From 5381765a08a808eae88babc897911c3d19d0b32c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 16 Jun 2026 19:13:28 +0000
Subject: [PATCH 1/6] feat(web): load your own MIDI tab in the playground

Let part A come from a user-loaded MIDI file instead of only the built-in
sample, then arrange a complement over any of its tracks.

- New import-free C-ABI exports input_alloc / load_score / load_len marshal
  the uploaded bytes in and a track summary out through linear memory; the
  parsed Score is stashed for subsequent arrange() calls.
- arrange() gains a track selector (track < 0 = built-in sample, track >= 0 =
  a track of the loaded score), reading ppqn/tempo off the source.
- MIDI only for now: griff-core's MIDI import is always available, so the wasm
  stays import-free (WebAssembly.instantiate(bytes, {})); Guitar Pro needs a
  getrandom backend that avoids wasm-bindgen and is a follow-up (ADR-0024).
- UI: file input + track <select>; README/ABI updated; tests cover rejecting
  non-MIDI bytes and the load -> arrange-over-imported-track path.
---
 web/README.md         |  29 +++--
 web/src/lib.rs        | 256 +++++++++++++++++++++++++++++++++++++-----
 web/static/app.js     |  53 ++++++++-
 web/static/index.html |  17 ++-
 web/static/style.css  |  10 ++
 5 files changed, 321 insertions(+), 44 deletions(-)

diff --git a/web/README.md b/web/README.md
index c352aa16..3d545b0c 100644
--- a/web/README.md
+++ b/web/README.md
@@ -6,16 +6,17 @@ A browser front for the complement arranger — built so the engine can be drive
 
 This is the **MVP** (ADR-0024 §2): a deliberately thin, throwaway front — no
 `wasm-bindgen`, no framework. `griff-web` is an *import-free* `cdylib` that
-exports three C-ABI functions; the page (`static/`) loads the `.wasm` with
+exports a few C-ABI functions; the page (`static/`) loads the `.wasm` with
 `WebAssembly.instantiate(bytes, {})` and marshals a small JSON result through
 linear memory. The canonical `egui` frontend (ADR-0016) replaces it at M2.
 
 ## What it does
 
-Builds a fixed sample lead (part A) and a generated complement (part B) entirely
-in the browser, with live controls for **mode**, **seed**, **register offset**,
-and **pitch spread** (the ADR-0023 `VariationControl`, audible on the grid-locked
-modes). Deterministic: the same controls always produce the same result.
+Takes a part A — either a built-in sample lead or **a track from a MIDI file you
+load** — and generates a complement (part B) entirely in the browser, with live
+controls for **mode**, **seed**, **register offset**, and **pitch spread** (the
+ADR-0023 `VariationControl`, audible on the grid-locked modes). Deterministic:
+the same controls always produce the same result.
 
 ## Build & run locally
 
@@ -28,20 +29,26 @@ The crate is wasm32-only and excluded from the root workspace (like `fuzz/`), so
 stable `--workspace` builds/clippy/tests never touch it. It depends on
 `griff-core` with `default-features = false`, dropping the Guitar Pro importer
 (`guitarpro`/`zip`/`time`/`getrandom` → `wasm-bindgen`) — that is what keeps the
-module import-free and ~90 KiB.
+module import-free. MIDI import is always available, so loading a `.mid` works in
+the lean build (~220 KiB once the parser is reachable code); Guitar Pro file
+loading waits on a `getrandom` backend that does not pull in `wasm-bindgen`.
 
 ## ABI
 
 | export | signature | meaning |
 | --- | --- | --- |
-| `arrange` | `(mode:u32, seed:u32, offset:i32, variation:f32) -> *const u8` | arrange; returns a pointer to JSON in linear memory |
-| `arrange_len` | `() -> usize` | byte length of the last result |
+| `arrange` | `(mode:u32, seed:u32, offset:i32, variation:f32, track:i32) -> *const u8` | arrange over part A (`track<0` = built-in sample, `track>=0` = loaded score's track); returns a pointer to JSON |
+| `arrange_len` | `() -> usize` | byte length of the last `arrange` result |
+| `input_alloc` | `(len:usize) -> *mut u8` | reserve `len` bytes for an uploaded file; JS writes the bytes here, then calls `load_score` |
+| `load_score` | `(len:usize) -> *const u8` | parse the input buffer (MIDI), stash the score, return a pointer to a JSON track summary |
+| `load_len` | `() -> usize` | byte length of the last `load_score` summary |
 | `memory` | — | the linear memory JS reads the JSON from |
 
 `mode`: 0 `rhythm_lock`, 1 `register_contrast`, 2 `call_response`,
 3 `support_layer`, 4 `octave_double`, 5 `counter_melody`.
 
-Result JSON: `{ppqn, tempo, realized_spread, error, tracks:[{name, role, notes:[{p,s,d,v}]}]}`.
+Arrange JSON: `{ppqn, tempo, realized_spread, error, tracks:[{name, role, notes:[{p,s,d,v}]}]}`.
+Load summary JSON: `{error, ppqn, tempo, bars, tracks:[{i, name, notes}]}`.
 
 ## Deploy
 
@@ -52,4 +59,6 @@ pushes to the default branch (enable Pages → "GitHub Actions" in repo settings
 
 - Audio is a placeholder WebAudio synth (sawtooth + envelope, A left / B right).
   A real SoundFont (guitar tone) is a follow-up.
-- Input is a fixed in-code sample; a file picker / drag-drop comes later.
+- You can load your own **MIDI** file and arrange over any of its tracks;
+  **Guitar Pro** file loading (needs a `wasm-bindgen`-free `getrandom`) and
+  drag-drop are follow-ups.
diff --git a/web/src/lib.rs b/web/src/lib.rs
index 73568119..d1bb5efb 100644
--- a/web/src/lib.rs
+++ b/web/src/lib.rs
@@ -1,15 +1,21 @@
 //! Browser playground (WASM) for the griff complement arranger — ADR-0024.
 //!
 //! A deliberately thin, throwaway front (ADR-0024 §5): no `wasm-bindgen`, no
-//! framework. It exports three C-ABI functions and marshals a JSON result
-//! through linear memory, so the build is just `cargo build --target
+//! framework. It exports a handful of C-ABI functions and marshals a JSON
+//! result through linear memory, so the build is just `cargo build --target
 //! wasm32-unknown-unknown` and the page is static files. The canonical `egui`
 //! frontend (ADR-0016) replaces this at M2.
 //!
-//! `arrange(mode, seed, offset, variation)` builds a fixed sample part A, runs
-//! [`arrange_complement_varied`], and writes `{ppqn, tempo, realized_spread,
-//! error, tracks:[A, B]}` into a thread-local buffer; JS reads it via
-//! `arrange()` (pointer) + `arrange_len()` (length).
+//! `arrange(mode, seed, offset, variation, track)` runs
+//! [`arrange_complement_varied`] over a part A — either the built-in sample
+//! (`track < 0`) or a track of a user-loaded score (`track >= 0`) — and writes
+//! `{ppqn, tempo, realized_spread, error, tracks:[A, B]}` into a thread-local
+//! buffer; JS reads it via the returned pointer + `arrange_len()`.
+//!
+//! File loading is import-free MIDI (the `gp` feature is off in the wasm build,
+//! per ADR-0024): JS writes the file bytes into `input_alloc(len)`, calls
+//! `load_score(len)` to parse + stash the [`Score`], and reads a track summary
+//! (`load_len()`); `arrange(.., track)` then arranges over the chosen track.
 
 use std::cell::RefCell;
 use std::fmt::Write as _;
@@ -19,6 +25,7 @@ use griff_core::complement::{
 };
 use griff_core::event::{NoteMarks, Pitch, Tempo, Ticks, TimeSignature, Tuning, Velocity};
 use griff_core::generate::GenerationSeed;
+use griff_core::import::import_score_auto;
 use griff_core::score::{
     AtomEvent, EventGroup, EventGroupKind, LossReport, MasterBar, RepeatMarker, Score, Track, Voice,
 };
@@ -140,21 +147,49 @@ fn json_escape(s: &str) -> String {
     s.replace('\\', "\\\\").replace('"', "\\\"")
 }
 
-/// Builds the result JSON for one arrangement request.
-fn build_json(mode: u32, seed: u64, offset: i32, variation: f32) -> String {
-    let score = sample_part_a();
+/// The four knobs behind one arrangement (mirror the UI controls).
+#[derive(Clone, Copy)]
+struct ArrangeParams {
+    mode: u32,
+    seed: u64,
+    offset: i32,
+    variation: f32,
+}
+
+/// Builds the result JSON for one arrangement request over
+/// `source.tracks[track_index]` as part A. The header `ppqn`/`tempo` are read
+/// off the source so a loaded score plays back at its own resolution.
+fn arrange_to_json(source: &Score, track_index: usize, params: ArrangeParams) -> String {
+    let ppqn = source.ticks_per_quarter;
+    let tempo = source.master_bars.first().map_or(TEMPO, |b| b.tempo.0);
+
+    let mut json = String::with_capacity(2048);
+    let _ = write!(json, "{{\"ppqn\":{ppqn},\"tempo\":{tempo},");
+
+    let part_a = match source.tracks.get(track_index) {
+        Some(t) => t,
+        None => {
+            json.push_str("\"realized_spread\":0,\"error\":\"track out of range\",\"tracks\":[]}");
+            return json;
+        }
+    };
+    let a_name = part_a.name.clone().unwrap_or_else(|| "A".to_string());
+
     let spec = ComplementSpec {
-        mode: relation_mode(mode),
-        register_offset: offset.clamp(-48, 48) as i8,
+        mode: relation_mode(params.mode),
+        register_offset: params.offset.clamp(-48, 48) as i8,
     };
     let control = VariationControl {
-        pitch_spread: f64::from(variation).clamp(0.0, 1.0),
+        pitch_spread: f64::from(params.variation).clamp(0.0, 1.0),
     };
 
-    let mut json = String::with_capacity(2048);
-    let _ = write!(json, "{{\"ppqn\":{PPQN},\"tempo\":{TEMPO},");
-
-    match arrange_complement_varied(&score, 0, spec, GenerationSeed(seed), control) {
+    match arrange_complement_varied(
+        source,
+        track_index,
+        spec,
+        GenerationSeed(params.seed),
+        control,
+    ) {
         Ok(varied) => {
             let combined = &varied.complement.score;
             let b_index = varied.complement.part_b_index;
@@ -168,8 +203,12 @@ fn build_json(mode: u32, seed: u64, offset: i32, variation: f32) -> String {
                 "\"realized_spread\":{:.3},\"error\":null,\"tracks\":[",
                 varied.realized_spread
             );
-            json.push_str("{\"name\":\"A\",\"role\":\"a\",\"notes\":");
-            push_notes(&mut json, &score.tracks[0]);
+            let _ = write!(
+                json,
+                "{{\"name\":\"{}\",\"role\":\"a\",\"notes\":",
+                json_escape(&a_name)
+            );
+            push_notes(&mut json, part_a);
             json.push('}');
             if let Some(b_track) = combined.tracks.get(b_index) {
                 let _ = write!(
@@ -184,13 +223,19 @@ fn build_json(mode: u32, seed: u64, offset: i32, variation: f32) -> String {
         }
         Err(e) => {
             // Surface the typed error; still return A so the page can draw it.
+            // Escape it: a Debug repr can carry quotes/backslashes that would
+            // otherwise break the JSON the browser parses.
+            let err = json_escape(&format!("{e:?}"));
             let _ = write!(
                 json,
-                "\"realized_spread\":0,\"error\":\"{:?}\",\"tracks\":[",
-                e
+                "\"realized_spread\":0,\"error\":\"{err}\",\"tracks\":["
             );
-            json.push_str("{\"name\":\"A\",\"role\":\"a\",\"notes\":");
-            push_notes(&mut json, &score.tracks[0]);
+            let _ = write!(
+                json,
+                "{{\"name\":\"{}\",\"role\":\"a\",\"notes\":",
+                json_escape(&a_name)
+            );
+            push_notes(&mut json, part_a);
             json.push_str("}]");
         }
     }
@@ -200,14 +245,32 @@ fn build_json(mode: u32, seed: u64, offset: i32, variation: f32) -> String {
 
 thread_local! {
     static OUT: RefCell<Vec<u8>> = const { RefCell::new(Vec::new()) };
+    static IN: RefCell<Vec<u8>> = const { RefCell::new(Vec::new()) };
+    static LOADED: RefCell<Option<Score>> = const { RefCell::new(None) };
 }
 
 /// Arranges a complement and stores the JSON result; returns a pointer into
 /// WASM linear memory. Read `arrange_len()` bytes from it (valid until the next
-/// `arrange` call).
+/// `arrange` call). Part A is the loaded score's `track` (when `track >= 0` and
+/// a score has been loaded), otherwise the built-in sample.
 #[no_mangle]
-pub extern "C" fn arrange(mode: u32, seed: u32, offset: i32, variation: f32) -> *const u8 {
-    let json = build_json(mode, u64::from(seed), offset, variation);
+pub extern "C" fn arrange(
+    mode: u32,
+    seed: u32,
+    offset: i32,
+    variation: f32,
+    track: i32,
+) -> *const u8 {
+    let params = ArrangeParams {
+        mode,
+        seed: u64::from(seed),
+        offset,
+        variation,
+    };
+    let json = LOADED.with(|l| match (l.borrow().as_ref(), usize::try_from(track)) {
+        (Some(score), Ok(ti)) => arrange_to_json(score, ti, params),
+        _ => arrange_to_json(&sample_part_a(), 0, params),
+    });
     OUT.with(|o| {
         *o.borrow_mut() = json.into_bytes();
         o.borrow().as_ptr()
@@ -220,14 +283,112 @@ pub extern "C" fn arrange_len() -> usize {
     OUT.with(|o| o.borrow().len())
 }
 
