fix(overlap): restore isolated active-stem filter without local caps

[cursor]

Summary

Repair for #801 at head a559d65e. Keep the sound active-stem filter and fail-closed threshold contract. Remove the Bolt-head silent 10M-sample / 10-stem guards, the .jules notes, the CVE-2026-16633 Trivy ignore, and the npm/PDF.js lock churn owned by #783.

Net diff versus protected develop is four files:

• services/analysis-engine/src/bandscope_analysis/roles/overlap.py
• services/analysis-engine/tests/test_register_overlap.py
• services/analysis-engine/tests/test_register_overlap_threshold_contract.py
• CHANGELOG.md

This restores the isolated 171f0ab0 product slice: filter active stems per register band, preserve BANDS tie order, fail closed on boolean / non-finite / out-of-range thresholds, and leave audio-size and stem-count admission to canonical audio_resource_policy (#781 / #866).

Close or supersede #801 once this lands. Do not merge #801 at a559d65e.

Verification

• uv run --project services/analysis-engine pytest services/analysis-engine/tests/test_register_overlap.py services/analysis-engine/tests/test_register_overlap_threshold_contract.py — 22 passed
• ./scripts/harness/quickcheck.sh (queued on this head)

Security Notes

Attack surface

In-memory numpy FFT and pair comparison on stems already admitted by orchestration. No file I/O, URL intake, subprocess, IPC, or persistence changes.

Trust boundary

Feature analyzer after the process/IPC admission boundary. Canonical orchestration owns encoded size, decoded sample count, duration, stem count, memory, and CPU/GPU budgets (#781).

Mitigations

• No feature-local silent sample or stem ceiling that can drop density warnings on a valid 4–15 minute rehearsal stem.
• Invalid thresholds (bool, non-finite, outside 0.0..1.0) fail closed to an empty result instead of clamping to 0.0 and fabricating silent-stem overlaps.
• Occupancy requires share > 0.0 and share >= threshold.
• No new dependencies, lockfile edits, or Trivy suppressions.

Test points

• Deterministic sine-wave band occupancy (80 Hz / 100 Hz low overlap; separated registers; drums excluded).
• Policy-owned regressions: logical 100,000,001-sample audio still reaches FFT; 101 pitched stems still emit pairs.
• Equal-severity results keep declared BANDS order.
• Silent stems stay empty at 0.0 / negative / -inf thresholds; threshold=True fails closed.

Dependency and Supply Chain

• No new direct dependency was added
• If a new dependency was added, this PR explains why it is needed
• runtime / dev / build / test classification is recorded
• alternatives were considered
• maintainer trust and update health were checked
• license fit was checked
• known security issues were checked
• transitive footprint impact was considered
• SBOM or supplemental inventory impact was recorded

This PR removes a stale CVE-2026-16633 ignore and pdfjs/nanoid/undici lock edits from the #801 Bolt head. Coordinated npm/PDF.js baseline remains #783.

i18n impact

• No user-visible string changed
• Korean and English locale impact was updated

Reviewer checklist

• Gitflow target branch is develop
• protected-branch rules were not weakened
• required checks are expected to stay green

  

[seonghobae]

Superseded by canonical existing owner #801 after exact-head reconciliation. #801 branch jules-5181940737828421207-470195ff has been fast-forwarded non-destructively to this exact head 05533f29f299bf8077d3df61b6ee404d9a956985; therefore the four-file product tree, threshold fail-closed regressions, removal of feature-local sample/stem caps, absence of npm/PDF.js/Trivy drift, and BANDS tie-order preservation are now identical in #801. Closing this duplicate leaves one owner for the overlap boundary. Fresh exact-head CI/review on #801 is still required before any merge classification.