Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/desktop/src-tauri/src/main.rs`:
- Around line 22-26: The jobs HashMap in AppStateInner (jobs) accumulates
completed AnalysisJobStatus/RehearsalSongPayload entries with no deletion,
causing unbounded memory growth; modify the code paths that insert/overwrite
jobs (where AnalysisJobStatus and RehearsalSongPayload are stored) to evict
entries once they reach a terminal state or implement an eviction policy: either
add a timestamp/expiry field and run a periodic cleanup task to remove entries
older than TTL, or switch to an LRU bounded cache (e.g., lru::LruCache) to cap
size, and ensure read/update functions (the functions that return job results)
remove the job after first successful read if desired; also ensure thread safety
when replacing the Mutex<HashMap<...>> with the chosen eviction mechanism.
- Around line 380-392: In the failure branch where stdin.write_all(...) returns
Err, after calling process.kill() you must also reap the child to avoid leaving
a zombie; call process.wait() (or process.wait_timeout/try_wait if nonblocking
behavior is required) and ignore or log any error before returning
failed_status(...) so the Child started earlier is properly waited on; update
the branch referencing stdin.write_all, process.kill, and failed_status (and
keep requested_at and AnalysisJobErrorCode usage) to ensure the child is
waited/reaped after kill.
- Around line 359-361: 현재 Command 빌더에서 .stdout(Stdio::piped()) 및
.stderr(Stdio::piped())로 파이프를 열어놓고, 이후 폴링 루프에서 process.try_wait()만 호출(폴링 루프 내부의
"process.try_wait()" 사용)하므로 자식 프로세스가 stdout/stderr를 버퍼 한도까지 쓸 경우 쓰기 블록으로 이어져
데드락이 발생합니다; 해결하려면 파이프를 읽는 로직을 추가하세요 — 자식 프로세스에서 반환되는 ChildStdout/ChildStderr를 별도
스레드로 spawn하여(또는 비동기 태스크로) 동시에 drain하도록 하거나, stderr를 사용하지 않으면
.stderr(Stdio::null())로 변경하여 파이프를 제거하시기 바랍니다; 해당 변경은 Command 생성 코드(현재
.stdin/.stdout/.stderr 체인)와 폴링 루프에서 process.try_wait()를 호출하는 부분을 함께 수정해 적용하세요.

In `@apps/desktop/src/App.tsx`:
- Around line 155-156: jobStatus and jobError are currently rendered as plain
<p> elements so screen readers miss updates; change the JSX that renders
jobStatus (where progressMessage(t, jobStatus.state) is used) to an element with
role="status" and aria-live="polite" (e.g., a <div> or <p> wrapping the
progressMessage) and change the JSX that renders jobError to an element with
role="alert" so failures are announced immediately; ensure you still use the
existing jobStatus, jobError and progressMessage(t, ...) symbols and only add
the appropriate ARIA attributes/roles to those render nodes.

In `@apps/desktop/src/i18n/index.ts`:
- Around line 5-15: TranslationKey is currently derived from enCommon only, so
missing keys in other locale objects (koCommon) are only caught at runtime;
change the dictionaries typing to force compile-time synchronization by typing
dictionaries as Record<Locale, Record<TranslationKey, string>> (or deriving a
Dictionaries type that maps Locale to Record<keyof typeof enCommon, string>) and
adjust createTranslator to accept Locale and index dictionaries with that type;
ensure enCommon and koCommon conform to that shared Record type so any missing
translation keys in koCommon will cause a TypeScript error during compilation.

In `@apps/desktop/src/lib/analysis.ts`:
- Around line 22-28: The getInvoke function currently returns the imported
invoke even in browsers, causing runtime errors; change it to first import and
call isTauri() from "@tauri-apps/api/core" and only return invoke when isTauri()
is true and window.__TAURI_INVOKE__ is available; otherwise return null so
browserFallback() can run. Update the getInvoke implementation (referencing
getInvoke, window.__TAURI_INVOKE__, invoke, and isTauri) to perform the runtime
check and adjust the return values accordingly.

In `@docs/plans/2026-03-12-issue-32-analysis-orchestration-design.md`:
- Around line 66-73: 문서상 데이터 흐름이 queued에서 바로 terminal(succeeded/failed)로만 기록되도록
되어 있어 UI가 running 상태를 알 수 없으니, start_analysis_job 흐름에 subprocess를 spawn한 직후(또는
subprocess가 실제로 시작된 시점)에 상태를 `running`으로 전이하도록 명시하고 문서의 단계 3과 5 사이에 `running`
저장을 추가하세요; 구체적으로 문서에서 언급된 `start_analysis_job`, `AnalysisJobRequest`, 상태
값(`queued`, `running`, `succeeded`, `failed`) 및 폴링 엔드포인트
`get_analysis_job_status`를 업데이트하여 Rust가 subprocess 시작 시점에 `running`을 기록하고 폴링 결과가
이를 반영하도록 설명을 보강하세요.
- Around line 82-96: The test plan omits failure scenarios for hung
subprocesses, broken stdout/invalid JSON, and concurrent execution limits;
update the docs and tests to add scenarios that simulate: (1) start_analysis_job
returning engine_unavailable when the Python subprocess times out or is killed,
(2) malformed/invalid JSON on subprocess stdout and mapping to a typed safe
failure (e.g., JSON parse error path), (3) repeated start_analysis_job calls
exercising and enforcing the in-flight job limit and validating cleanup and
resource reclamation, and (4) process kill/cleanup behavior by asserting
subprocess termination, orphan prevention, and that errors are redacted in logs;
reference the existing IPC boundary and subprocess invocation code paths so
tests exercise the allowlist/validation, subprocess argument arrays, and error
mapping logic.