+/// Reserves `len` bytes of input buffer and returns a writable pointer into
+/// linear memory. JS copies the uploaded file's bytes here, then calls
+/// [`load_score`]. (Create the JS view *after* this call: memory may grow.)
+#[no_mangle]
+pub extern "C" fn input_alloc(len: usize) -> *mut u8 {
+    IN.with(|b| {
+        let mut b = b.borrow_mut();
+        b.clear();
+        b.resize(len, 0);
+        b.as_mut_ptr()
+    })
+}
+
+/// Parses the first `len` bytes of the input buffer (MIDI; Guitar Pro when the
+/// `gp` feature is on), stashes the [`Score`] for later [`arrange`] calls, and
+/// writes a JSON track summary into the output buffer. Returns a pointer to it;
+/// read [`load_len`] bytes. On failure, leaves any previously loaded score in
+/// place and writes `{"error":"…","tracks":[]}`.
+#[no_mangle]
+pub extern "C" fn load_score(len: usize) -> *const u8 {
+    let json = IN.with(|b| {
+        let bytes = b.borrow();
+        let end = len.min(bytes.len());
+        load_to_json(&bytes[..end])
+    });
+    OUT.with(|o| {
+        *o.borrow_mut() = json.into_bytes();
+        o.borrow().as_ptr()
+    })
+}
+
+/// Length in bytes of the JSON stored by the last [`load_score`] call.
+#[no_mangle]
+pub extern "C" fn load_len() -> usize {
+    OUT.with(|o| o.borrow().len())
+}
+
+/// Imports `data`, stores the score on success, and returns a JSON summary
+/// `{error, ppqn, tempo, bars, tracks:[{i,name,notes}]}`.
+fn load_to_json(data: &[u8]) -> String {
+    match import_score_auto(data) {
+        Ok(score) => {
+            let ppqn = score.ticks_per_quarter;
+            let tempo = score.master_bars.first().map_or(TEMPO, |b| b.tempo.0);
+            let mut json = String::with_capacity(512);
+            let _ = write!(
+                json,
+                "{{\"error\":null,\"ppqn\":{ppqn},\"tempo\":{tempo},\"bars\":{},\"tracks\":[",
+                score.master_bars.len()
+            );
+            for (i, t) in score.tracks.iter().enumerate() {
+                if i > 0 {
+                    json.push(',');
+                }
+                let name = t.name.clone().unwrap_or_else(|| format!("track {i}"));
+                let _ = write!(
+                    json,
+                    "{{\"i\":{i},\"name\":\"{}\",\"notes\":{}}}",
+                    json_escape(&name),
+                    note_count(t)
+                );
+            }
+            json.push_str("]}");
+            LOADED.with(|l| *l.borrow_mut() = Some(score));
+            json
+        }
+        Err(e) => {
+            let err = json_escape(&format!("{e}"));
+            format!("{{\"error\":\"{err}\",\"tracks\":[]}}")
+        }
+    }
+}
+
+/// Counts pitched notes in a track's primary voice (what the playground draws).
+fn note_count(track: &Track) -> usize {
+    track.voices.first().map_or(0, |v| {
+        v.event_groups
+            .iter()
+            .flat_map(|g| &g.atoms)
+            .filter(|a| matches!(a, AtomEvent::Note(_)))
+            .count()
+    })
+}
+
 #[cfg(test)]
 mod tests {
-    use super::build_json;
+    use super::{arrange_to_json, load_to_json, sample_part_a, ArrangeParams};
+
+    /// Arrange over the built-in sample (the old `build_json` behaviour).
+    fn sample_json(mode: u32, seed: u64, offset: i32, variation: f32) -> String {
+        arrange_to_json(
+            &sample_part_a(),
+            0,
+            ArrangeParams {
+                mode,
+                seed,
+                offset,
+                variation,
+            },
+        )
+    }
 
     #[test]
     fn every_mode_emits_part_a_and_well_formed_header() {
         for mode in 0..6 {
-            let j = build_json(mode, 5, 0, 1.0);
+            let j = sample_json(mode, 5, 0, 1.0);
             assert!(
                 j.starts_with("{\"ppqn\":480,\"tempo\":120"),
                 "mode {mode}: {j:.60}"
@@ -241,7 +402,7 @@ mod tests {
     #[test]
     fn counter_melody_succeeds_on_the_uniform_sample() {
         // mode 5 = counter_melody; the sample is uniform 4/4, so no NonUniformTimeline.
-        let j = build_json(5, 0, 0, 1.0);
+        let j = sample_json(5, 0, 0, 1.0);
         assert!(j.contains("\"error\":null"), "expected success: {j:.120}");
         assert!(j.contains("\"role\":\"b\""), "counter_melody emits part B");
     }
@@ -249,8 +410,8 @@ mod tests {
     #[test]
     fn pitch_spread_changes_rhythm_lock_output() {
         // mode 0 = rhythm_lock: the knob must move B's pitches.
-        let locked = build_json(0, 5, 0, 0.0);
-        let full = build_json(0, 5, 0, 1.0);
+        let locked = sample_json(0, 5, 0, 0.0);
+        let full = sample_json(0, 5, 0, 1.0);
         assert_ne!(
             locked, full,
             "pitch_spread must change a grid-locked complement"
@@ -259,6 +420,39 @@ mod tests {
 
     #[test]
     fn deterministic_for_identical_args() {
-        assert_eq!(build_json(5, 7, -12, 0.5), build_json(5, 7, -12, 0.5));
+        assert_eq!(sample_json(5, 7, -12, 0.5), sample_json(5, 7, -12, 0.5));
+    }
+
+    #[test]
+    fn load_rejects_non_midi_bytes() {
+        let j = load_to_json(b"definitely not a midi file");
+        assert!(j.contains("\"error\":\""), "expected an error: {j}");
+        assert!(!j.contains("\"error\":null"), "must not claim success");
+    }
+
+    #[test]
+    fn load_then_arrange_round_trips_a_midi_score() {
+        // Export the built-in sample to MIDI, re-import it through the public
+        // entry, and arrange over the imported track — the file-load path.
+        let bytes = griff_core::midi::export_score(&sample_part_a()).expect("export");
+        let summary = load_to_json(&bytes);
+        assert!(summary.contains("\"error\":null"), "import: {summary:.160}");
+        assert!(summary.contains("\"tracks\":["), "summary lists tracks");
+
+        let imported = griff_core::import::import_score_auto(&bytes).expect("reimport");
+        let j = arrange_to_json(
+            &imported,
+            0,
+            ArrangeParams {
+                mode: 5,
+                seed: 0,
+                offset: 0,
+                variation: 1.0,
+            },
+        );
+        assert!(
+            j.contains("\"role\":\"a\""),
+            "arranges the imported track: {j:.160}"
+        );
     }
 }
diff --git a/web/static/app.js b/web/static/app.js
index f2cf1a09..78fab27f 100644
--- a/web/static/app.js
+++ b/web/static/app.js
@@ -2,6 +2,7 @@
   'use strict';
   const $ = (id) => document.getElementById(id);
   const els = {
+    file: $('file'), track: $('track'),
     mode: $('mode'), seed: $('seed'), seedOut: $('seedOut'),
     offset: $('offset'), offsetOut: $('offsetOut'),
     variation: $('variation'), varOut: $('varOut'),
@@ -31,7 +32,8 @@
     const seed = +els.seed.value;
     const offset = +els.offset.value;
     const variation = (+els.variation.value) / 100;
-    const ptr = wasm.arrange(mode, seed, offset, variation);
+    const track = +els.track.value;
+    const ptr = wasm.arrange(mode, seed, offset, variation, track);
     const len = wasm.arrange_len();
     // Read AFTER the call: arrange() may have grown linear memory.
     const view = new Uint8Array(wasm.memory.buffer, ptr, len);
@@ -55,6 +57,50 @@
       ` · realized spread ${Number(current.realized_spread).toFixed(2)}`;
   }
 
+  // ---- file loading (import-free MIDI; see ADR-0024) ----
+  const escapeHtml = (s) => String(s).replace(/[&<>"]/g,
+    (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+
+  function loadFile(file) {
+    const reader = new FileReader();
+    reader.onload = () => {
+      try {
+        const bytes = new Uint8Array(reader.result);
+        const ptr = wasm.input_alloc(bytes.length);
+        // View AFTER input_alloc: reserving the buffer may have grown memory.
+        new Uint8Array(wasm.memory.buffer, ptr, bytes.length).set(bytes);
+        const rptr = wasm.load_score(bytes.length);
+        const view = new Uint8Array(wasm.memory.buffer, rptr, wasm.load_len());
+        const summary = JSON.parse(new TextDecoder('utf-8').decode(view));
+        if (summary.error) {
+          els.status.classList.add('error');
+          els.status.textContent = 'load failed: ' + summary.error;
+          return;
+        }
+        els.status.classList.remove('error');
+        populateTracks(summary);
+        arrange();
+      } catch (err) {
+        els.status.classList.add('error');
+        els.status.textContent = 'load failed: ' + err;
+      }
+    };
+    reader.readAsArrayBuffer(file);
+  }
+
+  function populateTracks(summary) {
+    const opts = ['<option value="-1">built-in sample</option>'];
+    let firstWithNotes = -1;
+    for (const t of summary.tracks) {
+      opts.push(`<option value="${t.i}">${escapeHtml(t.name)} · ${t.notes} notes</option>`);
+      if (firstWithNotes < 0 && t.notes > 0) firstWithNotes = t.i;
+    }
+    els.track.innerHTML = opts.join('');
+    els.track.value = String(firstWithNotes >= 0 ? firstWithNotes : -1);
+    els.status.textContent =
+      `loaded ${summary.tracks.length} track(s) · ${summary.bars} bars — pick a track, then ▶`;
+  }
+
   // ---- drawing ----
   function allNotes() {
     if (!current) return [];
@@ -179,6 +225,11 @@
       els.varOut.textContent = (els.variation.value / 100).toFixed(2); arrange();
     });
     els.mode.addEventListener('change', arrange);
+    els.track.addEventListener('change', arrange);
+    els.file.addEventListener('change', (e) => {
+      const f = e.target.files && e.target.files[0];
+      if (f) loadFile(f);
+    });
     els.gen.addEventListener('click', arrange);
     els.play.addEventListener('click', play);
     els.stop.addEventListener('click', stop);
diff --git a/web/static/index.html b/web/static/index.html
index 35e02bd5..2b9a2c36 100644
--- a/web/static/index.html
+++ b/web/static/index.html
@@ -11,11 +11,24 @@
   <main>
     <h1>griff <span class="muted">· complement playground</span></h1>
     <p class="muted small">
-      A fixed sample lead (part A) + a generated complement (part B), all in the
-      browser. Deterministic: same controls → same result. (ADR-0024, MVP)
+      Load your own MIDI tab (or use the built-in sample) as part A, and griff
+      generates a complement part B — all in the browser. Deterministic: same
+      controls → same result. (ADR-0024, MVP)
     </p>
 
     <section class="controls">
+      <label>
+        Load tab <span class="hint">MIDI (.mid) — Guitar Pro coming</span>
+        <input id="file" type="file" accept=".mid,.midi,audio/midi" />
+      </label>
+
+      <label>
+        Track
+        <select id="track">
+          <option value="-1">built-in sample</option>
+        </select>
+      </label>
+
       <label>
         Mode
         <select id="mode">
diff --git a/web/static/style.css b/web/static/style.css
index aa078c77..77b61a56 100644
--- a/web/static/style.css
+++ b/web/static/style.css
@@ -64,6 +64,16 @@ select {
 /* Big touch targets for phones. */
 input[type="range"] { height: 40px; }
 
+input[type="file"] {
+  width: 100%;
+  color: var(--ink);
+  background: #0d1017;
+  border: 1px solid #2a3146;
+  border-radius: 10px;
+  padding: 10px;
+  font-size: 0.9rem;
+}
+
 .transport {
   display: flex;
   gap: 10px;

From ca71f8652e87b1f2388a2bdf0c4a4c83a2a8e127 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 16 Jun 2026 20:51:16 +0000
Subject: [PATCH 2/6] feat(corpus): add RightsInfo (schema v7) and curate
 rights prompt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Capture per-chunk rights + provenance at curation time — the documented
precondition for mass curation (decisions 2026-06-12). Rights status is not
derivable from content, so backfilling a grown corpus would mean re-researching
provenance per source; the field must exist before the first curation session.

- ChunkMeta gains an optional rights: Option<RightsInfo> under the same
  serde(default, skip_serializing_if) pattern as the other versioned fields, so
  pre-v7 records round-trip byte-identically. SCHEMA_VERSION -> 7.
- RightsInfo = rights_status (public_domain / cc_by / cc_by_sa /
  copyrighted_composition / unknown), acquisition (community_tab_site /
  purchased_official / self_transcribed / omr_from_scan / artist_provided),
  redistributable: bool (a typed fact so novelty.rs and any future export gate
  filter without scanning prose), and a free-form notes string.
- griff curate prompts for the four fields; defaults match the common case
  (scraped community tab of a copyrighted composition, not redistributable).
- Tests: v7 round-trip, pre-v7 loads-as-None, enum round-trips, proptest
  coverage, and a curate integration test that drives the new prompt.
---
 cli/src/main.rs             |  55 +++++++++++++++-
 cli/tests/curate_cmd.rs     |  54 ++++++++++++++-
 core/src/corpus.rs          |  68 ++++++++++++++++++-
 core/tests/corpus_schema.rs | 128 ++++++++++++++++++++++++++++++++++--
 core/tests/similarity.rs    |   1 +
 preview/tests/curation.rs   |   1 +
 6 files changed, 296 insertions(+), 11 deletions(-)

diff --git a/cli/src/main.rs b/cli/src/main.rs
index f3fcd85a..8836bba1 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -11,8 +11,9 @@ use griff_core::{
     classify::{self, BarClass},
     complement,
     corpus::{
-        ChunkId, ChunkMeta, EnsembleGroup, EnsembleRef, PairRelation, QualityFlag,
-        ReviewerDecision, SourceFormat, SourceRef, StyleCohort, SwancoreTag,
+        Acquisition, ChunkId, ChunkMeta, EnsembleGroup, EnsembleRef, PairRelation, QualityFlag,
+        ReviewerDecision, RightsInfo, RightsStatus, SourceFormat, SourceRef, StyleCohort,
+        SwancoreTag,
     },
     event::{NoteMarks, NotePosition, Pitch, TechniqueSource, Ticks},
     generate, gesture,
@@ -907,6 +908,7 @@ fn build_chunk_meta(
         complexity,
         style_cohort: Some(inputs.style_cohort),
         ensemble,
+        rights: Some(inputs.rights.clone()),
         created_at: now.clone(),
         updated_at: now,
     }
@@ -950,6 +952,7 @@ struct CurateInputs {
     tags: Vec<SwancoreTag>,
     quality_flags: Vec<QualityFlag>,
     reviewer: Option<ReviewerDecision>,
+    rights: RightsInfo,
 }
 
 fn gather_curate_inputs(ensemble: bool) -> Result<CurateInputs, CliError> {
@@ -1011,6 +1014,8 @@ fn gather_curate_inputs(ensemble: bool) -> Result<CurateInputs, CliError> {
         _ => None,
     };
 
