fix(shared): enforce valid transcription timing intervals

[seonghobae]

Problem

Issues #1253 and #1255 identify one shared TranscriptionNote admission boundary with two distinct failure classes:

• JavaScript number admits NaN, +Infinity, and -Infinity unless finiteness is checked;
• finite values can still describe an impossible audio-relative note (onset < 0 or offset <= onset).

GrooveMap uses onset as timeline position and offset - onset as note width. The protected transcription producer derives start time from non-negative frame indices and drops events shorter than MIN_NOTE_DURATION_SECONDS = 0.05, so negative starts and non-positive durations are not an intentional producer domain.

Change

The existing #1254 branch remains the single writer for validateTranscriptionNote(); #1255 was not implemented through a parallel consumer validator or a second branch.

• Initial contract(shared): reject non-finite transcription timing before rehearsal UI #1253 RED 73c60d5d85684eedf274b6b2dde4272a95b534a1 covers non-finite onset/offset.
• 7dec5a64d5a265cbf75ac735e286d8529c09c31f adds finite-number admission; ordinary descendant 53cc2c6057b34cf006232d47599532fd9f8f0d3f removes an unrelated metadata-handoff delta from that repair.
• contract(shared): reject impossible transcription intervals before rehearsal rendering #1255 RED 9a27a87f8c2c74614d84acb23458845949f948a0 adds hostile finite intervals: negative onset, zero-duration interval, inverted interval, plus zero/negative-zero and ordinary positive controls. This is a source-level RED; no hosted failing run is claimed.
• Causal repair 95356c11a76716dde927bfe311dffb5eec4cf9e1 requires finite onset >= 0 and finite offset > onset at the shared validator.
• Doctoring 02e85d3150bfd32472a23793b36af577fd55e331 records producer evidence, GrooveMap rendering consequence, persistence/recovery behavior, rejected clamps/normalization, and keeps velocity policy separate.
• Ordinary two-parent descendant c21c18ccd630614feee1fef3e0b7e5cf4fdce658 makes canonical formatter prerequisite repair(ci): format consolidated supply-chain policy test #1176 (8fe6b6d99c009527ef0bcba419e6f6debdb23c23) actual ancestry without copying its one-file source delta into this PR.

Desktop saveProject() parses before persistence and loadProject() parses the native response before returning it. Malformed durable timing therefore fails closed with the exact field path rather than being silently clamped or rewritten.

Dependency-stack repair / exact identity

Protected product truth is still develop@314ddeae7b775a4957594b599358c8255617eb2e, but #1254 is intentionally stacked on formatter prerequisite #1176 while that prerequisite is not yet protected ancestry.

• Base: bolt-performance-chart-export-13223013812255847379@8fe6b6d99c009527ef0bcba419e6f6debdb23c23 (repair(ci): format consolidated supply-chain policy test #1176).
• Exact head: c21c18ccd630614feee1fef3e0b7e5cf4fdce658.
• Fresh compare from repair(ci): format consolidated supply-chain policy test #1176: ahead=8 / behind=0; merge base exactly 8fe6b6d....
• PR diff remains exactly three files: docs/doctoring/transcription-timing-admission.md, packages/shared-types/src/index.ts, and packages/shared-types/test/transcription-timing-admission.test.ts.
• Open / Draft / mergeable.

This is a real ancestry repair, not base-label bookkeeping. The #1176 formatter blob is consumed through ancestry and does not appear as a second writer in the #1254 diff.

Hosted evidence before stacking

The latest direct-develop generation on semantic head 02e85d3150bfd32472a23793b36af577fd55e331 reached terminal results:

• build-baseline 35725434517: SUCCESS;
• Security Scan 35725434480: SUCCESS;
• SAST Semgrep 35725434526: SUCCESS;
• sbom 35725434460: SUCCESS;
• repository ci 35725434515: FAILURE;
• CodeQL PR 35725434457: remained nonterminal at the last direct-develop read.

