feat(workspace): open tonight's first notes on the groove map

[seonghobae]

Buyer-visible gap

After a part is selected, Transcribe Bass did nothing for bass and said coming soon for every other role. The groove map already sat underneath with tonight's notes or an empty panel. A bandmate who had just picked a part still could not start on the first notes.

Cites Figma 19-526 Groove Map and docs/design-system/component-contract.md.

Product outcome

• Selected part with notes: See Bass Guitar notes · E2 from 0:00 opens the groove map.
• Selected part with range only: See Lead Vocal range · G#3–C#5 names the first lock-in window and focuses the empty map.
• Cue-only roles do not expose an enabled first-notes action: without transcription or a complete range, the control remains explicitly unavailable and does not focus the groove map or emit a false first-notes status.
• Selected-role transcription is aggregated across all song sections and sorted by absolute onset, so a role whose first section has no notes can still open its later analyzed notes on tonight's groove map.
• Live copy: Tonight's first Bass Guitar notes are E2 from 0:00. Count in on the groove map.
• This does not invent a transcription engine, isolation playback, or a parallel MIR product. test(analysis): govern real YouTube known-stem benchmark #828 remains the known-stem owner.
• Copy is bilingual (en/ko).

Current regression repair

Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
Exact current head: bc3a69b736b5d84197b0abd55d92ce308e29657e.

Current-code inspection found and repaired two same-scope behavior gaps on the canonical branch:

1. roleCue previously made the first-notes control actionable even when both transcription and a complete range were absent, while its visible and accessible label still said no notes were ready. The focused cue-only Bass Guitar regression now requires the unavailable control to remain aria-disabled, perform no groove-map focus/scroll, and emit no cue-only first-notes status.
2. The initial implementation derived first-note/groove-map content from only one representative role record. The current head aggregates the selected role's transcription across sections and has a regression where section 1 contains only range metadata while a later section contains an A2 at absolute onset 42; the action must expose that real later note as 0:42 and render it in the groove map.

No dependency/root-lock, workflow, generic filesystem/network/subprocess authority, or security-suppression change belongs to this PR.

Exact-current-head repository gate state

Repository workflows on bc3a69b... are terminal-success for ci, release, build-baseline, sbom, secret-scan-gate, SAST Semgrep, and bandit.

security-audit and aggregate Security Scan are terminal-failure and therefore non-passing. This PR does not modify dependency manifests/root lockfiles or the security workflows; inherited protected-base dependency remediation remains the canonical #783 lane and must be regenerated after that dependency root integrates. Failed/inherited evidence is not treated as success and is not suppressed here.

Fresh inline review inspection has zero unresolved threads and no formal reviews are recorded for this PR. There is therefore no qualifying independent non-author last-push approval.

Security notes

• No new filesystem, network, subprocess, or generic exec path.
• Note, range, and cue text come from already-validated analysis output.
• Scroll/focus stays inside the existing workspace DOM.

Merge gate

• Target is protected develop.
• Not a MIR product and not a parallel [Product Gap] Add real-audio MIR accuracy acceptance benchmarks #770 owner. test(analysis): govern real YouTube known-stem benchmark #828 remains the known-stem owner.
• Do not mix with 🔒 [보안] CLI 무제한 파일 읽기 취약점 수정 #811, test(analysis): govern real YouTube known-stem benchmark #828, or feat(workspace): Storybook tokens for rehearsal components #897.
• Inherited fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 dependency findings must not be suppressed here.
• Merge only after the unchanged current head has every applicable required exact-head gate terminal-success and a qualifying independent non-author last-push APPROVE under live branch protection.

Queued, pending, skipped-required, cancelled, failed, prior-head, protected-base, model-only, author/self, or administrative-bypass evidence is non-passing.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d04f7b19-2f46-4e9e-9046-bfc8e9eac8c8

📥 Commits

Reviewing files that changed from the base of the PR and between acdbea6 and bc3a69b.

📒 Files selected for processing (11)

• AGENTS.md
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• apps/desktop/src/features/workspace/GrooveMap.tsx
• apps/desktop/src/features/workspace/Workspace.cue-action.test.tsx
• apps/desktop/src/features/workspace/Workspace.test.tsx
• apps/desktop/src/features/workspace/Workspace.tsx
• apps/desktop/src/locales/en/common.json
• apps/desktop/src/locales/ko/common.json
• docs/design-system/component-contract.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.