+    let rights = gather_rights(&mut input_buf)?;
+
     Ok(CurateInputs {
         id,
         title,
@@ -1019,6 +1024,52 @@ fn gather_curate_inputs(ensemble: bool) -> Result<CurateInputs, CliError> {
         tags,
         quality_flags,
         reviewer,
+        rights,
+    })
+}
+
+/// Prompts for the schema-v7 rights record (decisions 2026-06-12). Defaults
+/// match the common case — a scraped community tab of a copyrighted modern-metal
+/// composition, not redistributable — so a blank answer is the safe one.
+fn gather_rights(input_buf: &mut String) -> Result<RightsInfo, CliError> {
+    println!(
+        "Rights status: 0=public_domain  1=cc_by  2=cc_by_sa  \
+         3=copyrighted_composition  4=unknown"
+    );
+    let status_input = prompt_line(input_buf, "Rights [3=copyrighted_composition]")?;
+    let rights_status = match status_input.trim() {
+        "0" => RightsStatus::PublicDomain,
+        "1" => RightsStatus::CcBy,
+        "2" => RightsStatus::CcBySa,
+        "4" => RightsStatus::Unknown,
+        _ => RightsStatus::CopyrightedComposition,
+    };
+
+    println!(
+        "Acquisition: 0=community_tab_site  1=purchased_official  2=self_transcribed  \
+         3=omr_from_scan  4=artist_provided"
+    );
+    let acq_input = prompt_line(input_buf, "Acquisition [0=community_tab_site]")?;
+    let acquisition = match acq_input.trim() {
+        "1" => Acquisition::PurchasedOfficial,
+        "2" => Acquisition::SelfTranscribed,
+        "3" => Acquisition::OmrFromScan,
+        "4" => Acquisition::ArtistProvided,
+        _ => Acquisition::CommunityTabSite,
+    };
+
+    let redist_input = prompt_line(input_buf, "Redistributable? 0=no 1=yes [0=no]")?;
+    let redistributable = redist_input.trim() == "1";
+
+    let notes = prompt_line(input_buf, "Rights notes (source URL, date, publisher)")?
+        .trim()
+        .to_owned();
+
+    Ok(RightsInfo {
+        rights_status,
+        acquisition,
+        redistributable,
+        notes,
     })
 }
 
diff --git a/cli/tests/curate_cmd.rs b/cli/tests/curate_cmd.rs
index 863e1aa4..643520fb 100644
--- a/cli/tests/curate_cmd.rs
+++ b/cli/tests/curate_cmd.rs
@@ -19,7 +19,10 @@ use std::{
 
 use griff_core::{
     complement::measure_pair_axes,
-    corpus::{ChunkId, ChunkMeta, EnsembleGroup, EnsembleRef, StyleCohort},
+    corpus::{
+        Acquisition, ChunkId, ChunkMeta, EnsembleGroup, EnsembleRef, RightsInfo, RightsStatus,
+        StyleCohort,
+    },
     gesture, midi,
     score::AtomEvent,
     structure,
@@ -382,3 +385,52 @@ fn curate_records_complexity_of_the_first_note_bearing_track() {
         "curate persists the measured complexity profile"
     );
 }
+
+/// Schema v7: the rights prompt (after the reviewer decision) is recorded —
+/// status, acquisition, redistributable flag, and free-form notes.
+#[test]
+fn curate_records_rights() {
+    let fixture = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/simple_4_4.mid");
+    let out_path =
+        std::env::temp_dir().join(format!("griff_curate_v7_{}.chunk.json", std::process::id()));
+
+    let mut child = Command::new(griff_bin())
+        .arg("curate")
+        .arg(&fixture)
+        .arg("--output")
+        .arg(&out_path)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .expect("spawn griff curate");
+    child
+        .stdin
+        .as_mut()
+        .expect("piped stdin")
+        // id, title, tuning, cohort, tags, flags, decision (all blank/default),
+        // then rights: status 0=public_domain, acquisition 2=self_transcribed,
+        // redistributable 1=yes, notes.
+        .write_all(b"rt_001\nRights Chunk\n\n\n\n\n\n0\n2\n1\npdmx.example/score, 2026-06-16\n")
+        .expect("write curate answers");
+    let out = child.wait_with_output().expect("wait for curate");
+    assert!(
+        out.status.success(),
+        "curate must exit 0: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+
+    let json = std::fs::read_to_string(&out_path).expect("curate wrote the record");
+    let _cleanup = std::fs::remove_file(&out_path);
+    let meta: ChunkMeta = serde_json::from_str(&json).expect("record parses as ChunkMeta");
+
+    assert_eq!(
+        meta.rights,
+        Some(RightsInfo {
+            rights_status: RightsStatus::PublicDomain,
+            acquisition: Acquisition::SelfTranscribed,
+            redistributable: true,
+            notes: "pdmx.example/score, 2026-06-16".to_owned(),
+        })
+    );
+}
diff --git a/core/src/corpus.rs b/core/src/corpus.rs
index 2535cbd1..2a463e48 100644
--- a/core/src/corpus.rs
+++ b/core/src/corpus.rs
@@ -31,7 +31,12 @@ use crate::structure::{ComplexityProfile, StructureMetrics};
 /// - v6 — the per-axis complexity profile (S14): `ChunkMeta` gains optional
 ///   measured [`ComplexityProfile`] under the same pattern; pre-v6 records
 ///   load it as `None` and re-serialize losslessly.
-pub const SCHEMA_VERSION: u32 = 6;
+/// - v7 — per-chunk rights + provenance (decisions 2026-06-12): `ChunkMeta`
+///   gains optional [`RightsInfo`] under the same pattern; pre-v7 records (no
+///   `rights` key) keep loading and re-serialize losslessly. Rights status is
+///   not derivable from content, so it is captured at curation time and cannot
+///   be backfilled.
+pub const SCHEMA_VERSION: u32 = 7;
 
 // ── identifiers ───────────────────────────────────────────────────────────────
 
@@ -243,6 +248,62 @@ pub struct EnsembleGroup {
     pub relations: Vec<PairRelation>,
 }
 
+// ── rights and provenance (schema v7) ─────────────────────────────────────────
+
+/// Rights status of a chunk's underlying material (decisions 2026-06-12).
+///
+/// Not an OSS licence — this records the *composition* rights status, paired
+/// with [`Acquisition`] provenance. Most scraped, purchased, or self-transcribed
+/// modern-metal tabs are `CopyrightedComposition`; only public-domain sources
+/// (e.g. PDMX `MusicXML`) are freely redistributable.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RightsStatus {
+    /// Public-domain composition (e.g. PDMX `MusicXML`).
+    PublicDomain,
+    /// Creative Commons Attribution.
+    CcBy,
+    /// Creative Commons Attribution-ShareAlike.
+    CcBySa,
+    /// Composition under copyright (the common case for modern-metal tabs).
+    CopyrightedComposition,
+    /// Rights status not yet determined.
+    Unknown,
+}
+
+/// How a chunk's source file was acquired (decisions 2026-06-12).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Acquisition {
+    /// Scraped from a community tab site (Ultimate Guitar, Songsterr, …).
+    CommunityTabSite,
+    /// Purchased from an official publisher (e.g. Sheet Happens GP).
+    PurchasedOfficial,
+    /// Transcribed by the curator (own transcription does not transfer the
+    /// underlying composition rights).
+    SelfTranscribed,
+    /// Optical music recognition from a scan.
+    OmrFromScan,
+    /// Provided directly by the artist.
+    ArtistProvided,
+}
+
+/// Per-chunk rights and provenance (schema v7, decisions 2026-06-12).
+///
+/// `redistributable` is a typed fact — not a freeform note — because
+/// `novelty.rs` and any future export gate must filter on it without scanning
+/// prose. Captured at curation time: rights status cannot be derived from the
+/// notes, so backfilling would mean re-researching provenance per source.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct RightsInfo {
+    pub rights_status: RightsStatus,
+    pub acquisition: Acquisition,
+    /// Whether the chunk's source material may be redistributed.
+    pub redistributable: bool,
+    /// Free-form provenance note (source URL, acquisition date, publisher).
+    pub notes: String,
+}
+
 // ── chunk metadata ────────────────────────────────────────────────────────────
 
 /// Full annotation for one corpus chunk.
@@ -292,6 +353,11 @@ pub struct ChunkMeta {
     /// the key is skipped when unset.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub ensemble: Option<EnsembleRef>,
+    /// Rights and provenance (schema v7, decisions 2026-06-12). Absent in pre-v7
+    /// records — the key is skipped when unset, so older files round-trip
+    /// byte-identically. Captured at curation time; cannot be backfilled.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rights: Option<RightsInfo>,
     /// ISO 8601 creation timestamp.
     pub created_at: String,
     /// ISO 8601 last-modified timestamp.
diff --git a/core/tests/corpus_schema.rs b/core/tests/corpus_schema.rs
index 20692720..5cf6def3 100644
--- a/core/tests/corpus_schema.rs
+++ b/core/tests/corpus_schema.rs
@@ -9,9 +9,9 @@
 
 use griff_core::complement::AxisScores;
 use griff_core::corpus::{
-    BoundaryEntry, ChunkId, ChunkMeta, CorpusManifest, EnsembleGroup, EnsembleRef, PairRelation,
-    QualityFlag, ReviewerDecision, SourceFormat, SourceRef, StyleCohort, SwancoreTag,
-    SCHEMA_VERSION,
+    Acquisition, BoundaryEntry, ChunkId, ChunkMeta, CorpusManifest, EnsembleGroup, EnsembleRef,
+    PairRelation, QualityFlag, ReviewerDecision, RightsInfo, RightsStatus, SourceFormat, SourceRef,
+    StyleCohort, SwancoreTag, SCHEMA_VERSION,
 };
 use griff_core::gesture::GestureStats;
 use griff_core::structure::{ComplexityProfile, StructureMetrics};
@@ -87,21 +87,100 @@ fn minimal_chunk() -> ChunkMeta {
         complexity: None,
         style_cohort: None,
         ensemble: None,
+        rights: None,
         created_at: "2026-05-20T00:00:00Z".to_owned(),
         updated_at: "2026-05-20T00:00:00Z".to_owned(),
     }
 }
 
-// ── schema v6: the per-axis complexity profile (S14) ──────────────────────────
+// ── schema v7: rights + provenance (decisions 2026-06-12) ─────────────────────
 
 #[test]
-fn schema_version_is_6() {
+fn schema_version_is_7() {
     assert_eq!(
-        SCHEMA_VERSION, 6,
-        "the complexity profile bumps the corpus schema"
+        SCHEMA_VERSION, 7,
+        "the rights record bumps the corpus schema"
+    );
+}
+
+/// A representative rights record (the common scraped-community-tab case).
+fn sample_rights() -> RightsInfo {
+    RightsInfo {
+        rights_status: RightsStatus::CopyrightedComposition,
+        acquisition: Acquisition::CommunityTabSite,
+        redistributable: false,
+        notes: "ultimate-guitar.com, 2026-06-12".to_owned(),
+    }
+}
+
+#[test]
+fn chunk_meta_with_rights_roundtrips() {
+    let mut meta = minimal_chunk();
+    meta.rights = Some(sample_rights());
+
+    let json = serde_json::to_string(&meta).expect("serialize");
+    assert!(
+        json.contains("\"rights\""),
+        "v7 records carry the rights key"
+    );
+    assert!(
+        json.contains("\"copyrighted_composition\"") && json.contains("\"community_tab_site\""),
+        "rights enums serialize snake_case: {json}"
+    );
+    let back: ChunkMeta = serde_json::from_str(&json).expect("deserialize");
+    assert_eq!(back.rights, Some(sample_rights()));
+    let json2 = serde_json::to_string(&back).expect("re-serialize");
+    assert_eq!(json, json2, "JSON round-trip must be byte-identical");
+}
+
+#[test]
+fn pre_v7_record_without_rights_loads_as_none() {
+    // A pre-v7 record has no rights key; it parses as None and re-serializes
+    // without inventing the key.
+    let old_json = serde_json::to_string(&minimal_chunk()).expect("serialize");
+    assert!(
+        !old_json.contains("\"rights\""),
+        "an absent rights record must not introduce a key: {old_json}"
     );
+
+    let back: ChunkMeta = serde_json::from_str(&old_json).expect("pre-v7 record must parse");
+    assert!(back.rights.is_none());
+    let json2 = serde_json::to_string(&back).expect("re-serialize");
+    assert_eq!(old_json, json2, "JSON round-trip must be byte-identical");
+}
+
+#[test]
+fn all_rights_statuses_roundtrip() {
+    for status in [
+        RightsStatus::PublicDomain,
+        RightsStatus::CcBy,
+        RightsStatus::CcBySa,
+        RightsStatus::CopyrightedComposition,
+        RightsStatus::Unknown,
+    ] {
+        let json = serde_json::to_string(&status).expect("serialize");
+        let back: RightsStatus = serde_json::from_str(&json).expect("deserialize");
+        assert_eq!(status, back);
+    }
 }
 
+#[test]
+fn all_acquisitions_roundtrip() {
+    for acq in [
+        Acquisition::CommunityTabSite,
+        Acquisition::PurchasedOfficial,
+        Acquisition::SelfTranscribed,
+        Acquisition::OmrFromScan,
+        Acquisition::ArtistProvided,
+    ] {
+        let json = serde_json::to_string(&acq).expect("serialize");
+        let back: Acquisition = serde_json::from_str(&json).expect("deserialize");
+        assert_eq!(acq, back);
+    }
+}
+
+// ── schema v6: the per-axis complexity profile (S14) ──────────────────────────
+
 #[test]
 fn chunk_meta_with_complexity_roundtrips() {
     let mut meta = minimal_chunk();
@@ -620,6 +699,39 @@ fn arb_ensemble() -> impl Strategy<Value = Option<EnsembleRef>> {
     prop_opt(link)
 }
 
+fn arb_rights() -> impl Strategy<Value = Option<RightsInfo>> {
+    let status = prop_oneof![
+        Just(RightsStatus::PublicDomain),
+        Just(RightsStatus::CcBy),
+        Just(RightsStatus::CcBySa),
+        Just(RightsStatus::CopyrightedComposition),
+        Just(RightsStatus::Unknown),
+    ];
+    let acquisition = prop_oneof![
+        Just(Acquisition::CommunityTabSite),
+        Just(Acquisition::PurchasedOfficial),
+        Just(Acquisition::SelfTranscribed),
+        Just(Acquisition::OmrFromScan),
+        Just(Acquisition::ArtistProvided),
+    ];
+    // ASCII notes (no quotes/backslashes) keep the JSON round-trip byte-identical.
+    let info = (
+        status,
+        acquisition,
+        any::<bool>(),
+        "[A-Za-z0-9 :/._-]{0,40}",
+    )
+        .prop_map(
+            |(rights_status, acquisition, redistributable, notes)| RightsInfo {
+                rights_status,
+                acquisition,
+                redistributable,
+                notes,
+            },
+        );
+    prop_opt(info)
+}
+
 proptest! {
     #[test]
     fn prop_chunk_meta_json_roundtrip(
@@ -640,6 +752,7 @@ proptest! {
         complexity in arb_complexity(),
         style_cohort in arb_cohort(),
         ensemble in arb_ensemble(),
+        rights in arb_rights(),
     ) {
         let meta = ChunkMeta {
             id: ChunkId(id),
@@ -663,6 +776,7 @@ proptest! {
             complexity,
             style_cohort,
             ensemble,
+            rights,
             created_at: "2026-05-20T00:00:00Z".to_owned(),
             updated_at: "2026-05-20T00:00:00Z".to_owned(),
         };
diff --git a/core/tests/similarity.rs b/core/tests/similarity.rs
index b1699a27..8c600d45 100644
--- a/core/tests/similarity.rs
+++ b/core/tests/similarity.rs
@@ -146,6 +146,7 @@ fn chunk(
         complexity,
         style_cohort: None,
         ensemble: None,
+        rights: None,
         created_at: "2026-06-10T00:00:00Z".to_owned(),
         updated_at: "2026-06-10T00:00:00Z".to_owned(),
     }
diff --git a/preview/tests/curation.rs b/preview/tests/curation.rs
index 1e151699..b00c7f5c 100644
--- a/preview/tests/curation.rs
+++ b/preview/tests/curation.rs
@@ -42,6 +42,7 @@ fn record() -> ChunkMeta {
         complexity: None,
         style_cohort: None,
         ensemble: None,
+        rights: None,
         created_at: "2026-06-11T00:00:00Z".to_owned(),
         updated_at: "2026-06-11T00:00:00Z".to_owned(),
     }

From 6a3f7bb77624dcddd19ee76cc524cc3bd435493f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 16 Jun 2026 20:59:44 +0000
Subject: [PATCH 3/6] feat(cli): persist phrase boundaries in curate and add
 `griff manifest`

Close the two remaining corpus-tooling gaps before mass curation.

