fix(roles): fail closed on missing windows and lock identity tests

[cursor]

Summary

Successor to #873. The identity-safety repair in _STEM_TO_ROLE_IDS was already in production, but the only RoleExtractor measured-overlap test still required keys-left to share Bass Guitar's warning. Missing or mismatched section windows also failed open into a song-wide FFT, repeating one average clash on every card.

Buyer-visible contract on this head:

• An 80 Hz verse vs 1 kHz chorus fixture warns Bass Guitar only in the crowded section. Keyboard Left Hand, Keyboard Right Hand, and Acoustic Guitar stay empty.
• other + vocals warns Lead Vocal only.
• Stems without matching section windows emit no overlap warning.
• A partial boundary list is not enough evidence to measure any section.
• Next-action copy still tells the player to thin one part in that section.

Do not merge #873 in parallel. Leave dependency remediation on #783 and audio resource admission on #781/#866.

Verification

• Focused overlap/role tests: 42 passed
• uv run --project services/analysis-engine pytest --cov=src/bandscope_analysis --cov-report=term-missing --cov-fail-under=100 — 679 passed, 24 skipped, 100% statement coverage
• ./scripts/harness/quickcheck.sh (hosted CI on this head is the merge evidence; this environment is not counted as a substitute)

Security Notes

Attack surface

• In-memory stem arrays and section boundary timestamps already admitted by canonical orchestration
• Role-warning strings rendered in the desktop WebView

Trust boundary

• Python analysis engine → shared rehearsal-role contract → React workspace cards

Mitigations

• No file I/O, network, subprocess, dependency, or model authority added
• Missing windows, mismatched boundary counts, non-array stems, and mapping exceptions fail closed to no warning
• Display-only stem names use .get(..., ()) so a later label cannot KeyError into the extractor fail-soft path
• Mixed other remains usable in player-facing copy but cannot authorize named keyboard-hand or guitar roles

Test points

• Known 80 Hz bass+accompaniment verse versus 1 kHz chorus fixture, with band-energy RMSE vs the ideal low/mid profiles
• Empty warnings when stems exist but section windows are missing or the boundary count mismatches
• other + vocals warns only lead-vocal
• Display-only stem names do not raise and do not invent a new role id

Dependency and Supply Chain

• No new direct dependency was added
• If a new dependency was added, this PR explains why it is needed
• runtime / dev / build / test classification is recorded
• alternatives were considered
• maintainer trust and update health were checked
• license fit was checked
• known security issues were checked
• transitive footprint impact was considered
• SBOM or supplemental inventory impact was recorded

i18n impact

• No user-visible string changed
• Korean and English locale impact was updated

Engine warning copy is already English next-action text from #873. This successor does not add or change locale keys.

Reviewer checklist

• Gitflow target branch is develop
• protected-branch rules were not weakened
• required checks are expected to stay green on this exact head

Keep this Draft-equivalent until the unchanged resulting exact head has realistic focused/full tests GREEN, 100% owned production coverage, and ordinary branch-protection acceptance. Queued, skipped, predecessor, or self/author evidence is not success.

  

[seonghobae]

Superseded by canonical PR #873 with all unique work preserved. Immediately before consolidation, compare(8cf7d26e27a685181d4561643562d900c3bf7a96, 9f1e166da9acf043b7f4b8b6df84b5e1a2417706) reported this branch as exactly one direct child commit (ahead_by=1, behind_by=0, merge-base 8cf7d26…). #873 was then fast-forwarded non-forced to exact head 9f1e166da9acf043b7f4b8b6df84b5e1a2417706; post-consolidation compare is identical with zero commits/files. Required checks/reviews must regenerate on #873; #876 evidence does not transfer for merge.