epiphany/spec/CONTRACT_GENESIS_G3A_ENTITIES.md

# Contract: Genesis G3a — the four root-level entity mints

**Governed by** `spec/RULING_GENESIS_PERSISTENCE.md` and
`spec/PLAN_GENESIS_OPS.md` §4 (G3 split ratified 2026-07-29) and §6 (rulings 1,
2, 3 ratified 2026-07-29). Predecessor rung: G2b, signed off at `25c4733`.

**Scope.** Four operations that mint the four remaining root-level `Score`
entity vectors:

| Op | Kind | Tag | Carried type | `Score` field | `schema_major()` |
|---|---|---|---|---|---|
| `CreateStaffGroup` | 35 | 35 | `StaffGroup` | `staff_groups` | 0 |
| `CreatePartDefinition` | 36 | 36 | `PartDefinition` | `parts` | 0 |
| `CreateAnalysisLayer` | 37 | 37 | `AnalysisLayer` | `analysis_layers` | 0 |
| `CreateView` | 38 | 38 | `ViewDefinition` | `views` | 0 |

All four ride the `CreateStaff` set-union mint pattern (`reduce.rs:4075`) with
byte-identical re-carry idempotence. Epoch **11** for all four.

**Explicitly out of scope:** `CreateMeasure` (G3b), every delete (§6.1,
deferred), graph invariant 20 (G3b), any new `PreconditionFailureReason` (G3b),
and pruning or compaction of any kind (standing prohibition, see pin 9).

---

## 1. Why this rung exists — a live defect, not a completeness item

All five G3 object kinds become `Live` in the reducer's object map **only**
through base ingest (`reduce.rs:1449`–`:1563`). No operation mints any of them.
Two consequences hold in the tree today:

* `CreateStaff` validates `Staff.group` against a live `StaffGroup`
  (`reduce.rs:4372`). Under **from-empty** reduction — the path G1 created and
  T1b depends on — that precondition is **unsatisfiable**. A document built
  only from operations can never author a grouped staff.
* `TimeAnchor::Measure` (`reduce.rs:1280`) can never resolve from empty. That
  half is G3b's.

G3a completes the four root-level vectors. **It closes the satisfiability half
only** — §1.1 (ratified) rules that a bidirectionally consistent staff group
remains unauthorable in this packet, by design and on the record.

---

## 1.1 The pin, RESOLVED — `StaffGroup`/`Staff` authorship authority

**Ratified 2026-07-29: disposition B.** Drafted in the contract, decided by the
user — the shape G2b's `accidental_extensions` pin took.

### The cycle

`CreateStaff` requires its `group` to be a live `StaffGroup`
(`reduce.rs:4372`). `CreateStaffGroup` (pin 4) requires each of its `members`
to be a live `Staff`. Neither can name the other first, so **with mints only,
no authoring order produces a bidirectionally consistent group**:

* `CreateStaffGroup(g, members: [])` → `CreateStaff(s, group: Some(g))` leaves
  `s.group == Some(g)` while `g.members == []`.
* `CreateStaff(s, group: None)` → `CreateStaffGroup(g, members: [s])` leaves
  the mirror image, and re-carrying `CreateStaff` with `group: Some(g)` is
  `RecreateContentMismatch`, not an amendment.

There is no `ModifyStaffGroup` and no `ModifyStaff`, and deletes are deferred
(§6.1). So the inconsistency is not merely unchecked — **it is unrepairable
within this packet.**

### Why nothing in the tree decides it

Invariant 10 checks resolution in **both** directions independently — a staff's
group is declared (`invariants.rs:1188`), a group's members are declared
(`:1196`) — and **agreement in neither**. No agreement check exists anywhere in
the crate. The specification declares `StaffGroup.members`
(`core_spec.tex:4231`) and `Staff.group` (`:5585`, "Visual grouping: which
staff group (if any) this staff belongs to") without stating which is
authoritative or requiring them to agree. **This is genuinely unspecified, not
merely unimplemented.**

### Disposition A — `Staff.group` authoritative, `members` reduction-maintained

`CreateStaffGroup` mints identity, name, and kind, and MUST carry
`members: []`; a non-empty `members` is refused or normalized away at
construction (the "subset over normalization" choice G2b faced). Thereafter
`StaffGroup.members` is maintained **by reduction**: `create_staff` with
`group: Some(g)` appends to `g.members`. Fully authorable from empty; joining
is commutative and set-union, which fits the CRDT discipline.