- curate now persists the measured track's detected phrase boundaries (S4)
  instead of hardcoding an empty list, scaling the detector's tick gaps to the
  source PPQN exactly as `griff phrases` does.
- New `griff manifest <dir>` builds a CorpusManifest from a directory of
  curated *.chunk.json / *.group.json records and prints a coverage summary:
  count toward the S7 ~100-phrase gate, cohort mix, rights coverage, and review
  status; writes <dir>/manifest.json.
- Tests: curate persists the detector's boundaries (two_phrases fixture), and
  manifest assembles both curated chunks at the current schema version.
---
 cli/src/main.rs         | 122 ++++++++++++++++++++++++++++++++--
 cli/tests/curate_cmd.rs | 141 +++++++++++++++++++++++++++++++++++++++-
 2 files changed, 257 insertions(+), 6 deletions(-)

diff --git a/cli/src/main.rs b/cli/src/main.rs
index 8836bba1..d2870afb 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -11,9 +11,9 @@ use griff_core::{
     classify::{self, BarClass},
     complement,
     corpus::{
-        Acquisition, ChunkId, ChunkMeta, EnsembleGroup, EnsembleRef, PairRelation, QualityFlag,
-        ReviewerDecision, RightsInfo, RightsStatus, SourceFormat, SourceRef, StyleCohort,
-        SwancoreTag,
+        Acquisition, BoundaryEntry, ChunkId, ChunkMeta, CorpusManifest, EnsembleGroup, EnsembleRef,
+        PairRelation, QualityFlag, ReviewerDecision, RightsInfo, RightsStatus, SourceFormat,
+        SourceRef, StyleCohort, SwancoreTag, SCHEMA_VERSION,
     },
     event::{NoteMarks, NotePosition, Pitch, TechniqueSource, Ticks},
     generate, gesture,
@@ -140,6 +140,18 @@ enum Command {
         #[arg(long)]
         ensemble: bool,
     },
+
+    /// Build a corpus manifest from a directory of curated `*.chunk.json` /
+    /// `*.group.json` records and print a coverage summary (count toward the
+    /// S7 ~100-phrase gate, cohort mix, rights, and review status).
+    Manifest {
+        /// Directory holding the curated chunk and group JSON records.
+        #[arg(value_name = "DIR")]
+        dir: PathBuf,
+        /// Output path for the manifest JSON (default: `<dir>/manifest.json`).
+        #[arg(short, long, value_name = "OUTPUT")]
+        output: Option<PathBuf>,
+    },
 }
 
 fn run() -> Result<(), CliError> {
@@ -169,6 +181,7 @@ fn run() -> Result<(), CliError> {
             output,
             ensemble,
         } => cmd_curate(&path, output.as_deref(), ensemble),
+        Command::Manifest { dir, output } => cmd_manifest(&dir, output.as_deref()),
     }
 }
 
@@ -855,6 +868,26 @@ fn source_format(score: &Score) -> SourceFormat {
     }
 }
 
+/// Detects phrase boundaries (S4) for `track_index`, scaling the detector's
+/// tick gaps to the score's PPQN exactly as `griff phrases` does, and maps them
+/// to corpus [`BoundaryEntry`] records.
+fn detect_boundaries(score: &Score, track_index: usize) -> Vec<BoundaryEntry> {
+    let ppqn = u32::from(score.ticks_per_quarter);
+    let config = boundary::BoundaryConfig {
+        min_gap: Ticks(ppqn.saturating_mul(2)),
+        quantize_ticks: Ticks(ppqn.checked_div(4).unwrap_or(1).max(1)),
+        ..boundary::BoundaryConfig::default()
+    };
+    boundary::detect_phrase_boundaries(score, track_index, &config)
+        .into_iter()
+        .map(|b| BoundaryEntry {
+            start_tick: b.start_tick.0,
+            end_tick: b.end_tick.0,
+            score: b.score,
+        })
+        .collect()
+}
+
 /// Measures `track_index` (when present) and assembles one chunk record.
 #[allow(clippy::too_many_arguments)] // a private assembly seam shared by both curate modes
 fn build_chunk_meta(
@@ -884,6 +917,7 @@ fn build_chunk_meta(
     let structure = track_index.and_then(|idx| structure::measure_structure(score, idx).ok());
     let gesture = track_index.and_then(|idx| gesture::measure_gesture(score, idx).ok());
     let complexity = track_index.and_then(|idx| structure::measure_complexity(score, idx).ok());
+    let boundaries = track_index.map_or_else(Vec::new, |idx| detect_boundaries(score, idx));
 
     let now = "2026-05-20T00:00:00Z".to_owned();
     ChunkMeta {
@@ -899,7 +933,7 @@ fn build_chunk_meta(
         time_signature,
         tuning: inputs.tuning.clone(),
         tags: inputs.tags.clone(),
-        boundaries: Vec::new(),
+        boundaries,
         techniques: Vec::new(),
         quality_flags: inputs.quality_flags.clone(),
         reviewer: inputs.reviewer,
@@ -944,6 +978,86 @@ fn write_output(path: &Path, json: &str) -> Result<(), CliError> {
     Ok(())
 }
 
+/// Builds a [`CorpusManifest`] from a directory of curated records, prints a
+/// coverage summary, and writes the manifest. Globs `*.chunk.json` into chunks
+/// and `*.group.json` into groups (both sorted, so the manifest is
+/// deterministic regardless of directory order).
+fn cmd_manifest(dir: &Path, output: Option<&Path>) -> Result<(), CliError> {
+    let mut chunk_paths: Vec<PathBuf> = Vec::new();
+    let mut group_paths: Vec<PathBuf> = Vec::new();
+    for entry in fs::read_dir(dir)? {
+        let path = entry?.path();
+        let Some(name) = path.file_name().and_then(|n| n.to_str()) else {
+            continue;
+        };
+        if name.ends_with(".group.json") {
+            group_paths.push(path);
+        } else if name.ends_with(".chunk.json") {
+            chunk_paths.push(path);
+        }
+    }
+    chunk_paths.sort();
+    group_paths.sort();
+
+    let mut chunks = Vec::with_capacity(chunk_paths.len());
+    for path in &chunk_paths {
+        let json = fs::read_to_string(path)?;
+        chunks.push(serde_json::from_str::<ChunkMeta>(&json).map_err(CliError::Json)?);
+    }
+    let mut groups = Vec::with_capacity(group_paths.len());
+    for path in &group_paths {
+        let json = fs::read_to_string(path)?;
+        groups.push(serde_json::from_str::<EnsembleGroup>(&json).map_err(CliError::Json)?);
+    }
+
+    let manifest = CorpusManifest {
+        schema_version: SCHEMA_VERSION,
+        chunks,
+        groups,
+    };
+    print_manifest_summary(&manifest);
+
+    let out_path = output.map_or_else(|| dir.join("manifest.json"), PathBuf::from);
+    let json = serde_json::to_string_pretty(&manifest).map_err(CliError::Json)?;
+    write_output(&out_path, &json)
+}
+
+/// Prints corpus coverage: progress toward the S7 ~100-phrase gate, cohort mix
+/// (decisions 2026-06-11 targets ~70-80% core), rights coverage, and reviews.
+fn print_manifest_summary(manifest: &CorpusManifest) {
+    let chunks = &manifest.chunks;
+    let n = chunks.len();
+    let core = chunks
+        .iter()
+        .filter(|c| c.style_cohort == Some(StyleCohort::Core))
+        .count();
+    let adjacent = chunks
+        .iter()
+        .filter(|c| c.style_cohort == Some(StyleCohort::Adjacent))
+        .count();
+    let accepted = chunks
+        .iter()
+        .filter(|c| c.reviewer == Some(ReviewerDecision::Accepted))
+        .count();
+    let with_rights = chunks.iter().filter(|c| c.rights.is_some()).count();
+    let redistributable = chunks
+        .iter()
+        .filter(|c| c.rights.as_ref().is_some_and(|r| r.redistributable))
+        .count();
+
+    println!("Corpus manifest (schema v{})", manifest.schema_version);
+    println!("Chunks : {n}  (S7 graph layer recommended at ~100)");
+    println!(
+        "Cohort : {core} core / {adjacent} adjacent / {} unlabeled",
+        n.saturating_sub(core).saturating_sub(adjacent)
+    );
+    println!("Review : {accepted}/{n} accepted");
+    println!("Rights : {with_rights}/{n} recorded · {redistributable} redistributable");
+    if !manifest.groups.is_empty() {
+        println!("Groups : {}", manifest.groups.len());
+    }
+}
+
 struct CurateInputs {
     id: String,
     title: String,
diff --git a/cli/tests/curate_cmd.rs b/cli/tests/curate_cmd.rs
index 643520fb..fc945779 100644
--- a/cli/tests/curate_cmd.rs
+++ b/cli/tests/curate_cmd.rs
@@ -18,11 +18,13 @@ use std::{
 };
 
 use griff_core::{
+    boundary,
     complement::measure_pair_axes,
     corpus::{
-        Acquisition, ChunkId, ChunkMeta, EnsembleGroup, EnsembleRef, RightsInfo, RightsStatus,
-        StyleCohort,
+        Acquisition, ChunkId, ChunkMeta, CorpusManifest, EnsembleGroup, EnsembleRef, RightsInfo,
+        RightsStatus, StyleCohort, SCHEMA_VERSION,
     },
+    event::Ticks,
     gesture, midi,
     score::AtomEvent,
     structure,
@@ -434,3 +436,138 @@ fn curate_records_rights() {
         })
     );
 }
+
+/// S4 wiring: curate persists the measured track's detected phrase boundaries
+/// (no longer hardcoded empty), matching what the detector reports.
+#[test]
+fn curate_records_phrase_boundaries() {
+    // two_phrases has detectable boundaries (unlike the single-phrase fixtures).
+    let fixture = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/two_phrases.mid");
+    let out_path = std::env::temp_dir().join(format!(
+        "griff_curate_bnd_{}.chunk.json",
+        std::process::id()
+    ));
+
+    let mut child = Command::new(griff_bin())
+        .arg("curate")
+        .arg(&fixture)
+        .arg("--output")
+        .arg(&out_path)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .expect("spawn griff curate");
+    child
+        .stdin
+        .as_mut()
+        .expect("piped stdin")
+        .write_all(b"bnd_001\nBoundaries\n\n\n\n\n\n")
+        .expect("write curate answers");
+    let out = child.wait_with_output().expect("wait for curate");
+    assert!(
+        out.status.success(),
+        "curate must exit 0: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+
+    let json = std::fs::read_to_string(&out_path).expect("curate wrote the record");
+    let _cleanup = std::fs::remove_file(&out_path);
+    let meta: ChunkMeta = serde_json::from_str(&json).expect("record parses as ChunkMeta");
+
+    // Recompute with the same PPQN-scaled config the curate path applies.
+    let bytes = std::fs::read(&fixture).expect("fixture bytes");
+    let score = midi::import_score(&bytes).expect("fixture imports");
+    let track = score
+        .tracks
+        .iter()
+        .position(|t| {
+            t.voices
+                .iter()
+                .flat_map(|v| &v.event_groups)
+                .flat_map(|g| &g.atoms)
+                .any(|a| matches!(a, AtomEvent::Note(_)))
+        })
+        .expect("fixture has a note-bearing track");
+    let ppqn = u32::from(score.ticks_per_quarter);
+    let config = boundary::BoundaryConfig {
+        min_gap: Ticks(ppqn.saturating_mul(2)),
+        quantize_ticks: Ticks(ppqn.checked_div(4).unwrap_or(1).max(1)),
+        ..Default::default()
+    };
+    let expected: Vec<(u32, u32)> = boundary::detect_phrase_boundaries(&score, track, &config)
+        .into_iter()
+        .map(|b| (b.start_tick.0, b.end_tick.0))
+        .collect();
+    let got: Vec<(u32, u32)> = meta
+        .boundaries
+        .iter()
+        .map(|b| (b.start_tick, b.end_tick))
+        .collect();
+
+    assert!(
+        !got.is_empty(),
+        "two_phrases fixture has detectable boundaries"
+    );
+    assert_eq!(got, expected, "curate persists the detector's boundaries");
+}
+
+/// `griff manifest` assembles a `CorpusManifest` from a directory of curated
+/// chunk records at the current schema version.
+#[test]
+fn manifest_builds_from_curated_chunks() {
+    let fixture = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/two_phrases.mid");
+    let dir = std::env::temp_dir().join(format!("griff_manifest_{}", std::process::id()));
+    std::fs::create_dir_all(&dir).expect("create corpus dir");
+
+    for id in ["m_001", "m_002"] {
+        let mut child = Command::new(griff_bin())
+            .arg("curate")
+            .arg(&fixture)
+            .arg("--output")
+            .arg(dir.join(format!("{id}.chunk.json")))
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .expect("spawn curate");
+        child
+            .stdin
+            .as_mut()
+            .expect("piped stdin")
+            .write_all(format!("{id}\nChunk {id}\n\n\n\n\n\n").as_bytes())
+            .expect("write curate answers");
+        assert!(
+            child
+                .wait_with_output()
+                .expect("wait for curate")
+                .status
+                .success(),
+            "curate must exit 0"
+        );
+    }
+
+    let out = Command::new(griff_bin())
+        .arg("manifest")
+        .arg(&dir)
+        .output()
+        .expect("run griff manifest");
+    assert!(
+        out.status.success(),
+        "manifest must exit 0: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+
+    let manifest_json =
+        std::fs::read_to_string(dir.join("manifest.json")).expect("manifest was written");
+    let _cleanup = std::fs::remove_dir_all(&dir);
+    let manifest: CorpusManifest =
+        serde_json::from_str(&manifest_json).expect("manifest parses as CorpusManifest");
+
+    assert_eq!(manifest.schema_version, SCHEMA_VERSION);
+    assert_eq!(
+        manifest.chunks.len(),
+        2,
+        "both curated chunks land in the manifest"
+    );
+}

From a93662fa51afb6bb4d5726dc52e01e33e02fb80b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 17 Jun 2026 09:57:27 +0000
Subject: [PATCH 4/6] feat(web): load Guitar Pro tabs in the browser via
 wasm-bindgen (ADR-0025)

The corpus is swancore-first and swancore tabs are overwhelmingly Guitar Pro,
so phone-side curation needs GP loading in the browser. The Rust GP reader
(guitarpro -> zip -> time/getrandom) pulls wasm-bindgen with no lean shortcut
(a custom getrandom backend fails to compile on wasm32 in getrandom 0.4.2, and
time pulls js-sys regardless), so ADR-0025 supersedes ADR-0024's import-free
cdylib for the web front.