Inside repository CI, npm-lock-validation 106737836491 and macOS rust-check 106805057853 succeeded. Ubuntu ci / build-and-test 106805057896 failed only at Ruff 0.15.5 format --check, which reported exactly services/analysis-engine/tests/test_supply_chain_policy.py. #1254 does not modify Python or that file; the defect is the protected-base formatter debt canonically owned by #1176. Documentation, Security Notes, security patterns, supply-chain checks, GitHub bootstrap, JS/TS lint, Python docstring checks and Ruff lint had already passed before the format gate.

The current stacked head c21c18... has no repository-owned workflow generation because these workflows admit the protected-target path rather than this feature-base stack. Zero runs is absence of evidence, not GREEN. After #1176 reaches protected ancestry, #1254 must ordinary/non-force reconcile to the resulting protected develop and reacquire exact-head/base evidence.

No source-neutral wake commit, blind rerun, force push, destructive rebase, self-approval or required-gate weakening is used.

Claim boundary

This PR establishes the shared audio-relative timing invariant only:

• onset and offset must be finite;
• onset >= 0;
• offset > onset;
• JavaScript -0 is accepted equivalently to 0;
• velocity scale/range is intentionally unchanged until producer/consumer evidence establishes a canonical contract.

It does not claim migration of any historical malformed project. If such durable data is discovered, recovery must classify it explicitly instead of weakening the invariant or silently rewriting note timing.

Security Notes

No new network, filesystem, subprocess, IPC, telemetry, dependency, or PII surface. This tightens the existing local runtime-schema boundary and fails closed with stable field-path errors that do not include note contents or local paths.

Supply chain / i18n

No dependency or lockfile change. No user-visible string or locale change.

Merge gate

Keep Draft until #1176 reaches protected ancestry, this branch is ordinarily reconciled without losing its three-file semantic delta, and one unchanged final exact head has terminal applicable repository/security/SBOM/CodeQL evidence, zero valid unresolved findings, and a qualifying independent non-author current-head approval. Issues #1253 and #1255 stay open until this PR or a verified successor is protected ancestry with complete source/test/traceability/evidence succession.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh exact-head verification on unchanged b69239b058ebb8efb33ea170ffa03163764cc2b7: build-baseline run 35698861418 and SAST Semgrep run 35698861497 are now terminal SUCCESS. ci 35698861564, Security Scan 35698861742, SBOM 35698861393, and CodeQL PR 35698861511 remain queued/nonterminal. Formal review inventory is still empty; no qualifying independent non-author current-head approval exists. No source movement, no no-op wake commit, and no predecessor-evidence transfer.

[seonghobae]

Downstream consumer audit found one real persistence-boundary drift without changing this PR's shared-owner scope.

#970 Project Persistence has now adopted this exact #1254 head c21c18ccd630614feee1fef3e0b7e5cf4fdce658 as actual ancestry through ordinary two-parent descendant 3f2d1ad2377c7dafbabdfe3e6b449468953dbc5d, then retargeted its PR base to this branch. No shared timing source was copied into #970.

The Python final-result cache consumer in #970 still admitted any finite onset/offset pair. Source RED 3314730077b7c24c077e2f15cec73eb627b8d75e now rejects negative, zero-duration and inverted cached intervals; minimal consumer repair 3dfd77e11187211e9b7ed2317b8f559e5e1fb018 adds only onset >= 0 and offset > onset after the existing finite checks. Velocity remains unchanged.

This is downstream adaptation to #1254, not a second timing-policy owner. #1254 remains Draft and must still reach protected ancestry with final exact-head gates/review before #970 can reconcile and claim final evidence.

[seonghobae]

Evidence-authority correction from #1258: the direct-develop repository ci generation listed in this PR must be classified as PR merge-result evidence, not exact-source-head execution, unless its job log proves an explicit source checkout. Protected .github/workflows/ci.yml currently leaves actions/checkout without ref: on pull requests, and #970 live logs confirm that contract resolves to refs/pull/<n>/merge.

The #1254 timing source/test/doctoring ownership and the #1176 formatter-owner split are unchanged. Build/Security/Semgrep/SBOM receipts remain whatever their own workflow checkout contracts prove; this correction is specifically for generic ci.yml. Current stacked c21c18... still has no repository-owned generation, so no final exact-source GREEN is claimed.