Costs, stated honestly: it makes `members` a *derived* field of a stored type,
so byte-identical re-carry of `CreateStaffGroup` MUST compare against the
**carried** value (empty), never the current derived state — an explicit
sub-pin, and exactly the class of confusion `canonical_value!` cannot catch. It
also expands G3a beyond a pure mint packet, which is the property that made
this rung cheap.

### Disposition B — declare the authority, defer the enforcement — **RATIFIED**

Ratified 2026-07-29 with this precise meaning, which is **normative**:

* **`Staff.group` is the sole authority for membership.** Every consumer reads
  membership from `Staff.group`. Nothing may read `StaffGroup.members` to
  decide whether a staff is in a group.
* **`StaffGroup.members` is a non-authoritative denormalized projection.**
* **G3a stores it but neither maintains nor trusts it.** `CreateStaffGroup`
  carries `members` as given and validates resolution only (pin 4).
* **G3a permits both stale forms**, and they are equally permitted:
  * a **missing** member — `s.group == Some(g)` while `g.members` omits `s`;
  * a **spurious** member — `g.members` contains `s` while `s.group` is `None`
    or names a *different* group.

  An earlier draft named only the first. Naming only the missing-member form
  would have understated the ruling and left the spurious form looking like a
  bug rather than a permitted state.

**This is a normative semantic ruling, not a deferral of one.** The earlier
draft's argument for B — that it "adds no semantics" while A does — was wrong
and is withdrawn. B *assigns authority to a field the specification left
unranked*, which is a semantic change; what it defers is **enforcement**, not
meaning. The honest statement of B's advantage over A is narrower: it adds
semantics without adding *machinery*, leaving the mint a mint.

**Filed as P13-S16** (`spec/PASS13_CANDIDATES.md`) — the concrete gap, both
stale forms, the disposition-A fix, the candidate invariant 21, and the
instruction that consumers read `Staff.group` only. The earlier draft claimed
a "filed gap" while no such entry existed; it does now.

**Disposition A remains the later maintenance/enforcement fix**, sequenced
after G3b so an invariant append is not competing with invariant 20.

### What t8 must therefore claim

**t8's claim is narrowed** — see §4. The unqualified "the defect closes"
framing was wrong: what closes is that `CreateStaff.group`'s precondition
becomes *satisfiable*, not that a consistent group becomes *authorable*.

**t8 must pin both asymmetric authoring orders**, not only the first:

* `CreateStaffGroup(g, members: [])` → `CreateStaff(s, group: Some(g))`
  ⟹ `s.group == Some(g)`, `g.members == []` — the **missing** form;
* `CreateStaff(s, group: None)` → `CreateStaffGroup(g, members: [s])`
  ⟹ `g.members == [s]`, `s.group == None` — the **spurious** form.

Both must be asserted to *hold*, as permitted states under the ruling. A test
that pins only one leaves the other free to change silently.

---

## 2. Design pins

### Pin 1 — kinds and tags are 35–38, in **both** spaces, and they are aligned here

Next free is kind 35, tag 35 (`payload.rs:390`, `:714`, re-verified
2026-07-29). The two spaces are **not** aligned in general —
`OperationKind::discriminant()` is a hand-written match (`payload.rs:253`)
while `OperationKindTag` is macro-generated (`payload.rs:440`); `RespellPitch`
is kind 2 and tag 3. They happen to coincide from 24 upward. **Assign each
space explicitly and never derive one from the other**; pin 1's test asserts
both independently.

