feat(workspace): name tonight's first part handoff on the map

[seonghobae]

Product outcome

Name tonight's first corroborated part-to-part handoff on the mounted rehearsal map so the room can lock the owned pass before rehearsal. Open is the next action: it moves to the matching rendered song-structure section.

Demo: Bass Guitar still hands off to Lead Vocal in the verse at 0:10. Korean copy stays particle-safe ({from} 파트가 {to} 파트로).

This map next-action is distinct from:

• labeled handoff form guidance (feat(workspace): guide tonight's first labeled handoff on map and player #937)
• Part Handoff Map visualization (feat: add Part Handoff Map UI component to workspace #850)

Do not mix with #811, #828, or #897.

Exact current identity

• Protected target: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
• Branch: feat/workspace-first-part-handoff.
• Exact current head: 87664d8fd1c7a111964faa48f9bfd1b65d233446.

Current implementation

• Resolver requires dense own sections, bounded time, unique ranked-active roles, unique active graph nodes, and owned unique handoff_to / handoff_from edges.
• Receiving part must corroborate the giving part in handoff_from.
• Skip self-handoff, inactive nodes, labeled-handoff-without-graph, inherited/accessor/sparse metadata, and duplicated identities.
• Prefer earliest time, then locale-independent section id, then high rehearsalPriority, then locale-independent giving id.
• Bound displayed role names to 80 Unicode code points without splitting a surrogate pair.
• FirstPartHandoffCallout Open scrolls the renderer-owned data-section-index target. Analysis section.id is never DOM-ID authority.
• Reduced-motion uses behavior: "auto"; otherwise smooth.
• Unavailable state stays guidance-only (no Open).
• Do not invent the pass from groove, cue, simplification, overlap, range, chord labels, function labels, setup notes, confirmed overrides, harmonic explanations, confidence notes, transposition plans, or a labeled handoff form without owned bidirectional graph edges.

Security Notes

• Attack surface: untrusted rehearsal-song runtime metadata (sections, roles, partGraph edges, identity accessors) plus DOM navigation against the mounted song-structure renderer.
• Trust boundary: only own data properties on dense collections are read. Inherited/accessor/sparse/hostile getters fail closed to null and keep the callout guidance-only.
• Navigation authority is the renderer-owned section index, not analysis ids.
• Logging/privacy: no path, filename, or rejected-metadata echo.
• Test points: inherited-metadata suite, particle-safe Korean copy, reduced-motion scroll, workspace-scope renderer selection, Workspace navigation.

Dependency / merge gate

• fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 remains the canonical protected JavaScript dependency-security owner. Inherited pdfjs-dist / nanoid / undici HIGH findings are not copied or suppressed here. No lockfile change.
• Keep unmerged until the unchanged then-current head has every applicable repository/central CI, cross-platform build, exact owned statement+branch coverage, docstring, SAST/security/SBOM/supply-chain/package/release gate terminal-success; zero valid unresolved findings; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance.
• Queued, pending, skipped, cancelled, failed, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is not success.
• Never bypass protection or transfer predecessor evidence.
• Do not self-approve.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 3 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a09d24a4-28ee-4b7f-aa44-cd88ade43a67

📥 Commits

Reviewing files that changed from the base of the PR and between acdbea6 and e06ca27.

📒 Files selected for processing (20)

• AGENTS.md
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• apps/desktop/src/features/workspace/FirstPartHandoffCallout.particle.test.tsx
• apps/desktop/src/features/workspace/FirstPartHandoffCallout.reduced-motion.test.tsx
• apps/desktop/src/features/workspace/FirstPartHandoffCallout.test.tsx
• apps/desktop/src/features/workspace/FirstPartHandoffCallout.tsx
• apps/desktop/src/features/workspace/FirstPartHandoffCallout.workspace-scope.test.tsx
• apps/desktop/src/features/workspace/Workspace.test.tsx
• apps/desktop/src/features/workspace/Workspace.tsx
• apps/desktop/src/features/workspace/firstPartHandoff.inherited-metadata.test.ts
• apps/desktop/src/features/workspace/firstPartHandoff.test.ts
• apps/desktop/src/features/workspace/firstPartHandoff.ts
• apps/desktop/src/i18n/index.test.ts
• apps/desktop/src/i18n/index.ts
• apps/desktop/src/locales/en/common.json
• apps/desktop/src/locales/ko/common.json
• docs/design-system/component-contract.md
• docs/doctoring/reduced-motion-first-part-handoff-navigation.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.