement), #281 (τ as a calibration layer), #279 (voltage calibration preservation), #276 (epic DoD: "refuses rather than degrades").

[mkovero]

tracked under EPIC #475 — τ trust

Role here: the general per-session check. Stored τ and level calibration are invalidated by events their keys cannot record — a power cycle moved analog gain staging by +6 dB while ALSA readback reported the baseline, and again by +3 dB on 2026-09-16. Sequenced after #461, which is the measured instance.

The epic groups this with #346, #347, #350, #351, #359, #363, #461, #466 and #467 because they share one mechanism — latency moves in discrete quanta (one JACK period per client start; 16 samples per FireWire enumeration) that TauConditions cannot see — and one signature: a number that is stable, repeatable, physically plausible and wrong.

Backlink only. No routing, scope or priority change to this issue.