Assignment order is fixed as the table in §Scope: StaffGroup 35, PartDefinition
36, AnalysisLayer 37, View 38.

### Pin 2 — `schema_major()` gains **no arm**; the catch-all `_ => 0` is correct

This is G2a's shape, not G2b's. All four carried types have exactly one byte
layout: no versioned walk exists for any of them, and both `decode_v0_score`
(`codec.rs:2698`) and the live walk (`:3274`) read all four through plain
`Codec::dec`. **Adding them to the `=> 2` arm would be the bug.** Verify by
reading the walks, not by assuming.

Consequence: **no `epiphany-bundle` change of any kind.** The op-block
accept-set stays at 3 where G2b left it. If the implementation touches a bundle
file, something is wrong.

### Pin 3 — the four types need `canonical_value!` entries, and no other *code* change in core

Each already has a `Codec` — `struct_codec!(PartDefinition …)`
(`codec.rs:1790`), `AnalysisLayer` (`:1791`), `ViewDefinition` (`:1792`),
`StaffGroup` (`:2329`) — and each is already exported from `lib.rs`. **None is
in `canonical_value!`** (`codec.rs:3518`); G3a adds exactly four entries, in
the §Scope order, under one comment naming this contract.

`canonical_value!` introduces **no new byte layout** — it makes the existing
whole-score layout reachable per-value, and its generated `decode_canonical`
gives strict canonical-form enforcement (decode → `finish()` → re-encode →
reject on mismatch) for free.

**No `textvalue_graph.rs` work.** `struct_codec!` generates the `TextValue`
impl as well as the `Codec` (`codec.rs:510`, `:522`), so all four types already
project and parse. This is the one place G3a is *cheaper* than G2b, which had
to hand-write `TextValue for TuningContextSettings`. Confirm it by compiling,
not by assuming.

### Pin 4 — referential preconditions are **graph-aware**, mirroring `CreateStaff`

Per ruling §2, and copying `create_staff`'s structure (`reduce.rs:4102`–`:4125`)
including its `if self.graph.is_some()` guard — base-free reduction has no
universe to check against and MUST NOT enforce these:

| Op | Precondition | Failure reason |
|---|---|---|
| `CreateStaffGroup` | every `members[i]` is a live `Staff` | `TargetMissing` |
| `CreatePartDefinition` | every `staves[i]` is a live `Staff` | `TargetMissing` |
| `CreateAnalysisLayer` | *(none — no outbound references)* | — |
| `CreateView` | every `active_layers[i]` is a live `AnalysisLayer` | `TargetMissing` |

**Reuse `TargetMissing` (discriminant 0). Add no new
`PreconditionFailureReason`** — that space stays at 0–15 until G3b.

Mint preconditions are `CreateStaff`'s exactly: a live id re-carried with a
byte-identical value is `NoOp { AlreadyApplied }`; a live id with a differing
value is `NoOp { PreconditionFailedUnderReduction { RecreateContentMismatch } }`;
a tombstoned id is `NoOp { TargetTombstoned }`.

### Pin 4a — byte-identical re-carry needs a **carried-value map**, at seven sites each

The first draft of pin 4 promised re-carry idempotence without the machinery
that makes it work, which would have shipped the promise and not the property.
Comparing "the same value" requires *retaining* the value; the object map holds
only `Live`/`Tombstoned`.

Exactly three such maps exist today — `staff_values`,
`time_signature_values`, `instrument_values` (`reduce.rs:999`–`:1007`) — and
each is threaded through **seven** sites. G3a adds four more
(`staff_group_values`, `part_definition_values`, `analysis_layer_values`,
`view_values`), so this is **28 touch points**, none of which appeared in the
first draft's touch table:

| # | Site | Existing lines |
|---|---|---|
| 1 | reducer state declaration | `reduce.rs:999`–`:1007` |
| 2 | `WorkingSnapshot` declaration | `:1106`–`:1108` |
| 3 | initialization | `:1388`–`:1390` |
| 4 | **base seeding** in `seed_from_graph` | `:1437`, `:1445`, `:1460` |
| 5 | mint insertion in the reducer | `:4134`, `:4183`, `:4219` |
| 6 | snapshot | `:7637`–`:7639` |
| 7 | restore | `:7677`–`:7679` |