- web build enables `gp`: MIDI and Guitar Pro (.gp3/.gp4/.gp5/.gpx) both import
  through the shared import_score_auto -- the same parser as the CLI.
- exports become two #[wasm_bindgen] functions returning JSON strings
  (arrange, load_score(bytes)); the manual linear-memory marshalling and the
  C-ABI alloc/len shims are gone. The page loads the generated ES module.
- getrandom uses its wasm_js backend (--cfg getrandom_backend="wasm_js");
  build.sh runs wasm-bindgen --target web; wasm-bindgen-cli is pinned to the
  crate version and installed + cached in CI.
- payload grows ~90 KiB -> ~830 KiB (accepted); the lean MIDI-only path still
  exists behind default-features = false.
- docs: ADR-0025 + decisions.log entry + web/README; a host test proves the GP
  path is wired (a GP seed routes to the GP reader, not the MIDI fallback).
---
 .github/workflows/web.yml                     |  14 +
 ...uitar-pro-in-browser-needs-wasm-bindgen.md |  73 +++
 docs/adr/README.md                            |   3 +-
 docs/decisions.log.md                         |  21 +
 web/Cargo.toml                                |  13 +-
 web/README.md                                 |  61 +--
 web/build.sh                                  |  23 +-
 web/src/lib.rs                                | 122 ++---
 web/static/app.js                             | 445 +++++++++---------
 web/static/index.html                         |  12 +-
 10 files changed, 436 insertions(+), 351 deletions(-)
 create mode 100644 docs/adr/0025-guitar-pro-in-browser-needs-wasm-bindgen.md

diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 7d2320b5..24958367 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -34,6 +34,20 @@ jobs:
             ~/.cargo/git
             web/target
           key: web-wasm-${{ hashFiles('web/Cargo.toml', 'core/Cargo.toml') }}
+      # GP support needs wasm-bindgen (ADR-0025); the CLI must match the crate
+      # version pinned in web/Cargo.toml. Cache the built binary across runs.
+      - name: Cache wasm-bindgen-cli
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/wasm-bindgen
+          key: wasm-bindgen-cli-${{ hashFiles('web/Cargo.toml') }}
+      - name: Install wasm-bindgen-cli
+        run: |
+          if command -v wasm-bindgen >/dev/null; then
+            echo "cached: $(wasm-bindgen --version)"; exit 0
+          fi
+          ver=$(grep -m1 'wasm-bindgen = ' web/Cargo.toml | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+          cargo install wasm-bindgen-cli --version "$ver" --locked
       - name: Build playground
         run: ./web/build.sh
       - uses: actions/upload-pages-artifact@v3
diff --git a/docs/adr/0025-guitar-pro-in-browser-needs-wasm-bindgen.md b/docs/adr/0025-guitar-pro-in-browser-needs-wasm-bindgen.md
new file mode 100644
index 00000000..58a2cc2e
--- /dev/null
+++ b/docs/adr/0025-guitar-pro-in-browser-needs-wasm-bindgen.md
@@ -0,0 +1,73 @@
+# ADR 0025: Guitar Pro in the browser needs wasm-bindgen (supersede ADR-0024's import-free web build)
+
+Date: 2026-06-17
+Status: Accepted
+
+Supersedes ADR-0024 §2–§3 and §6 (the import-free `cdylib`, the `gp`-off wasm
+build, and the no-`wasm-bindgen` toolchain). ADR-0024's other decisions — egui as
+the M2 canonical web frontend, WebAudio, determinism — stand.
+
+## Context
+
+ADR-0024 shipped the M1 web playground as an *import-free* `cdylib`: `griff-core`
+built with `default-features = false` (GP off), exporting C-ABI functions, loaded
+with `WebAssembly.instantiate(bytes, {})` — no `wasm-bindgen`, ~90 KiB. That kept
+the build trivial but made the browser **MIDI-only**.
+
+The corpus is swancore-first (ADR-0005), and swancore tabs are overwhelmingly
+**Guitar Pro**, not MIDI. Phone-side curation — the reason the web front exists —
+is dead without GP loading: the maintainer works from a phone and cannot feed the
+corpus real material there. Loading GP in the browser is the unblocker.
+
+The Rust GP reader is not import-free-compatible. `guitarpro` → `zip` (a
+non-optional dependency; `.gpx` is a zip container) → `time` → `js-sys` →
+`wasm-bindgen`, and `zip` → `getrandom`, whose wasm support also routes through
+`wasm-bindgen`. A `getrandom` *custom* backend (to dodge that) fails to compile on
+`wasm32-unknown-unknown` in getrandom 0.4.2 (a `WEB_CRYPTO` bug), and `time` pulls
+`wasm-bindgen` independently regardless. There is no lean shortcut: GP through the
+shared Rust parser requires the `wasm-bindgen` toolchain.
+
+The alternative — parse GP in JavaScript (e.g. alphaTab) and feed notes to the
+wasm — was rejected: it forks parsing out of `griff-core`, so the browser and the
+CLI would disagree on coverage and bugs, and it adds a heavy JS dependency.
+
+## Decision
+
+1. **The web build uses `wasm-bindgen`** (`--target web`), not the import-free
+   `cdylib`. `griff-web` exports two `#[wasm_bindgen]` functions returning JSON
+   strings (`arrange`, `load_score(bytes)`); the manual linear-memory marshalling
+   is gone. The page loads the generated ES module (`<script type="module">`).
+
+2. **The wasm build enables `gp`** (default features on `griff-core`) so Guitar
+   Pro (`.gp3/.gp4/.gp5/.gpx`) and MIDI both import through the shared
+   `import_score_auto` — the *same* parser as the CLI, so behaviour matches.
+
+3. **`getrandom` uses its `wasm_js` backend** (Web Crypto), enabled by the
+   `wasm_js` feature plus `--cfg getrandom_backend="wasm_js"` in `RUSTFLAGS`
+   (set in `build.sh`).
+
+4. **`wasm-bindgen-cli` is pinned to the `wasm-bindgen` crate version**
+   (`= 0.2.x` in `web/Cargo.toml`); `build.sh` and CI derive and install that
+   exact version, and CI caches the built CLI.
+
+## Consequences
+
+- GP tabs load in the browser, parsed by the same Rust code as the CLI. Phone
+  curation is unblocked.
+- The web build is no longer import-free or lean: the payload grows from ~90 KiB
+  to ~830 KiB (gp + zip + wasm-bindgen), and the toolchain now needs
+  `wasm-bindgen-cli` (version-matched). Accepted — GP support is worth it.
+- `griff-core`'s `gp` feature gate is unchanged; the lean MIDI-only wasm path
+  still exists (`default-features = false`), it is just not what the playground
+  ships.
+- Determinism (SPEC §6) is unaffected: `getrandom` is present only transitively
+  (zip never consumes randomness on the read path); the engine's seeded PRNG is
+  untouched.
+- ADR-0024's M2 plan stands: the egui/eframe frontend remains canonical and
+  replaces this playground; this ADR only changes the M1 build mechanics.
+
+## See also
+
+- [`0024-web-wasm-frontend-for-mobile.md`](0024-web-wasm-frontend-for-mobile.md)
+- [`0005-swancore-first-scope.md`](0005-swancore-first-scope.md)
+- [`0018-rich-note-model-fretboard-and-techniques.md`](0018-rich-note-model-fretboard-and-techniques.md)
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 2d8ce98f..c2674e08 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -29,7 +29,8 @@ immutable; supersede it with a new one. New ADRs: copy
 | [0021](0021-property-invariants-over-canonical-score.md) | Property-based invariants over the canonical Score | Proposed |
 | [0022](0022-repeat-unfolding-as-projection.md) | Repeat unfolding is a projection, not a model rewrite | Proposed |
 | [0023](0023-variation-control-for-complement.md) | Control pitch/contour spread of complementary parts | Proposed |
-| [0024](0024-web-wasm-frontend-for-mobile.md) | Ship the egui frontend to the browser (WASM) for mobile testing | Proposed |
+| [0024](0024-web-wasm-frontend-for-mobile.md) | Ship the egui frontend to the browser (WASM) for mobile testing | Proposed (§2–3,6 superseded by ADR-0025) |
+| [0025](0025-guitar-pro-in-browser-needs-wasm-bindgen.md) | Guitar Pro in the browser needs wasm-bindgen (over the import-free web build) | Accepted |
 
 See also: [`../SPEC.md`](../SPEC.md), [`../glossary.md`](../glossary.md),
 [`../decisions.log.md`](../decisions.log.md).
diff --git a/docs/decisions.log.md b/docs/decisions.log.md
index 575c6c3f..a7ba7dcb 100644
--- a/docs/decisions.log.md
+++ b/docs/decisions.log.md
@@ -1208,3 +1208,24 @@ Architectural decisions go to [`adr/`](adr/) instead.
   ADR: Harte et al. 2005 (the Harte chord syntax), `chord-rs` or similar
   Rust crates (for prior-art reuse vs native reimplementation per
   AGENTS.md). Captured so it is not lost; no commitment to build.
+
+- 2026-06-17 — In the context of unblocking phone-side swancore curation
+  (the corpus is GP-heavy, ADR-0005), facing that the M1 web playground
+  was MIDI-only because ADR-0024 built `griff-core` with
+  `default-features = false` to stay import-free, we decided for **loading
+  Guitar Pro in the browser via the shared Rust reader, accepting
+  `wasm-bindgen`** (ADR-0025 supersedes ADR-0024 §2–3, §6): enable `gp` in
+  the wasm build, export two `#[wasm_bindgen]` JSON functions (`arrange`,
+  `load_score`), use `getrandom`'s `wasm_js` backend
+  (`--cfg getrandom_backend="wasm_js"`), and build with a version-pinned
+  `wasm-bindgen-cli` — and against the import-free custom-`getrandom` route
+  (getrandom 0.4.2 fails to compile its custom backend on
+  `wasm32-unknown-unknown`, and `time` → `js-sys` pulls `wasm-bindgen`
+  regardless, so import-free is unreachable), and against a JS GP parser
+  (alphaTab forks parsing out of `griff-core`, so the browser and CLI would
+  diverge on coverage/bugs, plus a heavy JS dependency). Accepted: the
+  payload grows ~90 KiB → ~830 KiB, the toolchain now needs
+  `wasm-bindgen-cli` matched to the crate version (CI installs + caches it),
+  determinism is unaffected (zip never consumes randomness on the read
+  path), the lean MIDI-only wasm path still exists behind
+  `default-features = false`, and ADR-0024's egui M2 plan is untouched.
diff --git a/web/Cargo.toml b/web/Cargo.toml
index 50ef81a4..18aedf44 100644
--- a/web/Cargo.toml
+++ b/web/Cargo.toml
@@ -12,10 +12,17 @@ description = "Browser playground (WASM) for the griff engine — see docs/adr/0
 # wasm build still emits the cdylib.
 crate-type = ["cdylib", "rlib"]
 
-# `default-features = false` drops the GP importer (guitarpro/zip/time/getrandom
-# → wasm-bindgen), leaving a lean, import-free wasm module.
+# Guitar Pro import is ON in the browser (GP loading is the unblocker for phone
+# curation). The GP reader needs `wasm-bindgen` (`zip` → `time`/`getrandom` pull
+# js-sys / Web Crypto), so this build is no longer import-free — ADR-0024's lean
+# cdylib is superseded for the web front (see ADR-0025). Built with
+# `wasm-bindgen --target web` (see build.sh); `getrandom`'s `wasm_js` backend
+# needs the matching `--cfg getrandom_backend="wasm_js"` in RUSTFLAGS.
 [dependencies]
-griff-core = { path = "../core", default-features = false }
+griff-core = { path = "../core" }
+# Pinned exact: `wasm-bindgen-cli` must match this version exactly (see build.sh).
+wasm-bindgen = "=0.2.125"
+getrandom = { version = "0.4", features = ["wasm_js"] }
 
 # A pure-compute WASM module: no unwinding (smaller, no import surface), squeezed
 # for mobile download.
diff --git a/web/README.md b/web/README.md
index 3d545b0c..2223be96 100644
--- a/web/README.md
+++ b/web/README.md
@@ -2,47 +2,49 @@
 
 A browser front for the complement arranger — built so the engine can be driven
 (and *heard*) from a phone, no install. See
-[`docs/adr/0024-web-wasm-frontend-for-mobile.md`](../docs/adr/0024-web-wasm-frontend-for-mobile.md).
+[`docs/adr/0024-web-wasm-frontend-for-mobile.md`](../docs/adr/0024-web-wasm-frontend-for-mobile.md)
+and [`docs/adr/0025-guitar-pro-in-browser-needs-wasm-bindgen.md`](../docs/adr/0025-guitar-pro-in-browser-needs-wasm-bindgen.md).
 
-This is the **MVP** (ADR-0024 §2): a deliberately thin, throwaway front — no
-`wasm-bindgen`, no framework. `griff-web` is an *import-free* `cdylib` that
-exports a few C-ABI functions; the page (`static/`) loads the `.wasm` with
-`WebAssembly.instantiate(bytes, {})` and marshals a small JSON result through
-linear memory. The canonical `egui` frontend (ADR-0016) replaces it at M2.
+This is the **MVP**: a deliberately thin, throwaway front — no framework, just two
+`wasm-bindgen` functions returning JSON strings. To load Guitar Pro tabs the Rust
+GP reader pulls `zip`/`time`/`getrandom`, which need `wasm-bindgen` glue, so the
+build is no longer import-free (ADR-0025 supersedes ADR-0024's lean cdylib). The
+canonical `egui` frontend (ADR-0016) replaces it at M2.
 
 ## What it does
 
-Takes a part A — either a built-in sample lead or **a track from a MIDI file you
-load** — and generates a complement (part B) entirely in the browser, with live
-controls for **mode**, **seed**, **register offset**, and **pitch spread** (the
-ADR-0023 `VariationControl`, audible on the grid-locked modes). Deterministic:
-the same controls always produce the same result.
+Takes a part A — either a built-in sample lead or **a track from a MIDI or Guitar
+Pro file you load** — and generates a complement (part B) entirely in the browser,
+with live controls for **mode**, **seed**, **register offset**, and **pitch
+spread** (the ADR-0023 `VariationControl`, audible on the grid-locked modes).
+Deterministic: the same controls always produce the same result.
 
 ## Build & run locally
 
 ```sh
-./web/build.sh                              # → web/dist/ (wasm + static)
+# one-time: install the CLI matching the wasm-bindgen crate version in Cargo.toml
+cargo install wasm-bindgen-cli --version 0.2.125 --locked
+
+./web/build.sh                              # → web/dist/ (wasm + glue + static)
 python3 -m http.server -d web/dist 8080     # open http://localhost:8080
 ```
 
 The crate is wasm32-only and excluded from the root workspace (like `fuzz/`), so
 stable `--workspace` builds/clippy/tests never touch it. It depends on
-`griff-core` with `default-features = false`, dropping the Guitar Pro importer
-(`guitarpro`/`zip`/`time`/`getrandom` → `wasm-bindgen`) — that is what keeps the
-module import-free. MIDI import is always available, so loading a `.mid` works in
-the lean build (~220 KiB once the parser is reachable code); Guitar Pro file
-loading waits on a `getrandom` backend that does not pull in `wasm-bindgen`.
+`griff-core` with the `gp` feature on, so MIDI and Guitar Pro both import through
+the shared `import_score_auto` — the same parser as the CLI. `build.sh` sets
+`--cfg getrandom_backend="wasm_js"` (Web Crypto) and runs `wasm-bindgen --target
+web`; the payload is ~830 KiB (gp + zip + wasm-bindgen).
+
+## API
 
-## ABI
+Two `#[wasm_bindgen]` functions, called from the generated ES module
+(`griff_web.js`); both return a JSON string:
 
 | export | signature | meaning |
 | --- | --- | --- |
-| `arrange` | `(mode:u32, seed:u32, offset:i32, variation:f32, track:i32) -> *const u8` | arrange over part A (`track<0` = built-in sample, `track>=0` = loaded score's track); returns a pointer to JSON |
-| `arrange_len` | `() -> usize` | byte length of the last `arrange` result |
-| `input_alloc` | `(len:usize) -> *mut u8` | reserve `len` bytes for an uploaded file; JS writes the bytes here, then calls `load_score` |
-| `load_score` | `(len:usize) -> *const u8` | parse the input buffer (MIDI), stash the score, return a pointer to a JSON track summary |
-| `load_len` | `() -> usize` | byte length of the last `load_score` summary |
-| `memory` | — | the linear memory JS reads the JSON from |
+| `arrange` | `(mode, seed, offset, variation, track) -> String` | arrange over part A (`track<0` = built-in sample, `track>=0` = the loaded score's track) |
+| `load_score` | `(bytes: &[u8]) -> String` | parse an uploaded MIDI or Guitar Pro file, stash the score, return a track summary |
 
 `mode`: 0 `rhythm_lock`, 1 `register_contrast`, 2 `call_response`,
 3 `support_layer`, 4 `octave_double`, 5 `counter_melody`.
@@ -52,13 +54,14 @@ Load summary JSON: `{error, ppqn, tempo, bars, tracks:[{i, name, notes}]}`.
 
