fix(analysis): score C major acceptance from decoded WAV bytes

[cursor]

Summary

Tier 1 real-audio acceptance writes license-clean C-major and 120 BPM click WAVs, verifies and decodes the on-disk bytes, then scores the production ChordRecognizer / TemporalAnalyzer. The branch fail-closes malformed metric, timing, fixture-generation, decoded-PCM, digest, and report-provenance evidence instead of allowing Python coercions or derived numeric overflow to become buyer-facing accuracy evidence.

Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
Exact current head: 77b7cb88af1be9a7857d1aca86900c3a2dcc9219.
Branch remains Draft. Do not mix #884 Stem Lab, #783 dependency remediation, #861 Python branch-coverage authority, or #866 audio-resource policy authority onto this branch.

Current test-first repairs

• Report provenance: strict 64-hex SHA-256, finite numeric metric values, non-empty/trim-stable identities, and exact non-empty product VERSION provenance.
• Chord recall: clips and unions matching intervals so overlap cannot double-count annotated time; rejects Boolean/non-finite/reversed annotation or estimate timing.
• Tempo Acc1: rejects Boolean/non-finite estimate, truth, or tolerance evidence.
• Fixture generation/WAV serialization: rejects Boolean/non-finite/non-positive duration, BPM, and sample-rate inputs before allocation, loops, or write authority.
• Derived fixture timing: rejects finite raw inputs whose duration×sample-rate overflows, durations that quantize below one sample, and BPM values whose derived beat interval is non-finite.
• Decoded C-major PCM: requires one-dimensional non-empty finite floating-point mono PCM and a finite positive non-Boolean sample rate before production recognition or duration division.

Derived fixture timing authority — RED → GREEN

Exact-current-code inspection found two distinct failure modes that raw-input validation did not cover.

1. A finite duration_seconds=1e308 could overflow duration_seconds * sample_rate before allocation. A tiny positive BPM could likewise make 60 / bpm non-finite and break loop timing.
   • RED/test-only b44af346648e8a331a6774c99c72ccbcdf477c52 reproduced three exact failures as OverflowError in release run 31983981110, job 95255654864.
   • GREEN bec94965f00945601d2da4e54bd80d64bf2cc46e added one derived sample-count boundary and finite beat-interval admission.
2. A positive duration smaller than one sample still quantized to zero. The triad factory returned empty evidence and the click factory reached a zero-size reduction.
   • RED/test-only d2625a7b16187d18d02214132128abef28a08f47 failed exactly two new cases in release run 31984374899, job 95256679147 (2 failed, 730 passed, 24 skipped).
   • GREEN code head c1baa4718b50102f7d96c5afe7a9c3c873f45727 requires the derived sample count to be finite and at least one sample.

Exact c1baa4718b50102f7d96c5afe7a9c3c873f45727 native CI job 95257131722 is GREEN: desktop 194/194 with 100% statements/branches/functions/lines, shared-types 20/20 with 100% on all four metrics, Python 755 passed / 1 skipped with 3249/3249 statements at 100%, all 23 numeric-parity tests executed, public docstrings D100–D107, Ruff, mypy, Bandit, docs/security/supply-chain checks, Rust numeric build, and frontend production build all passed. This is predecessor code evidence only; it is not transferred to the current docs-updated head.

Current head 77b7cb88af1be9a7857d1aca86900c3a2dcc9219 adds only the matching doctoring and CHANGELOG contract after that code evidence. At the latest refresh GitHub had not yet emitted PR workflow runs for this exact head, so no final-head check is counted as success yet.

Security / dependency classification

The exact code head c1baa4718b50102f7d96c5afe7a9c3c873f45727 was inspected at failed-job/log level before classification:

• security-audit run 31984544591 fails at npm audit on protected-base nanoid <3.3.18, pdfjs-dist >=5.6.83 <6.2.108, and undici 7.0.0–7.28.0; downstream Python/Rust audit stages are skipped and are not success.
• aggregate Security Scan run 31984544672 has successful OSV base-vs-head, Dependency Review, and Scorecard. Its only failed job is Trivy 95257132315, which reports CVE-2026-16633 HIGH for pdfjs-dist at package-lock.json:6370 and explicitly directs remediation to the shared base.

This branch has no JavaScript dependency/root-lock or vulnerability-suppression delta. These are canonical #783-owned inherited protected-base findings; they are not suppressed, duplicated, or counted as success. The current head must still receive its own exact-head security evidence before any merge classification.

Security / evidence boundary

Untrusted inputs include on-disk WAV bytes, decoded buffer structure and sample-rate evidence, recognizer intervals, tempo values, fixture numeric inputs and derived timing, digests, report-builder inputs, and parsed report mappings. Mitigations include checksum-before-score, finite/non-Boolean numeric admission, finite ≥1 derived sample-count admission, finite beat-interval admission, one-dimensional mono PCM admission, overlap-safe recall, strict digest/report provenance, no network or shell authority, and license-clean deterministic fixtures. APA 7 MIR references and the bounded claim remain recorded in docs/doctoring/real-audio-accuracy-acceptance.md.

Dependency / merge gate

Keep Draft and unmerged until the unchanged then-current head has realistic focused/full tests GREEN; exact 100% owned production statement and branch coverage plus other exposed metrics; public docstring evidence; all applicable repository/central SAST/security/SBOM/supply-chain/package/release gates terminal-success; zero valid unresolved findings; #783 and #861 integrated and the then-current central required-workflow prerequisite inherited; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance. Current central read-only prerequisites are .github#939 and .github#1020; historical #1008 is closed unmerged and transfers no evidence. Never count queued, cancelled, skipped-required, failed, predecessor-head, protected-base, model-only, self/author, or bypass evidence as success.