fix(audio): establish canonical local-audio resource policy

ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # ARCHITECTURE.md
 
-Last updated: 2026-03-11
+Last updated: 2026-09-07
 
 ## Brand source
 
@@ -111,9 +111,10 @@ Last updated: 2026-03-11
 - Shared contracts live in `packages/shared-types` so the UI can evolve without importing Python internals.
 - Shared contracts should ultimately model section, role, cue, confidence, and export artifacts explicitly enough that desktop UI and analysis outputs do not invent their own parallel schemas.
 - The current shared-types baseline includes a rehearsal-domain fixture that exercises section, role, cue, confidence, provenance, and export-summary fields in the desktop shell before the full analysis pipeline lands.
-- Local analysis orchestration uses typed Tauri IPC commands and a Python subprocess over stdin/stdout rather than a loopback HTTP listener.
-- Local audio intake bootstraps a project by validating a user-selected file in Rust, creating app-owned temp/cache/project roots, and referencing the original source file rather than copying it in this phase.
-- Those bootstrap roots should resolve from app-owned Tauri data/cache paths instead of the shared system temp namespace.
+- Local analysis orchestration uses typed Tauri IPC commands and a Python subprocess over stdin/stdout rather than a loopback HTTP listener. Renderer-visible commands are synchronized across the invoke handler, `AppManifest::commands`, generated command permissions, and the window capability; the WebView never receives a PID or generic process handle.
+- Local audio intake validates source metadata and encoded size before decode, stages admitted bytes into an app-owned project area, and commits the immutable project source with a path-free size/SHA-256 receipt. Unix publication uses a same-filesystem no-clobber hard link plus project-directory synchronization; Windows uses no-replace `MoveFileExW` with `MOVEFILE_WRITE_THROUGH`. A pre-existing project source is preserved rather than overwritten or deleted.
+- Those project and temp/cache roots resolve from app-owned Tauri data/cache paths instead of the shared system temp namespace.
+- Analysis cancellation is job-specific. Queued work can terminate as typed `cancelled`; running work currently kills and reaps only the directly owned analysis child. This is not process-tree containment: descendant termination, inherited-handle closure, temp-artifact cleanup, and bounded cancellation latency remain acceptance work across Windows/macOS/Linux.
 - Product and UX decisions should prefer rehearsal-first simplicity while still maintaining high analytical accuracy.
 - Security decisions should prefer allowlisted narrow capabilities over generic convenience APIs.
 
@@ -126,4 +127,4 @@ Last updated: 2026-03-11
 - Security docs and checks are part of the default quickcheck path so design drift is caught early.
 - Supply-chain docs, workflow pinning, and lockfile verification are part of the default quickcheck path so dependency drift is caught early.
 - Quickcheck and CI are expected to verify dependency review, audit, supplemental inventory, and SBOM baseline presence as part of bootstrap.
-- Cross-platform build workflow presence and trigger coverage are part of the default supply-chain verification path.
+- Cross-platform build workflow presence and trigger coverage are part of the default supply-chain verification path so dependency drift is caught early.

CHANGELOG.md

@@ -8,6 +8,21 @@
 - Display the analyzed song tempo (BPM) as a badge in the rehearsal workspace.
 - 각 합주 역할(Role)별 개인 연습 진행도를 0~100% 범위로 기록 및 시각화할 수 있는 연습 진척도(`practiceProgress`) 트래커 기능 추가. UI 컨트롤(슬라이더 및 +/- 버튼)과 한/영 다국어 지원 포함.
 