 ## Deploy
 
-`.github/workflows/web.yml` builds `web/dist` and publishes it to GitHub Pages on
-pushes to the default branch (enable Pages → "GitHub Actions" in repo settings).
+`.github/workflows/web.yml` installs the version-matched `wasm-bindgen-cli`, builds
+`web/dist`, and publishes it to GitHub Pages on pushes to the default branch
+(enable Pages → "GitHub Actions" in repo settings).
 
 ## Notes / next
 
 - Audio is a placeholder WebAudio synth (sawtooth + envelope, A left / B right).
   A real SoundFont (guitar tone) is a follow-up.
-- You can load your own **MIDI** file and arrange over any of its tracks;
-  **Guitar Pro** file loading (needs a `wasm-bindgen`-free `getrandom`) and
-  drag-drop are follow-ups.
+- You can load your own **MIDI** or **Guitar Pro** (`.gp3/.gp4/.gp5/.gpx`) file and
+  arrange over any of its tracks. Drag-drop and in-browser corpus curation /
+  download are follow-ups.
diff --git a/web/build.sh b/web/build.sh
index 503125e2..02dd2980 100755
--- a/web/build.sh
+++ b/web/build.sh
@@ -4,20 +4,35 @@
 #   ./web/build.sh                              # release build → web/dist
 #   python3 -m http.server -d web/dist 8080     # then open http://localhost:8080
 #
-# No wasm-bindgen / Trunk: griff-web is an import-free cdylib (ADR-0024), so the
-# .wasm is copied next to the static files and loaded with WebAssembly.instantiate.
+# Guitar Pro support needs the Rust GP reader, which pulls wasm-bindgen
+# (ADR-0025 supersedes ADR-0024's import-free cdylib). Pipeline: cargo build
+# (with getrandom's wasm_js backend) -> wasm-bindgen --target web -> static files.
+# `wasm-bindgen-cli` must match the `wasm-bindgen` crate version pinned in
+# Cargo.toml; install it with:
+#   cargo install wasm-bindgen-cli --version <that version> --locked
 set -euo pipefail
 here="$(cd "$(dirname "$0")" && pwd)"
 out="$here/dist"
 
 rustup target add wasm32-unknown-unknown >/dev/null 2>&1 || true
+# getrandom's wasm_js backend (Web Crypto) needs this cfg alongside the feature.
+export RUSTFLAGS="${RUSTFLAGS:-} --cfg getrandom_backend=\"wasm_js\""
 ( cd "$here" && cargo build --release --target wasm32-unknown-unknown )
 
+if ! command -v wasm-bindgen >/dev/null 2>&1; then
+  want=$(grep -m1 'wasm-bindgen = ' "$here/Cargo.toml" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+  echo "error: wasm-bindgen CLI not found. Install the matching version:" >&2
+  echo "  cargo install wasm-bindgen-cli --version ${want:-<see Cargo.toml>} --locked" >&2
+  exit 1
+fi
+
 rm -rf "$out"
 mkdir -p "$out"
 cp "$here"/static/* "$out"/
-cp "$here"/target/wasm32-unknown-unknown/release/griff_web.wasm "$out"/
+wasm-bindgen --target web --no-typescript \
+  --out-dir "$out" \
+  "$here/target/wasm32-unknown-unknown/release/griff_web.wasm"
 
-size=$(wc -c < "$out/griff_web.wasm")
+size=$(wc -c < "$out/griff_web_bg.wasm")
 echo "built web/dist ($((size / 1024)) KiB wasm) — serve it with:"
 echo "  python3 -m http.server -d \"$out\" 8080"
diff --git a/web/src/lib.rs b/web/src/lib.rs
index d1bb5efb..bf948ef2 100644
--- a/web/src/lib.rs
+++ b/web/src/lib.rs
@@ -1,25 +1,25 @@
-//! Browser playground (WASM) for the griff complement arranger — ADR-0024.
+//! Browser playground (WASM) for the griff complement arranger — ADR-0024/0025.
 //!
-//! A deliberately thin, throwaway front (ADR-0024 §5): no `wasm-bindgen`, no
-//! framework. It exports a handful of C-ABI functions and marshals a JSON
-//! result through linear memory, so the build is just `cargo build --target
-//! wasm32-unknown-unknown` and the page is static files. The canonical `egui`
-//! frontend (ADR-0016) replaces this at M2.
+//! A deliberately thin, throwaway front (ADR-0024 §5): no framework, just two
+//! `wasm-bindgen` functions returning JSON strings. Loading Guitar Pro tabs
+//! needs the Rust GP reader, which pulls `zip`/`time`/`getrandom` and therefore
+//! `wasm-bindgen` glue — so this build is no longer import-free (ADR-0025
+//! supersedes the lean cdylib for the web front). Built with `wasm-bindgen
+//! --target web` (see `build.sh`). The canonical `egui` frontend (ADR-0016)
+//! replaces this at M2.
 //!
-//! `arrange(mode, seed, offset, variation, track)` runs
-//! [`arrange_complement_varied`] over a part A — either the built-in sample
-//! (`track < 0`) or a track of a user-loaded score (`track >= 0`) — and writes
-//! `{ppqn, tempo, realized_spread, error, tracks:[A, B]}` into a thread-local
-//! buffer; JS reads it via the returned pointer + `arrange_len()`.
-//!
-//! File loading is import-free MIDI (the `gp` feature is off in the wasm build,
-//! per ADR-0024): JS writes the file bytes into `input_alloc(len)`, calls
-//! `load_score(len)` to parse + stash the [`Score`], and reads a track summary
-//! (`load_len()`); `arrange(.., track)` then arranges over the chosen track.
+//! - `arrange(mode, seed, offset, variation, track)` runs
+//!   [`arrange_complement_varied`] over a part A — the built-in sample
+//!   (`track < 0`) or a track of a user-loaded score (`track >= 0`) — and
+//!   returns `{ppqn, tempo, realized_spread, error, tracks:[A, B]}`.
+//! - `load_score(bytes)` parses an uploaded MIDI or Guitar Pro file, stashes the
+//!   [`Score`], and returns a `{error, ppqn, tempo, bars, tracks}` summary.
 
 use std::cell::RefCell;
 use std::fmt::Write as _;
 
+use wasm_bindgen::prelude::*;
+
 use griff_core::complement::{
     arrange_complement_varied, ComplementSpec, RelationMode, VariationControl,
 };
@@ -244,80 +244,32 @@ fn arrange_to_json(source: &Score, track_index: usize, params: ArrangeParams) ->
 }
 
 thread_local! {
-    static OUT: RefCell<Vec<u8>> = const { RefCell::new(Vec::new()) };
-    static IN: RefCell<Vec<u8>> = const { RefCell::new(Vec::new()) };
     static LOADED: RefCell<Option<Score>> = const { RefCell::new(None) };
 }
 
-/// Arranges a complement and stores the JSON result; returns a pointer into
-/// WASM linear memory. Read `arrange_len()` bytes from it (valid until the next
-/// `arrange` call). Part A is the loaded score's `track` (when `track >= 0` and
-/// a score has been loaded), otherwise the built-in sample.
-#[no_mangle]
-pub extern "C" fn arrange(
-    mode: u32,
-    seed: u32,
-    offset: i32,
-    variation: f32,
-    track: i32,
-) -> *const u8 {
+/// Arranges a complement and returns the result JSON. Part A is the loaded
+/// score's `track` (when `track >= 0` and a score has been loaded), otherwise
+/// the built-in sample.
+#[wasm_bindgen]
+pub fn arrange(mode: u32, seed: u32, offset: i32, variation: f32, track: i32) -> String {
     let params = ArrangeParams {
         mode,
         seed: u64::from(seed),
         offset,
         variation,
     };
-    let json = LOADED.with(|l| match (l.borrow().as_ref(), usize::try_from(track)) {
+    LOADED.with(|l| match (l.borrow().as_ref(), usize::try_from(track)) {
         (Some(score), Ok(ti)) => arrange_to_json(score, ti, params),
         _ => arrange_to_json(&sample_part_a(), 0, params),
-    });
-    OUT.with(|o| {
-        *o.borrow_mut() = json.into_bytes();
-        o.borrow().as_ptr()
-    })
-}
-
-/// Length in bytes of the JSON stored by the last [`arrange`] call.
-#[no_mangle]
-pub extern "C" fn arrange_len() -> usize {
-    OUT.with(|o| o.borrow().len())
-}
-
-/// Reserves `len` bytes of input buffer and returns a writable pointer into
-/// linear memory. JS copies the uploaded file's bytes here, then calls
-/// [`load_score`]. (Create the JS view *after* this call: memory may grow.)
-#[no_mangle]
-pub extern "C" fn input_alloc(len: usize) -> *mut u8 {
-    IN.with(|b| {
-        let mut b = b.borrow_mut();
-        b.clear();
-        b.resize(len, 0);
-        b.as_mut_ptr()
     })
 }
 
-/// Parses the first `len` bytes of the input buffer (MIDI; Guitar Pro when the
-/// `gp` feature is on), stashes the [`Score`] for later [`arrange`] calls, and
-/// writes a JSON track summary into the output buffer. Returns a pointer to it;
-/// read [`load_len`] bytes. On failure, leaves any previously loaded score in
-/// place and writes `{"error":"…","tracks":[]}`.
-#[no_mangle]
-pub extern "C" fn load_score(len: usize) -> *const u8 {
-    let json = IN.with(|b| {
-        let bytes = b.borrow();
-        let end = len.min(bytes.len());
-        load_to_json(&bytes[..end])
-    });
-    OUT.with(|o| {
-        *o.borrow_mut() = json.into_bytes();
-        o.borrow().as_ptr()
-    })
-}
-
-/// Length in bytes of the JSON stored by the last [`load_score`] call.
-#[no_mangle]
-pub extern "C" fn load_len() -> usize {
-    OUT.with(|o| o.borrow().len())
+/// Parses uploaded file bytes (MIDI or Guitar Pro), stashes the [`Score`] for
+/// later [`arrange`] calls, and returns a JSON track summary. On failure leaves
+/// any previously loaded score in place and returns `{"error":"…","tracks":[]}`.
+#[wasm_bindgen]
+pub fn load_score(bytes: &[u8]) -> String {
+    load_to_json(bytes)
 }
 