In `@docs/plans/2026-03-12-issue-32-analysis-orchestration.md`:
- Line 11: Change the task headings so they follow a proper H2 level under the
document title: replace the H3 heading "Task 1: Add shared analysis job
contracts" (and the equivalent "Task ..." headings later in the file) with H2
(##) headings, or alternatively introduce a new H2 parent section under the main
title and demote those task headings to H3 (###); update the headings for all
task sections referenced (the repeated "Task ..." headings) so markdownlint
MD001 is resolved and the heading hierarchy is consistent.

In `@packages/shared-types/src/index.ts`:
- Around line 105-113: The AnalysisJobSnapshot type currently duplicates failure
information by having both status (which contains error info) and a separate
error?: AnalysisJobError field; remove this ambiguity by deleting the top-level
error property from AnalysisJobSnapshot and rely on status.error as the single
source of truth, or if a distinct error meaning is required, rename error to a
clearly differentiated identifier (e.g., externalError or legacyError) and add a
doc comment explaining how it differs from status.error; update all
references/usages of AnalysisJobSnapshot, AnalysisJobSnapshot.error, and any
code expecting AnalysisJobError to use the chosen single source or new name so
consumers remain consistent.
- Around line 95-103: The current AnalysisJobStatus type allows invalid
state/result combinations; change it from a single object type to a
discriminated union keyed by the state field so the compiler enforces which
fields are present for each state (e.g., pending/processing states allow
optional progressLabel but neither result nor error, a success/finished state
requires result: RehearsalSong, and a failed state requires error:
AnalysisJobError); keep common fields (jobId, requestedAt, updatedAt) in each
variant and update any consumers to handle the narrowed union (refer to
AnalysisJobStatus, AnalysisJobState, RehearsalSong, and AnalysisJobError to
locate and adjust the type).

In `@services/analysis-engine/src/bandscope_analysis/api.py`:
- Around line 280-286: The success response currently mixes a dynamic
progressLabel with a hardcoded demo song title from build_demo_rehearsal_song(),
causing test mismatches; update run_analysis_job to ensure the returned
result.title matches request['sourceLabel']—either by changing
build_demo_rehearsal_song to accept a title parameter and pass
request['sourceLabel'], or by overriding result['title'] =
request['sourceLabel'] after calling build_demo_rehearsal_song(); keep all other
fields (jobId, state, timestamps, progressLabel) unchanged so the contract stays
consistent.
- Around line 141-145: The validation for role_focus currently only checks type
and element types but allows an empty list; update the validation in the same
block that uses role_focus to reject empty lists by adding a check like "if not
role_focus: raise ValueError(...)" so that an empty array raises a clear
ValueError for the 'roleFocus' field (keep the existing element-type checks
using enumerate for role strings). Ensure you reference the role_focus variable
and the existing ValueError pattern for 'roleFocus' so the new check is
colocated with the current isinstance and per-element string checks.

In `@services/analysis-engine/tests/test_api.py`:
- Around line 64-66: The test is only asserting
manualOverrides[0].value["source"], missing validation of the full override
payload which lets typoed keys (e.g., value.cord) pass; update the test in
services/analysis-engine/tests/test_api.py to assert the entire
manualOverrides[0]["value"] matches the expected HarmonyPayload shape (including
the "chord" key and its expected content) or at minimum assert presence and
correctness of required keys like "chord" and "source" on
song["sections"][0]["roles"][2]["manualOverrides"][0]["value"]; reference the
song variable and the manualOverrides/HarmonyPayload contract so the test fails
if the value is malformed or has typos.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/sbom.yml:
- Around line 41-48: The workflow currently downloads and runs an unaudited Syft
binary in the "Install Syft" / "Generate CycloneDX SBOM" steps; modify the job
to (1) pin or bump the Syft version to a current stable release (replace v1.20.0
with the chosen version string used in the workflow), (2) download the release
artifacts and verify the SHA-256 checksum before extracting/executing (compute
and compare against a hardcoded checksum value you add to the workflow for the
syft_*.tar.gz file), and (3) add an entry for Syft into
supply-chain/supplemental-component-inventory.json including source URL,
version, SHA-256 checksum, and license fields to satisfy
docs/security/dependency-policy.md requirements; ensure the workflow errors out
if checksum verification fails.