+### Fixed
+
+- Enforce one canonical local-audio resource policy across native local-file/YouTube bootstrap intake, the desktop bridge, Python request preflight, temporal decoding, and stem separation so oversized, overlong, malformed, wrong-rate, or non-finite input fails before bootstrap storage or expensive analysis/model work.
+- Commit an admitted local source through a platform-specific no-clobber durability barrier before returning path-free project authority: Unix synchronizes the project directory after hard-link publication/stage removal, while Windows uses no-replace `MoveFileExW` with `MOVEFILE_WRITE_THROUGH`.
+- Preflight source-container duration, sample rate, and channel count from the already-open audio handle before temporal, stem, or bass-transcription decoders resample, downmix, or truncate it; successful metadata probes rewind the handle and malformed probes fail closed.
+- Advance the local-audio resource policy to v2 and bind the admitted canonical decoded mono buffer to the production float32 representation: 158,760,000 bytes for the existing 39,690,000-sample / 15-minute ceiling, preventing a wider floating buffer from silently consuming twice the intended canonical artifact memory while keeping the same sample count.
+- Advance the local-audio resource policy to v3 and require the PCM artifact admitted to MIR to be native NumPy `float32`; noncanonical artifacts passed directly to policy validation fail closed with `decoded_dtype_unsupported`, while decoder-returned floating arrays are normalized only after their sample count and already-allocated bytes fit the shared policy.
+- Reject an oversized or over-budget decoder-returned array before float32 normalization can allocate a second canonical PCM buffer; decoder/resampler allocations made internally before `librosa.load` returns remain outside the artifact ceiling and require separate peak-RSS measurement.
+- Bound canonical PCM finiteness validation to 1 MiB temporary boolean-mask chunks instead of allocating a full-song NumPy mask, while preserving NaN and positive/negative infinity rejection.
+- Add job-specific native analysis cancellation without exposing PIDs or generic process authority to the renderer: queued work can terminate as typed `cancelled`, running work kills and reaps the directly owned analysis child, and the worker clears cancellation state and releases its in-flight slot once. Process-tree containment and measured descendant/temp cleanup remain separate acceptance work.
+- Fail closed on malformed known YouTube duration metadata before `download=True`; Boolean, non-numeric, non-finite, zero, negative, and non-canonical numeric-subtype duration evidence can no longer authorize a media download through Python numeric coercion or subclass semantics.
+- Align YouTube download admission with that same 100 MiB encoded-byte ceiling: abort in-flight with yt-dlp `max_filesize` and a progress hook, reject announced oversize before `download=True`, delete owned `.part` / `.ytdl` / `-Frag*` siblings from that import directory on abort, reject a completed path that resolves outside the current import cache before post-download validation, cleanup, or success, and delete owned post-download artifacts that still exceed the policy. A 60 MiB import that the old 50 MB check rejected is now accepted; a file one byte over 100 MiB is not.
+- Bound native stored-score PDF reads to the 25 MiB product limit before heap allocation and revalidate PDF magic on the same opened descriptor, preventing an attached score that later grows from bypassing the local resource boundary.
+- Treat every zero-element NumPy layout as empty chord input, including shapes whose first dimension is non-zero, before feature extraction.
+
 ### Changed
 
 - Consolidated Bandit, dependency audits, supplemental secret checks, and Trivy into one trusted-branch security backstop, delegated CodeQL to GitHub default setup, and removed duplicate local PR security and release-preflight runs.

CLAUDE.md

@@ -52,7 +52,7 @@ BandScope is a local-first desktop app for rehearsal prep: it turns a song into
 Three layers, decoupled through shared contracts:
 
 - `apps/desktop` — Tauri 2 + Vite + React 19 shell (Tailwind 4, Base UI, Storybook). Feature screens live in `src/features/` (home, workspace, chords, ranges, player, settings). The ready workspace names tonight's first playable range and the next instrument check. `src/lib/analysis.ts` and `src/lib/job_runner.ts` call typed Tauri IPC commands, with a browser fallback that serves demo data when not running inside Tauri.
-- `apps/desktop/src-tauri/src/main.rs` — the Rust orchestration boundary. Tauri commands (`start_analysis_job`, `get_analysis_job_status`, `select_local_audio_source`, `import_youtube_url`) validate untrusted input (project IDs, file paths, URLs) and spawn the Python engine as a subprocess. There is no loopback HTTP listener and no network path for local analysis.
+- `apps/desktop/src-tauri/src/main.rs` — the Rust orchestration boundary. Tauri commands cover analysis start/status/cancellation, local-audio selection and YouTube import, project save/load, and bounded score-PDF attach/read/remove operations. Each renderer-visible application command must remain synchronized across the invoke handler, `AppManifest::commands`, generated permission, and window capability. Commands validate untrusted input and spawn the allowlisted Python engine as a subprocess; no PID or generic process handle is exposed to the WebView. There is no loopback HTTP listener and no network path for local analysis.
 - `services/analysis-engine` — Python package `bandscope_analysis` (librosa/numpy). Entry point `cli.py` reads a JSON job request on stdin and prints a structured job-status JSON envelope on stdout (`--progress-jsonl` streams progress lines). `api.py` orchestrates the pipeline across the `separation`, `sections`, `roles`, `chords`, `ranges`, `temporal`, `transcription`, and `youtube` modules.
 
 Data flow: React UI → Tauri IPC command → Rust validation + Python subprocess over stdin/stdout → job status and progress events emitted back to the UI.

apps/desktop/core/Cargo.toml

@@ -7,7 +7,7 @@ publish = false
 
 [lib]
 name = "bandscope_desktop_core"
-path = "src/lib.rs"
+path = "src/root.rs"
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(coverage)'] }