 /// Imports `data`, stores the score on success, and returns a JSON summary
@@ -455,4 +407,22 @@ mod tests {
             "arranges the imported track: {j:.160}"
         );
     }
+
+    #[test]
+    fn load_routes_guitar_pro_bytes_to_the_gp_reader() {
+        // A header-only GP5 fuzz seed: enough to be recognised as Guitar Pro and
+        // routed to the GP reader, which reports a clean GP parse error. This
+        // proves the `gp` feature is on in the wasm build — a MIDI fallback would
+        // report a "MIDI" error instead.
+        let gp = include_bytes!("../../fuzz/corpus/guitar_pro_import/gp5_header_only.gp5");
+        let json = load_to_json(gp);
+        assert!(
+            json.contains("\"error\":\""),
+            "a truncated GP file must surface an error: {json}"
+        );
+        assert!(
+            json.contains("Guitar Pro"),
+            "the GP reader handled it, not the MIDI fallback: {json}"
+        );
+    }
 }
diff --git a/web/static/app.js b/web/static/app.js
index 78fab27f..f5798bbd 100644
--- a/web/static/app.js
+++ b/web/static/app.js
@@ -1,247 +1,228 @@
-(() => {
-  'use strict';
-  const $ = (id) => document.getElementById(id);
-  const els = {
-    file: $('file'), track: $('track'),
-    mode: $('mode'), seed: $('seed'), seedOut: $('seedOut'),
-    offset: $('offset'), offsetOut: $('offsetOut'),
-    variation: $('variation'), varOut: $('varOut'),
-    gen: $('gen'), play: $('play'), stop: $('stop'),
-    roll: $('roll'), status: $('status'),
-  };
-
-  const PPQN_FALLBACK = 480;
-  let wasm = null;     // wasm exports
-  let current = null;  // last arrange() result (parsed JSON)
-  let audio = null;    // AudioContext
-  let voices = [];     // scheduled oscillators
-  let playStartT = 0, playSpan = 0, raf = 0;
-
-  // ---- engine ----
-  async function initWasm() {
-    const resp = await fetch('./griff_web.wasm');
-    const bytes = await resp.arrayBuffer();
-    // Import-free module (ADR-0024): no import object needed.
-    const { instance } = await WebAssembly.instantiate(bytes, {});
-    wasm = instance.exports;
-  }
-
-  function arrange() {
-    if (!wasm) return;
-    const mode = +els.mode.value;
-    const seed = +els.seed.value;
-    const offset = +els.offset.value;
-    const variation = (+els.variation.value) / 100;
-    const track = +els.track.value;
-    const ptr = wasm.arrange(mode, seed, offset, variation, track);
-    const len = wasm.arrange_len();
-    // Read AFTER the call: arrange() may have grown linear memory.
-    const view = new Uint8Array(wasm.memory.buffer, ptr, len);
-    current = JSON.parse(new TextDecoder('utf-8').decode(view));
-    draw();
-    showStatus();
-  }
-
-  function showStatus() {
-    if (!current) return;
-    const a = current.tracks.find((t) => t.role === 'a');
-    const b = current.tracks.find((t) => t.role === 'b');
-    els.status.classList.toggle('error', !!current.error);
-    if (current.error) {
-      els.status.textContent =
-        `error: ${current.error} — try another offset/mode (A still shown)`;
-      return;
-    }
+// ES module: loads the wasm-bindgen glue (ADR-0025) and drives the playground.
+// `arrange`/`load_score` return JSON strings, so there is no manual linear-memory
+// marshalling here — wasm-bindgen handles the String/&[u8] boundary.
+import init, { arrange as wasmArrange, load_score as wasmLoadScore } from './griff_web.js';
+
+const $ = (id) => document.getElementById(id);
+const els = {
+  file: $('file'), track: $('track'),
+  mode: $('mode'), seed: $('seed'), seedOut: $('seedOut'),
+  offset: $('offset'), offsetOut: $('offsetOut'),
+  variation: $('variation'), varOut: $('varOut'),
+  gen: $('gen'), play: $('play'), stop: $('stop'),
+  roll: $('roll'), status: $('status'),
+};
+
+const PPQN_FALLBACK = 480;
+let current = null;  // last arrange() result (parsed JSON)
+let audio = null;    // AudioContext
+let voices = [];     // scheduled oscillators
+let playStartT = 0, playSpan = 0, raf = 0;
+
+function arrange() {
+  const mode = +els.mode.value;
+  const seed = +els.seed.value;
+  const offset = +els.offset.value;
+  const variation = (+els.variation.value) / 100;
+  const track = +els.track.value;
+  current = JSON.parse(wasmArrange(mode, seed, offset, variation, track));
+  draw();
+  showStatus();
+}
+
+function showStatus() {
+  if (!current) return;
+  const a = current.tracks.find((t) => t.role === 'a');
+  const b = current.tracks.find((t) => t.role === 'b');
+  els.status.classList.toggle('error', !!current.error);
+  if (current.error) {
     els.status.textContent =
-      `A: ${a ? a.notes.length : 0} notes · B: ${b ? b.notes.length : 0} notes` +
-      ` · realized spread ${Number(current.realized_spread).toFixed(2)}`;
+      `error: ${current.error} — try another offset/mode (A still shown)`;
+    return;
   }
-
-  // ---- file loading (import-free MIDI; see ADR-0024) ----
-  const escapeHtml = (s) => String(s).replace(/[&<>"]/g,
-    (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
-
-  function loadFile(file) {
-    const reader = new FileReader();
-    reader.onload = () => {
-      try {
-        const bytes = new Uint8Array(reader.result);
-        const ptr = wasm.input_alloc(bytes.length);
-        // View AFTER input_alloc: reserving the buffer may have grown memory.
-        new Uint8Array(wasm.memory.buffer, ptr, bytes.length).set(bytes);
-        const rptr = wasm.load_score(bytes.length);
-        const view = new Uint8Array(wasm.memory.buffer, rptr, wasm.load_len());
-        const summary = JSON.parse(new TextDecoder('utf-8').decode(view));
-        if (summary.error) {
-          els.status.classList.add('error');
-          els.status.textContent = 'load failed: ' + summary.error;
-          return;
-        }
-        els.status.classList.remove('error');
-        populateTracks(summary);
-        arrange();
-      } catch (err) {
+  els.status.textContent =
+    `A: ${a ? a.notes.length : 0} notes · B: ${b ? b.notes.length : 0} notes` +
+    ` · realized spread ${Number(current.realized_spread).toFixed(2)}`;
+}
+
+// ---- file loading (MIDI or Guitar Pro; see ADR-0025) ----
+const escapeHtml = (s) => String(s).replace(/[&<>"]/g,
+  (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+
+function loadFile(file) {
+  const reader = new FileReader();
+  reader.onload = () => {
+    try {
+      const summary = JSON.parse(wasmLoadScore(new Uint8Array(reader.result)));
+      if (summary.error) {
         els.status.classList.add('error');
-        els.status.textContent = 'load failed: ' + err;
+        els.status.textContent = 'load failed: ' + summary.error;
+        return;
       }
-    };
-    reader.readAsArrayBuffer(file);
-  }
-
-  function populateTracks(summary) {
-    const opts = ['<option value="-1">built-in sample</option>'];
-    let firstWithNotes = -1;
-    for (const t of summary.tracks) {
-      opts.push(`<option value="${t.i}">${escapeHtml(t.name)} · ${t.notes} notes</option>`);
-      if (firstWithNotes < 0 && t.notes > 0) firstWithNotes = t.i;
+      els.status.classList.remove('error');
+      populateTracks(summary);
+      arrange();
+    } catch (err) {
+      els.status.classList.add('error');
+      els.status.textContent = 'load failed: ' + err;
     }
-    els.track.innerHTML = opts.join('');
-    els.track.value = String(firstWithNotes >= 0 ? firstWithNotes : -1);
-    els.status.textContent =
-      `loaded ${summary.tracks.length} track(s) · ${summary.bars} bars — pick a track, then ▶`;
+  };
+  reader.readAsArrayBuffer(file);
+}
+
+function populateTracks(summary) {
+  const opts = ['<option value="-1">built-in sample</option>'];
+  let firstWithNotes = -1;
+  for (const t of summary.tracks) {
+    opts.push(`<option value="${t.i}">${escapeHtml(t.name)} · ${t.notes} notes</option>`);
+    if (firstWithNotes < 0 && t.notes > 0) firstWithNotes = t.i;
   }
-
-  // ---- drawing ----
-  function allNotes() {
-    if (!current) return [];
-    return current.tracks.flatMap((t) => t.notes.map((n) => ({ ...n, role: t.role })));
+  els.track.innerHTML = opts.join('');
+  els.track.value = String(firstWithNotes >= 0 ? firstWithNotes : -1);
+  els.status.textContent =
+    `loaded ${summary.tracks.length} track(s) · ${summary.bars} bars — pick a track, then ▶`;
+}
+
+// ---- drawing ----
+function allNotes() {
+  if (!current) return [];
+  return current.tracks.flatMap((t) => t.notes.map((n) => ({ ...n, role: t.role })));
+}
+
+function draw(playheadTick) {
+  const c = els.roll, dpr = window.devicePixelRatio || 1;
+  const w = c.clientWidth, h = c.clientHeight;
+  c.width = Math.floor(w * dpr); c.height = Math.floor(h * dpr);
+  const ctx = c.getContext('2d');
+  ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+  ctx.clearRect(0, 0, w, h);
+
+  const notes = allNotes();
+  if (notes.length === 0) return;
+
+  const ppqn = current.ppqn || PPQN_FALLBACK;
+  const endTick = Math.max(...notes.map((n) => n.s + n.d), 1);
+  const loP = Math.min(...notes.map((n) => n.p)) - 1;
+  const hiP = Math.max(...notes.map((n) => n.p)) + 1;
+  const pad = 6, plotW = w - pad * 2, plotH = h - pad * 2;
+  const x = (t) => pad + (t / endTick) * plotW;
+  const y = (p) => pad + (1 - (p - loP) / Math.max(1, hiP - loP)) * plotH;
+  const rowH = plotH / Math.max(1, hiP - loP);
+
+  // bar gridlines (4/4: bar = 4*ppqn)
+  ctx.strokeStyle = '#1c2230'; ctx.lineWidth = 1;
+  for (let t = 0; t <= endTick; t += 4 * ppqn) {
+    ctx.beginPath(); ctx.moveTo(x(t), pad); ctx.lineTo(x(t), h - pad); ctx.stroke();
   }
 
-  function draw(playheadTick) {
-    const c = els.roll, dpr = window.devicePixelRatio || 1;
-    const w = c.clientWidth, h = c.clientHeight;
-    c.width = Math.floor(w * dpr); c.height = Math.floor(h * dpr);
-    const ctx = c.getContext('2d');
-    ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
-    ctx.clearRect(0, 0, w, h);
-
-    const notes = allNotes();
-    if (notes.length === 0) return;
-
-    const ppqn = current.ppqn || PPQN_FALLBACK;
-    const endTick = Math.max(...notes.map((n) => n.s + n.d), 1);
-    const loP = Math.min(...notes.map((n) => n.p)) - 1;
-    const hiP = Math.max(...notes.map((n) => n.p)) + 1;
-    const pad = 6, plotW = w - pad * 2, plotH = h - pad * 2;
-    const x = (t) => pad + (t / endTick) * plotW;
-    const y = (p) => pad + (1 - (p - loP) / Math.max(1, hiP - loP)) * plotH;
-    const rowH = plotH / Math.max(1, hiP - loP);
-
-    // bar gridlines (4/4: bar = 4*ppqn)
-    ctx.strokeStyle = '#1c2230'; ctx.lineWidth = 1;
-    for (let t = 0; t <= endTick; t += 4 * ppqn) {
-      ctx.beginPath(); ctx.moveTo(x(t), pad); ctx.lineTo(x(t), h - pad); ctx.stroke();
-    }
-
-    for (const n of notes) {
-      const nx = x(n.s), nw = Math.max(2, x(n.s + n.d) - nx);
-      const ny = y(n.p) - rowH / 2, nh = Math.max(3, rowH * 0.8);
-      ctx.fillStyle = n.role === 'a' ? '#4aa3ff' : '#ffb24a';
-      ctx.globalAlpha = 0.35 + 0.55 * (n.v / 127);
-      ctx.fillRect(nx, ny, nw, nh);
-    }
-    ctx.globalAlpha = 1;
-
-    if (playheadTick != null) {
-      ctx.strokeStyle = '#5ad19a'; ctx.lineWidth = 2;
-      ctx.beginPath();
-      ctx.moveTo(x(playheadTick), pad); ctx.lineTo(x(playheadTick), h - pad); ctx.stroke();
-    }
+  for (const n of notes) {
+    const nx = x(n.s), nw = Math.max(2, x(n.s + n.d) - nx);
+    const ny = y(n.p) - rowH / 2, nh = Math.max(3, rowH * 0.8);
+    ctx.fillStyle = n.role === 'a' ? '#4aa3ff' : '#ffb24a';
+    ctx.globalAlpha = 0.35 + 0.55 * (n.v / 127);
+    ctx.fillRect(nx, ny, nw, nh);
   }
+  ctx.globalAlpha = 1;
 
-  // ---- playback (placeholder synth; a real SoundFont comes later) ----
-  const tickToSec = (tick, ppqn, tempo) => (tick / ppqn) * (60 / tempo);
-
-  function play() {
-    if (!current || allNotes().length === 0) return;
-    stop();
-    audio = audio || new (window.AudioContext || window.webkitAudioContext)();
-    if (audio.state === 'suspended') audio.resume(); // unlock on the tap gesture
-
-    const ppqn = current.ppqn || PPQN_FALLBACK;
-    const tempo = current.tempo || 120;
-    const t0 = audio.currentTime + 0.08;
-    const master = audio.createGain();
-    master.gain.value = 0.25;
-    master.connect(audio.destination);
-
-    let maxEnd = 0;
-    for (const n of allNotes()) {
-      const start = t0 + tickToSec(n.s, ppqn, tempo);
-      const dur = Math.max(0.05, tickToSec(n.d, ppqn, tempo));
-      maxEnd = Math.max(maxEnd, tickToSec(n.s + n.d, ppqn, tempo));
-
-      const osc = audio.createOscillator();
-      osc.type = 'sawtooth';
-      osc.frequency.value = 440 * Math.pow(2, (n.p - 69) / 12);
-      const g = audio.createGain();
-      const peak = 0.18 + 0.5 * (n.v / 127);
-      g.gain.setValueAtTime(0.0001, start);
-      g.gain.exponentialRampToValueAtTime(peak, start + 0.01);
-      g.gain.exponentialRampToValueAtTime(0.0001, start + dur);
-      osc.connect(g);
-      if (audio.createStereoPanner) {
-        const pan = audio.createStereoPanner();
-        pan.pan.value = n.role === 'a' ? -0.4 : 0.4;
-        g.connect(pan); pan.connect(master);
-      } else {
-        g.connect(master);
-      }
-      osc.start(start); osc.stop(start + dur + 0.02);
-      voices.push(osc);
+  if (playheadTick != null) {
+    ctx.strokeStyle = '#5ad19a'; ctx.lineWidth = 2;
+    ctx.beginPath();
+    ctx.moveTo(x(playheadTick), pad); ctx.lineTo(x(playheadTick), h - pad); ctx.stroke();
+  }
+}
+
+// ---- playback (placeholder synth; a real SoundFont comes later) ----
+const tickToSec = (tick, ppqn, tempo) => (tick / ppqn) * (60 / tempo);
+
+function play() {
+  if (!current || allNotes().length === 0) return;
+  stop();
+  audio = audio || new (window.AudioContext || window.webkitAudioContext)();
+  if (audio.state === 'suspended') audio.resume(); // unlock on the tap gesture
+
+  const ppqn = current.ppqn || PPQN_FALLBACK;
+  const tempo = current.tempo || 120;
+  const t0 = audio.currentTime + 0.08;
+  const master = audio.createGain();
+  master.gain.value = 0.25;
+  master.connect(audio.destination);
+
+  let maxEnd = 0;
+  for (const n of allNotes()) {
+    const start = t0 + tickToSec(n.s, ppqn, tempo);
+    const dur = Math.max(0.05, tickToSec(n.d, ppqn, tempo));
+    maxEnd = Math.max(maxEnd, tickToSec(n.s + n.d, ppqn, tempo));
+
+    const osc = audio.createOscillator();
+    osc.type = 'sawtooth';
+    osc.frequency.value = 440 * Math.pow(2, (n.p - 69) / 12);
+    const g = audio.createGain();
+    const peak = 0.18 + 0.5 * (n.v / 127);
+    g.gain.setValueAtTime(0.0001, start);
+    g.gain.exponentialRampToValueAtTime(peak, start + 0.01);
+    g.gain.exponentialRampToValueAtTime(0.0001, start + dur);
+    osc.connect(g);
+    if (audio.createStereoPanner) {
+      const pan = audio.createStereoPanner();
+      pan.pan.value = n.role === 'a' ? -0.4 : 0.4;
+      g.connect(pan); pan.connect(master);
+    } else {
+      g.connect(master);
     }
-
-    playStartT = t0; playSpan = maxEnd;
-    animatePlayhead();
+    osc.start(start); osc.stop(start + dur + 0.02);
+    voices.push(osc);
   }
 
