fix(workspace): keep lock-in pairs display-unique and honest

[cursor]

Summary

Landing vehicle for the Rehearsal Priorities lock-in-first card. Prefer this over #874 (5cd1afd6). Players see up to three named role-and-section pairs, with display-unique pairs so a repeated verse label cannot consume the third slot, and empty copy that points at the section roadmap instead of a no-op role click.

Exact current head: df023052. Protected base: develop@acdbea63.

Behavior:

• prefer high rehearsal-priority roles, then medium only if no high-priority role exists;
• skip blank and case-insensitive none sentinels;
• de-duplicate focus-section labels and lock-in display pairs case-insensitively, preserving first-occurrence spelling;
• keep the buyer-visible list at three distinct items;
• keep English and Korean chrome synchronized.

This remains distinct from #776 (setup, simplification, transposition, and overlap in the selected-role panel).

Verification

• npm --workspace @bandscope/desktop run typecheck
• npm --workspace @bandscope/desktop run lint
• npm --workspace @bandscope/desktop exec vitest run src/features/workspace --coverage (37 passed)
• ./scripts/harness/quickcheck.sh (exact-head CI still required; queued or predecessor evidence is not success)

Security Notes

Attack surface

• Already-validated RehearsalSong section labels, role names, focus-section strings, and rehearsal-priority enums rendered in Workspace.

Trust boundary

• The card consumes parseRehearsalSong output already shown elsewhere. No new file, URL, subprocess, IPC, WebView, model, database, or dependency path.

Mitigations

• Render role and section text as React text nodes only.
• Skip blank/none sentinels so missing evidence never becomes an instruction.
• De-duplicate display pairs and focus labels so repeated untrusted strings cannot hide later distinct actions.

Test points

• Late Night Set high-priority pairs (Bass Guitar · verse, Keyboard 1 Right Hand · verse).
• Repeated verse before chorus: third slot is Lead Vocal · chorus.
• Empty/none sentinels show honest empty copy in English and Korean.
• First-section fallback when every role is low and focusSections is empty.

Dependency and Supply Chain

• No new direct dependency was added
• If a new dependency was added, this PR explains why it is needed
• runtime / dev / build / test classification is recorded
• alternatives were considered
• maintainer trust and update health were checked
• license fit was checked
• known security issues were checked
• transitive footprint impact was considered
• SBOM or supplemental inventory impact was recorded

Canonical #783 remains the protected JavaScript dependency-security owner. This branch does not suppress or duplicate it.

i18n impact

• No user-visible string changed
• Korean and English locale impact was updated

workspacePriorityEmpty now tells players to pick the first entrance on the section roadmap. workspaceLockInFirstLabel and workspacePriorityFocusLead stay synchronized.

Reviewer checklist

• Gitflow target branch is correct (develop)
• protected-branch rules were not weakened
• required checks are expected to stay green

Keep Draft/unmerged until exact-head CI, coverage, security/SBOM/supply-chain evidence, and a qualifying independent non-author last-push approval exist. Do not merge #874 in parallel.

  

[seonghobae]

Superseded by canonical PR #874 with unique work preserved. Before consolidation, compare(5cd1afd6ce7bf4805bf74fecff35d0479ace9fa3, c646037d390ed92dfe12c4416e8eb9874cc03b6b) proved this branch was a direct three-commit descendant (ahead_by=3, behind_by=0, merge-base 5cd1afd…). #874 was fast-forwarded non-forced to exact head c646037d390ed92dfe12c4416e8eb9874cc03b6b; post-consolidation exact comparison is identical with zero commits/files. Fresh #874 checks/reviews are required; #877 evidence does not transfer for merge.

[cursor]

Assessment (c646037d)

The titled lock-in-first card is sound: display-unique pairs, sentinel skipping, and empty copy that points at the section roadmap are covered by Late Night Set tests. Do not merge #874 in parallel.

Two buyer-visible residuals on the later click-to-select commits are not merge blockers for the titled fix, but they are dishonest as shipped:

1. Unmatched focusSections such as bridge still render as “Show bridge on the roadmap”. Click assigns null and can wipe verse focus. The plan called this a no-op; the implementation is not.
2. Activating Lead Vocal · chorus sets data-focused-section but does not bring that w-80 card into the horizontal scroller.

Successor a0c2e612 on cursor/bc-fee24870-fea4-4d15-977a-a76d0b07145b-071e omits unmatched labels, walks past none first-section sentinels, and scrolls the named card into view with aria-current="true". Prefer that vehicle over this head.

Do not treat this comment as approval. Exact-head CI and an independent non-author last-push review are still required. Stem-lane placeholder copy stays a later gap; do not mix it here.

  

_{Sent by Cursor Automation: Fix Issues}