contract(shared): reject non-finite transcription timing before rehearsal UI #1253

Finding

TranscriptionNote.onset and offset were typed as number, while protected runtime admission accepted every JavaScript number, including NaN, +Infinity, and -Infinity. Rehearsal consumers perform timeline arithmetic on those fields, so this is a shared-contract defect rather than a GrooveMap-only concern.

Canonical owner

Draft PR #1254 remains the single source writer and is now exact 02e85d3150bfd32472a23793b36af577fd55e331.

The original #1253 lineage is preserved:

• RED 73c60d5d85684eedf274b6b2dde4272a95b534a1: non-finite onset/offset hostile fixtures;
• repair 7dec5a64d5a265cbf75ac735e286d8529c09c31f: finite-number admission;
• cleanup 53cc2c6057b34cf006232d47599532fd9f8f0d3f: removes an unrelated metadata-handoff delta.

Issue #1255 subsequently established the adjacent finite-interval invariant from repository producer and buyer-rendering evidence. To preserve single-writer ownership, that repair was ordinarily continued on the same #1254 branch rather than opening a parallel validator PR:

• RED 9a27a87f8c2c74614d84acb23458845949f948a0;
• causal repair 95356c11a76716dde927bfe311dffb5eec4cf9e1;
• current doctoring/head 02e85d3150bfd32472a23793b36af577fd55e331.

The shared boundary now requires finite onset >= 0 and finite offset > onset. Velocity remains outside this decision.

Current exact-head evidence

Fresh compare against protected develop@314ddeae7b775a4957594b599358c8255617eb2e: ahead=7, behind=0, merge base exactly protected develop, three changed files.

Fresh workflow generation for exact 02e85d3...:

• build-baseline 35725434517: pending;
• SAST Semgrep 35725434526: queued;
• Security Scan 35725434480: queued;
• repository ci 35725434515: queued;
• CodeQL PR 35725434457: pending;
• SBOM 35725434460: queued.

Successful checks from predecessor b69239b... are historical evidence only after the source mutation and do not transfer to this head. No qualifying independent current-head approval is claimed.

Acceptance

• NaN, +Infinity, and -Infinity onset/offset fail at shared admission with the exact nested field path.
• Consumer-side validation copies are not introduced.
• The follow-on finite interval invariant is reconciled in the same canonical writer rather than a parallel source lane.
• No dependency, network, IPC, filesystem, telemetry, PII, or locale surface is added.
• Exact-head repository/build/security/SBOM/CodeQL generation settles terminally.
• Zero valid unresolved findings and qualifying independent non-author current-head approval.
• fix(shared): enforce valid transcription timing intervals #1254 or a verified complete successor becomes protected ancestry.

Do not close this issue merely because source acceptance is implemented. Protected integration or verified complete succession remains required.