-  function animatePlayhead() {
-    cancelAnimationFrame(raf);
-    const step = () => {
-      if (!audio) return;
-      const el = audio.currentTime - playStartT;
-      if (el > playSpan + 0.1) { draw(); return; }
-      if (el >= 0) {
-        const ppqn = current.ppqn || PPQN_FALLBACK, tempo = current.tempo || 120;
-        draw((el / (60 / tempo)) * ppqn);
-      }
-      raf = requestAnimationFrame(step);
-    };
+  playStartT = t0; playSpan = maxEnd;
+  animatePlayhead();
+}
+
+function animatePlayhead() {
+  cancelAnimationFrame(raf);
+  const step = () => {
+    if (!audio) return;
+    const el = audio.currentTime - playStartT;
+    if (el > playSpan + 0.1) { draw(); return; }
+    if (el >= 0) {
+      const ppqn = current.ppqn || PPQN_FALLBACK, tempo = current.tempo || 120;
+      draw((el / (60 / tempo)) * ppqn);
+    }
     raf = requestAnimationFrame(step);
-  }
-
-  function stop() {
-    cancelAnimationFrame(raf);
-    for (const v of voices) { try { v.stop(); } catch (_) { /* already stopped */ } }
-    voices = [];
-    draw();
-  }
-
-  // ---- wiring ----
-  function bind() {
-    els.seed.addEventListener('input', () => { els.seedOut.textContent = els.seed.value; arrange(); });
-    els.offset.addEventListener('input', () => { els.offsetOut.textContent = els.offset.value; arrange(); });
-    els.variation.addEventListener('input', () => {
-      els.varOut.textContent = (els.variation.value / 100).toFixed(2); arrange();
-    });
-    els.mode.addEventListener('change', arrange);
-    els.track.addEventListener('change', arrange);
-    els.file.addEventListener('change', (e) => {
-      const f = e.target.files && e.target.files[0];
-      if (f) loadFile(f);
-    });
-    els.gen.addEventListener('click', arrange);
-    els.play.addEventListener('click', play);
-    els.stop.addEventListener('click', stop);
-    window.addEventListener('resize', () => draw());
-  }
-
-  initWasm().then(() => {
-    bind();
-    arrange();
-    els.status.textContent = 'ready — drag a slider, then ▶ Play';
-  }).catch((err) => {
-    els.status.classList.add('error');
-    els.status.textContent = 'failed to load engine: ' + err;
+  };
+  raf = requestAnimationFrame(step);
+}
+
+function stop() {
+  cancelAnimationFrame(raf);
+  for (const v of voices) { try { v.stop(); } catch (_) { /* already stopped */ } }
+  voices = [];
+  draw();
+}
+
+// ---- wiring ----
+function bind() {
+  els.seed.addEventListener('input', () => { els.seedOut.textContent = els.seed.value; arrange(); });
+  els.offset.addEventListener('input', () => { els.offsetOut.textContent = els.offset.value; arrange(); });
+  els.variation.addEventListener('input', () => {
+    els.varOut.textContent = (els.variation.value / 100).toFixed(2); arrange();
+  });
+  els.mode.addEventListener('change', arrange);
+  els.track.addEventListener('change', arrange);
+  els.file.addEventListener('change', (e) => {
+    const f = e.target.files && e.target.files[0];
+    if (f) loadFile(f);
   });
-})();
+  els.gen.addEventListener('click', arrange);
+  els.play.addEventListener('click', play);
+  els.stop.addEventListener('click', stop);
+  window.addEventListener('resize', () => draw());
+}
+
+init().then(() => {
+  bind();
+  arrange();
+  els.status.textContent = 'ready — load a tab or drag a slider, then ▶ Play';
+}).catch((err) => {
+  els.status.classList.add('error');
+  els.status.textContent = 'failed to load engine: ' + err;
+});
diff --git a/web/static/index.html b/web/static/index.html
index 2b9a2c36..3b0cec6f 100644
--- a/web/static/index.html
+++ b/web/static/index.html
@@ -11,15 +11,15 @@
   <main>
     <h1>griff <span class="muted">· complement playground</span></h1>
     <p class="muted small">
-      Load your own MIDI tab (or use the built-in sample) as part A, and griff
-      generates a complement part B — all in the browser. Deterministic: same
-      controls → same result. (ADR-0024, MVP)
+      Load your own MIDI or Guitar Pro tab (or use the built-in sample) as part
+      A, and griff generates a complement part B — all in the browser.
+      Deterministic: same controls → same result. (ADR-0024/0025, MVP)
     </p>
 
     <section class="controls">
       <label>
-        Load tab <span class="hint">MIDI (.mid) — Guitar Pro coming</span>
-        <input id="file" type="file" accept=".mid,.midi,audio/midi" />
+        Load tab <span class="hint">MIDI (.mid) or Guitar Pro (.gp3/.gp4/.gp5/.gpx)</span>
+        <input id="file" type="file" accept=".mid,.midi,audio/midi,.gp3,.gp4,.gp5,.gpx" />
       </label>
 
       <label>
@@ -72,6 +72,6 @@ <h1>griff <span class="muted">· complement playground</span></h1>
       to WASM; audio is a placeholder synth (a real SoundFont comes later).
     </p>
   </main>
-  <script src="./app.js"></script>
+  <script type="module" src="./app.js"></script>
 </body>
 </html>

From 46aacac2223ffdeaaf5583539fa4448d910bf47c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 17 Jun 2026 12:21:01 +0000
Subject: [PATCH 5/6] fix(web): escape control characters in json_escape
 (CodeRabbit)

A loaded MIDI/GP track name (or a Debug/Display error string) can contain
\n, \r, \t, or other control bytes. The old json_escape escaped only \ and ",
so such a name produced invalid JSON and crashed JSON.parse in the browser --
exactly the path that matters now that arbitrary GP/MIDI files load. Escape the
RFC 8259 control range: short forms for \n \r \t, \uXXXX for the rest.

All JSON string values route through json_escape, so this one fix covers every
call site (track names + error fields). Adds a unit test.
---
 web/src/lib.rs | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/web/src/lib.rs b/web/src/lib.rs
index bf948ef2..fdad018a 100644
--- a/web/src/lib.rs
+++ b/web/src/lib.rs
@@ -143,8 +143,27 @@ fn push_notes(json: &mut String, track: &Track) {
     json.push(']');
 }
 
+/// Escapes a string for embedding in JSON. Beyond `\` and `"`, this escapes the
+/// control characters (`U+0000..=U+001F`) that RFC 8259 forbids raw: imported
+/// MIDI/GP track names and `Debug`/`Display` error strings can carry `\n`, `\t`,
+/// or other control bytes that would otherwise make the output unparseable and
+/// crash `JSON.parse` in the browser.
 fn json_escape(s: &str) -> String {
-    s.replace('\\', "\\\\").replace('"', "\\\"")
+    let mut out = String::with_capacity(s.len() + 8);
+    for ch in s.chars() {
+        match ch {
+            '\\' => out.push_str("\\\\"),
+            '"' => out.push_str("\\\""),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            c if (c as u32) < 0x20 => {
+                let _ = write!(out, "\\u{:04x}", c as u32);
+            }
+            c => out.push(c),
+        }
+    }
+    out
 }
 
 /// The four knobs behind one arrangement (mirror the UI controls).
@@ -321,7 +340,19 @@ fn note_count(track: &Track) -> usize {
 
 #[cfg(test)]
 mod tests {
-    use super::{arrange_to_json, load_to_json, sample_part_a, ArrangeParams};
+    use super::{arrange_to_json, json_escape, load_to_json, sample_part_a, ArrangeParams};
+
+    #[test]
+    fn json_escape_escapes_quotes_backslashes_and_control_chars() {
+        // Backslash and quote.
+        assert_eq!(json_escape(r#"a\b"c"#), r#"a\\b\"c"#);
+        // The common control chars get their short forms.
+        assert_eq!(json_escape("l1\nl2\tx\r"), "l1\\nl2\\tx\\r");
+        // Other control bytes (e.g. a bell, 0x07) fall back to \uXXXX.
+        assert_eq!(json_escape("\u{0007}"), "\\u0007");
+        // Non-control Unicode passes through untouched (valid in UTF-8 JSON).
+        assert_eq!(json_escape("café ✓"), "café ✓");
+    }
 
     /// Arrange over the built-in sample (the old `build_json` behaviour).
     fn sample_json(mode: u32, seed: u64, offset: i32, variation: f32) -> String {

From 0f75787ba0654890200173b0a035cd01c65e2661 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 17 Jun 2026 12:35:45 +0000
Subject: [PATCH 6/6] feat(web): cap upload size + guard against Guitar Pro
 archive bombs

The browser loads untrusted files. Add an input-size cap (16 MiB; real tabs are
far smaller) and refuse a GP6 .gpx whose BCFZ header declares an implausible
uncompressed length -- the GP reader does Vec::with_capacity(declared) before
decompressing a byte, so an 8-byte file could request gigabytes. Enforced in
Rust (load_to_json) and mirrored as a fast pre-check in the browser. Format
validation itself already exists (header sniffing in import_score_auto rejects a
disguised non-MIDI/GP file cheaply).

Also addresses CodeRabbit review on the wasm-bindgen commits:
- build.sh verifies the wasm-bindgen CLI version *matches* the pinned crate, not
  just that it exists (mismatched glue/wasm would break at runtime).
- app.js: add a FileReader onerror handler so read failures surface in the UI.
- note the GP-routing test's coupling to griff-core's error text.
---
 web/build.sh      | 10 ++++++-
 web/src/lib.rs    | 66 ++++++++++++++++++++++++++++++++++++++++++++++-
 web/static/app.js | 11 ++++++++
 3 files changed, 85 insertions(+), 2 deletions(-)

diff --git a/web/build.sh b/web/build.sh
index 02dd2980..d89dba23 100755
--- a/web/build.sh
+++ b/web/build.sh
@@ -19,12 +19,20 @@ rustup target add wasm32-unknown-unknown >/dev/null 2>&1 || true
 export RUSTFLAGS="${RUSTFLAGS:-} --cfg getrandom_backend=\"wasm_js\""
 ( cd "$here" && cargo build --release --target wasm32-unknown-unknown )
 
+want=$(grep -m1 'wasm-bindgen = ' "$here/Cargo.toml" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
 if ! command -v wasm-bindgen >/dev/null 2>&1; then
-  want=$(grep -m1 'wasm-bindgen = ' "$here/Cargo.toml" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
   echo "error: wasm-bindgen CLI not found. Install the matching version:" >&2
   echo "  cargo install wasm-bindgen-cli --version ${want:-<see Cargo.toml>} --locked" >&2
   exit 1
 fi
+# The CLI must match the wasm-bindgen crate exactly, or the generated glue and
+# the .wasm disagree at runtime. Fail loudly on a mismatch instead of shipping it.
+have=$(wasm-bindgen --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)
+if [ -n "${want:-}" ] && [ "$have" != "$want" ]; then
+  echo "error: wasm-bindgen CLI version mismatch (have ${have:-none}, want $want)." >&2
+  echo "  cargo install wasm-bindgen-cli --version $want --locked --force" >&2
+  exit 1
+fi
 
 rm -rf "$out"
 mkdir -p "$out"
diff --git a/web/src/lib.rs b/web/src/lib.rs
index fdad018a..dc67e281 100644
--- a/web/src/lib.rs
+++ b/web/src/lib.rs
@@ -166,6 +166,42 @@ fn json_escape(s: &str) -> String {
     out
 }
 
+/// Upload guards for the browser, which loads *untrusted* files. Real swancore
+/// tabs are far smaller; these caps stop a giant file from being copied into
+/// wasm memory and a tiny Guitar Pro "archive bomb" whose `BCFZ` header declares
+/// a multi-gigabyte payload — the GP6 reader `Vec::with_capacity`s that declared
+/// length before decompressing a single byte.
+const MAX_UPLOAD_BYTES: usize = 16 * 1024 * 1024;
+const MAX_GP6_DECOMPRESSED: u32 = 64 * 1024 * 1024;
+
+/// Returns a rejection reason if these bytes should not be handed to the parser
+/// (too large, or a Guitar Pro container declaring an implausible payload).
+fn reject_upload(data: &[u8]) -> Option<String> {
+    if data.len() > MAX_UPLOAD_BYTES {
+        return Some(format!(
+            "file too large: {} bytes (limit {} MiB)",
+            data.len(),
+            MAX_UPLOAD_BYTES / (1024 * 1024)
+        ));
+    }
+    // GP6 `.gpx` BCFZ container: bytes 4..8 are the little-endian declared
+    // uncompressed length. A tiny file can claim gigabytes, so refuse it before
+    // the GP reader allocates that buffer.
+    if data.starts_with(b"BCFZ") {
+        if let Some(hdr) = data.get(4..8) {
+            let declared = u32::from_le_bytes([hdr[0], hdr[1], hdr[2], hdr[3]]);
+            if declared > MAX_GP6_DECOMPRESSED {
+                return Some(format!(
+                    "refusing a Guitar Pro file that declares a {declared}-byte \
+                     payload (limit {} MiB) — possible archive bomb",
+                    MAX_GP6_DECOMPRESSED / (1024 * 1024)
+                ));
+            }
+        }
+    }
+    None
+}
+
 /// The four knobs behind one arrangement (mirror the UI controls).
 #[derive(Clone, Copy)]
 struct ArrangeParams {
@@ -294,6 +330,9 @@ pub fn load_score(bytes: &[u8]) -> String {
 /// Imports `data`, stores the score on success, and returns a JSON summary
 /// `{error, ppqn, tempo, bars, tracks:[{i,name,notes}]}`.
 fn load_to_json(data: &[u8]) -> String {
+    if let Some(reason) = reject_upload(data) {
+        return format!("{{\"error\":\"{}\",\"tracks\":[]}}", json_escape(&reason));
+    }
     match import_score_auto(data) {
         Ok(score) => {
             let ppqn = score.ticks_per_quarter;
@@ -354,6 +393,30 @@ mod tests {
         assert_eq!(json_escape("café ✓"), "café ✓");
     }
 
+    #[test]
+    fn reject_upload_caps_size_and_refuses_archive_bombs() {
+        use super::{reject_upload, MAX_GP6_DECOMPRESSED, MAX_UPLOAD_BYTES};
+        // A small, ordinary input is accepted.
+        assert!(reject_upload(b"MThd\0\0\0\x06").is_none());
+        // Oversized input is rejected up front.
+        assert!(reject_upload(&vec![0u8; MAX_UPLOAD_BYTES + 1]).is_some());
+        // A BCFZ container declaring more than the cap is refused as a bomb...
+        let mut bomb = b"BCFZ".to_vec();
+        bomb.extend_from_slice(&(MAX_GP6_DECOMPRESSED + 1).to_le_bytes());
+        assert!(reject_upload(&bomb).unwrap().contains("archive bomb"));
+        // ...while a modest declared payload passes the guard.
+        let mut modest = b"BCFZ".to_vec();
+        modest.extend_from_slice(&1024u32.to_le_bytes());
+        assert!(reject_upload(&modest).is_none());
+    }
+
+    #[test]
+    fn load_rejects_oversized_uploads_with_error_json() {
+        let json = load_to_json(&vec![0u8; super::MAX_UPLOAD_BYTES + 1]);
+        assert!(json.contains("file too large"), "{json:.120}");
+        assert!(json.contains("\"tracks\":[]"), "{json:.120}");
+    }
+
     /// Arrange over the built-in sample (the old `build_json` behaviour).
     fn sample_json(mode: u32, seed: u64, offset: i32, variation: f32) -> String {
         arrange_to_json(
@@ -444,7 +507,8 @@ mod tests {
         // A header-only GP5 fuzz seed: enough to be recognised as Guitar Pro and
         // routed to the GP reader, which reports a clean GP parse error. This
         // proves the `gp` feature is on in the wasm build — a MIDI fallback would
-        // report a "MIDI" error instead.
+        // report a "MIDI" error instead. (Couples to griff-core's GP error text:
+        // if that wording changes, update the substring checked below.)
         let gp = include_bytes!("../../fuzz/corpus/guitar_pro_import/gp5_header_only.gp5");
         let json = load_to_json(gp);
         assert!(
diff --git a/web/static/app.js b/web/static/app.js
index f5798bbd..e2497042 100644
--- a/web/static/app.js
+++ b/web/static/app.js
@@ -14,6 +14,7 @@ const els = {
 };
 
 const PPQN_FALLBACK = 480;
+const MAX_UPLOAD_BYTES = 16 * 1024 * 1024; // mirror the Rust-side upload guard
 let current = null;  // last arrange() result (parsed JSON)
 let audio = null;    // AudioContext
 let voices = [];     // scheduled oscillators
@@ -50,7 +51,17 @@ const escapeHtml = (s) => String(s).replace(/[&<>"]/g,
   (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
 
 function loadFile(file) {
+  if (file.size > MAX_UPLOAD_BYTES) {
+    els.status.classList.add('error');
+    els.status.textContent =
+      `load failed: file too large (${file.size} bytes; limit ${MAX_UPLOAD_BYTES / (1024 * 1024)} MiB)`;
+    return;
+  }
   const reader = new FileReader();
+  reader.onerror = () => {
+    els.status.classList.add('error');
+    els.status.textContent = 'load failed: could not read file';
+  };
   reader.onload = () => {
     try {
       const summary = JSON.parse(wasmLoadScore(new Uint8Array(reader.result)));