feat(roles): wire measured register overlap into section warnings

[cursor]

Canonical buyer-visible slice

This Draft replaces fabricated role-overlap copy with section-windowed measured overlap, keeps mixed htdemucs other off named keyboard/guitar identity, and preserves the isolated active-stem optimization.

Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
Exact current head: 9423ae62492fd9bc3530f9a603bbd5b864322a21.

Product / evidence contract

• No clash copy unless pitched stems measurably share a register in the relevant section.
• Mixed other remains accompaniment and cannot authorize Keyboard Left Hand, Keyboard Right Hand, or Acoustic Guitar identity/presence.
• Missing/mismatched/invalid section authority produces no overlap warning rather than whole-song fallback.
• Register analysis accepts only one-dimensional mono arrays with finite positive non-Boolean sample-rate evidence.
• Section slicing accepts only finite non-Boolean start/end/sample-rate evidence and requires finite scaled sample positions before integer conversion.
• Valid warnings attach only to roles supported by evidence and use next-action copy.

Test-first current-head repairs

Boolean temporal/sample-rate authority

Exact-code review found Python bool values could pass ordinary numeric checks because bool is an int subtype: sr=True could enter FFT frequency construction, and Boolean section start/end/sample-rate values could become 0/1 timing authority.

• RED 2b2ca42f1bbfa604943177aad124e9b26b1d7e11 adds direct Boolean sample-rate and section-window regressions.
• GREEN 2db7a4797e57f4271bae260efc090fa99e51692f rejects Boolean sample rate in band_energy_profile and Boolean start/end/rate evidence in slice_stems_to_window, returning zero/empty evidence without I/O authority.
• e7ef5eadbaf1db8809318a0938467e03d6e76621 records the repair in CHANGELOG.
• Current head 9423ae62492fd9bc3530f9a603bbd5b864322a21 aligns docs/doctoring/register-overlap.md with the exact trust/test boundary and preserves the APA 7 psychoacoustic/MIR references.

Earlier branch repairs remain current: malformed multichannel stems fail closed before FFT; non-finite direct sample rates fail closed; finite raw timing whose scaled sample-index product overflows fails closed; matching result ordering and role-honesty are preserved.

Exact-current-head verification

The first workflow generation for 9423ae62492fd9bc3530f9a603bbd5b864322a21 was cancelled before repository jobs executed. That cancellation was inspected rather than treated as source failure. Exact-head reruns have now completed on the unchanged head.

Terminal-success repository workflows:

• ci run 31972445814;
• secret-scan-gate 31972445831;
• SAST Semgrep 31972445850;
• release 31972445830;
• bandit 31972445853;
• build-baseline 31972445824; and
• sbom 31972445862.

Two exact-head failures were inspected at the job/step/log boundary and are inherited protected-base dependency evidence rather than changes introduced by this branch:

• security-audit run 31972445819, attempt 2, job 95230076341 completed checkout/tool setup and failed specifically at Audit npm dependencies; subsequent Python/Rust audit stages were skipped. This branch has no JavaScript dependency/root-lock delta.
• aggregate Security Scan run 31972445818, attempt 2 failed only in trivy-fs job 95230123983. dependency-review and osv-scan succeeded, including the base/head PR-introduced comparison. Trivy reported exactly one HIGH whole-tree finding: CVE-2026-16633 for pdfjs-dist at package-lock.json:6370, and the workflow itself instructs remediation on the shared base branch.

Therefore neither failure is suppressed, copied into this branch, or counted as success. Canonical #783 remains the dependency-root owner. Rerunning these unchanged failing gates again would only reproduce the same protected-base finding.

Dependency / merge gate

This branch changes no JavaScript dependency/root lock or vulnerability suppression. Protected-base dependency findings remain canonical #783-owned and must never be suppressed or copied here. Python statement+branch merge evidence remains #861-owned. The current central required-workflow replacement is read-only .github#1020; historical #1008 is closed unmerged.

Keep Draft and unmerged until the unchanged then-current head has realistic focused/full tests GREEN, exact 100% owned production statement/branch coverage and public docstrings, applicable numerical parity, all required repository/central SAST/security/SBOM/supply-chain/package/release gates terminal-success, zero valid unresolved findings, dependency prerequisites integrated/regenerated, a qualifying independent non-author last-push approval, and ordinary branch-protection acceptance without bypass. Never count queued, cancelled, skipped-required, failed, predecessor-head, protected-base, model-only, self/author, or bypass evidence as success.