Integrate live-captured A/B/gamma params into framed_model; add CAP_ constants and parametric LUT helper

handoff/NOTES_CAPTURE.md

@@ -95,7 +95,40 @@
 - => P1.5 "live capture" is a dead end; scalars must be derived statically or the two missing
   constants recovered from the original soothing_mem.bin (not currently present in workspace).
 
-## 2026-08-20b (P1.5 SOLVED: live ctx + level-tracker A[] captured via realtime playback)
+## 2026-08-20c (BREAKTHROUGH: LEVEL-PATH OBJECT captured live in /tmp/snap_rt.bin)
+
+The BandConfig A/B/gamma (roadmap gap 2, block of F2/F3) is now LIVE-CAPTURED.
+Read-only scan of the existing realtime snapshot `/tmp/snap_rt.bin` (ctx 0x2370040,
+render_long.rpp) — no new capture needed.
+
+### Method (repro, ~2s)
+1. Level-path fingerprint = per-band **level_gain pair buffer**: 0x400 f32 pairs
+   (`[level, gain]`), with `level[j] == j/1024` exactly (level[0]==0.0, step 1/1024).
+   Vectorized scan (2nd derivative of level slots == 0 + level[0]==0.0) finds them.
+2. Six such buffers at stride  0x2020..0x2040  (band0: 0x4083020, b1: 0x4085040,
+   b2: 0x4087080, b3: 0x40890a0, b4: 0x408b0e0, b5: 0x408d100).
+3. Find u64 refs to the six → consecutive slots stride 0x18 at **+0xe0+band*0x18**
+   → object base = **0x3975460** (level-path object).
+
+### Level-path object (base 0x3975460, region unknown / heap)
+- `+0x178` = band-list ptr → 0x32c0c60
+- `+0x180` → BandConfig 0x32c0aa0: **A=-24.0, B=+28.0, gamma@0xc=1.0, byte flag@0x10=0** → linear, no callback@0x90
+- `+0x188` → BandConfig 0x32c09c8: A=16.0, B=20000.0, gamma@0xc=1.0, flag=0 (freq-range shaped cfg; +0x18.. floats 0.55,7.13,2.77,2.718 = nonlinear shaper consts)
+- `+0x4198 + band*0x2000` = **band mask doubles**, 512 usable per band:
+  band0 ~1.0 const; band1 1.001→1.216 (rising); band2 0.999→0.579 (falling);
+  band3 1.291→1.002 (falling); band4/5 1.0→~0.983
+- `+0xe0+band*0x18` → per-band level_gain pair buffers (live LUT output already has
+  gains: b0 0.53123 const, b1 0.5314→0.535, b2 const, b3 0.598→, b4 const, ...; many
+  bands `~0.531` because mask≈1.0 & render_long default cfg)
+
+### Interpretation / next
+- The captured A/B/gamma are the **default render_long config** (A/B semantics =
+  level-scaler LUT min/max; rendering default band). To get the A/B/gamma of a SPECIFIC
+  band shape (t1kq_only1_1000 etc.) re-run rtctx_rt.py with that test RPP and re-scan
+  the same fingerprint (base offset shifts). Method is now automated.
+- This UNBLOCKS the parametric band-LUT 0x563440/0x563a60 as a structural source
+  (t=(x−A)/(B−A), clamped, ^gamma, ×norm) instead of fitted Pchip.
+- Dump helper: /tmp/dump_levelpath.py, /tmp/probe_base.py.
 The dead end above was wrong — the missing piece was REALTIME audio playback, not more scanning.
 `-renderproject` uses the OFFLINE audio engine (fields live "only during audio", per earlier note);
 the ctx object only materializes during a realtime transport play.