feat(workspace): name the next action after project load or save fails

[seonghobae]

Product outcome

When a project file cannot open, the workspace names Choose another project as the next rehearsal action. When tonight's rehearsal map cannot be saved, it names Try saving again and keeps the open song visible. BandScope does not reuse the analysis error card for these persistence failures and does not invent a demo or retry analysis.

This is the remaining project-file failure path after analysis recovery (#976), local-file recovery (#981), and YouTube recovery (#982). Canonical MIR/known-stem work stays on #828 / #770. Canonical crash-safe save publication stays on #970 / #962. Canonical handoff import stays on #740 / #739.

open or save a project file
→ load fails  → Choose another project
→ save fails  → keep the rehearsal map + Try saving again

Exact current identity

• Protected target: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
• Branch: feat/project-save-load-failure-next-action.
• Exact head: 1f6c68d44389c049c7edb6dc1d08730117414709.

Buyer-visible contract

• Load title: That project file can't open tonight / 그 프로젝트 파일로는 오늘 합주를 열 수 없습니다.
• Load action: Choose another project / 다른 프로젝트 선택하기 reuses the existing project picker.
• Save title: Tonight's rehearsal map couldn't be saved / 오늘 합주 지도를 저장하지 못했습니다.
• Save action: Try saving again / 다시 저장하기 reuses the existing save picker.
• A failed save or a failed follow-up load does not hide an already-open rehearsal map.
• Cancelling the replacement picker is silent: the recovery action stays available.
• Choosing a local song, importing YouTube, starting analysis, or a successful load/save dismisses the persistence card.
• Secret-shaped, URL, and local-path diagnostics stay redacted and never appear in the recovery title or action.

Security Notes

• Untrusted input: project file picker results and native load_project / save_project error copy, including path- and URL-shaped diagnostics.
• Trust boundary: Tauri project load/save → safeErrorDetail → persistence recovery card → existing picker.
• Safe failure: recovery only re-invokes the existing load or save command. It does not follow links, open a generic filesystem API, start analysis, or replace an open rehearsal map with the analysis error card.
• Privacy: URL, path, and secret-shaped diagnostics are redacted before buyer copy. Tests assert secret-token never appears in the recovery heading or action.

Verification

Desktop Vitest on this head, with 100% gated coverage on App.tsx, export.ts, i18n, and Score*:

• src/App.test.tsx (73)
• src/i18n/index.test.ts (9)
• src/lib/export.test.ts (17)
• Score view/storage (32)

apps/desktop tsc --noEmit passed.

Dependency / merge gate

• Canonical JavaScript HIGH findings (nanoid, pdfjs-dist, undici) remain owned by fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783. This branch has no lockfile or vulnerability-suppression delta.
• Do not mix with 🔒 [보안] CLI 무제한 파일 읽기 취약점 수정 #811 (CLI job-file authority), test(analysis): govern real YouTube known-stem benchmark #828 (YouTube known-stem MIR), feat(workspace): Storybook tokens for rehearsal components #897 (Storybook tokens), feat: import rehearsal handoffs for focused reanalysis #740 (handoff import), or fix(project): stage new saves without clobbering known-good files #970 (atomic save publication).
• Keep unmerged until the unchanged then-current head has every applicable repository/central CI, cross-platform build, exact owned statement+branch coverage, docstring, SAST/security/SBOM/supply-chain/package/release gate terminal-success; zero valid unresolved findings; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance.
• Queued, pending, skipped-required, failed, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is non-passing.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 40 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9dd99772-1452-48e1-970c-98511e0ba3bd

📥 Commits

Reviewing files that changed from the base of the PR and between 749511c and ed0ba1e.

📒 Files selected for processing (12)

• AGENTS.md
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• apps/desktop/src/App.project-persistence.test.tsx
• apps/desktop/src/App.test.tsx
• apps/desktop/src/App.tsx
• apps/desktop/src/features/workspace/WorkspaceStates.tsx
• apps/desktop/src/locales/en/common.json
• apps/desktop/src/locales/ko/common.json
• docs/design-system/component-contract.md
• docs/design-system/product-design-handoff.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Merged current develop into this branch: resolved the shared-file conflict by including both this feature's project save/load failure next actions and the newly landed #957 playable-range work (CLAUDE.md keeps both sentences). No behavior dropped.

[devin-ai-integration]

Devin Review found 1 new potential issue.