**Site 4 is the one that fails silently.** Without a base seed, a re-carry
against an entity that came from the *base* score — not from the log — finds no
retained value and misclassifies. G1 already documents this exact hazard and
its mutation for `instrument_values` (`reduce.rs:13264`–`:13268`); copy that
shape. **Each of the four omitted seeds must be killed separately** (t13), and
a base-recarry test must exist (t5b) — a re-carry test that only ever reduces
from empty cannot see a missing seed at all.

**The packet is self-contained**: `CreateView`'s precondition target is minted
by `CreateAnalysisLayer` in this same packet, so the ordering is testable
end-to-end without a base score.

### Pin 4b — §1.1's ruling MUST land on the normative surfaces, not only here

**A normative ruling that lives only in a contract and a candidate ledger is
not normative.** §1.1 assigns authority; until the specification and the field
declarations say so, the normative record stays ambiguous and every reader
outside this packet is entitled to the opposite reading. Pin 3's "nothing else
in core" is therefore **narrowed to the codec surface only** — §1.1 adds a
documentation obligation to `graph.rs`, and pin 8's four-document ritual gains
two specific normative additions.

Required, all four:

| Site | What it must say |
|---|---|
| `core/src/graph.rs:848` — `Staff.group` | **Currently has no doc comment at all.** Write one: this field is the **sole authority** for group membership. |
| `core/src/graph.rs:1650` — `StaffGroup.members` | **Currently has no doc comment at all.** Write one: a **non-authoritative denormalized projection**; MUST NOT be read to decide membership; may be stale in **both** directions. |
| `core_spec.tex` — the `Staff`/`StaffGroup` declarations (`:5564`, `:4231`) | The same authority rule, normatively. This is the document that declared both fields without ranking them, so this is where the ambiguity actually lives. |
| `operation_catalog.tex` — the **new** `CreateStaffGroup` section **and** the **existing** `CreateStaff` section (`:1104`) | Explicit stale-form semantics: both the missing and the spurious form are **permitted outcomes**, named as such, with the authoring orders that produce them. `CreateStaff` needs it too — it is the operation that *creates* the missing form, and its section currently promises nothing about the projection. |

Cross-reference **P13-S16** from each, so a reader who meets the disagreement
finds the ruling rather than filing it again.

### Pin 5 — every precondition must correspond to an existing invariant-10 check

Invariant 10's **body** already resolves a staff's group, a group's members, a
part's staves, and a view's active layers (`core/src/invariants.rs:1122`–`:1156`).
The reducer's new preconditions and that checker must agree: **a score reduced
from empty through these operations MUST pass `check_invariants`.** This is the
oracle, and it is stronger than any assertion the reducer can make about itself.

### Pin 6 — the invariant-10 **prose** reconciliation (§6.3), and it is doc-only

Invariant 10's doc comment (`invariants.rs:59`–`:62`) names only cross-cutting
structures and event-internal references. Its body checks materially more: the
four reference classes above, plus measure and grid time-signature references
(`:1180`–`:1212`). **G3a repairs the doc comment to describe what the check
actually enforces.**

**No enum entry, no discriminant, no behaviour change, no `all()` count
change.** `GraphInvariant` stays at 19. It does not reach the wire — no
reference from `epiphany-ops` or `epiphany-bundle` — so this is not a schema
event. Invariant 20 is G3b's.

### Pin 7 — G-minor interaction: all four kinds carry epoch 11

`introduced_minor()` returns `Option<u16>` and has **no wildcard arm** by
design, so a new variant cannot compile without an epoch. All four take
`Some(11)` — one epoch for one additive event, per the ratified policy
(`spec/PLAN_GMINOR_SCHEMA_MINOR.md` §4); G2a's precedent put two kinds at the
single epoch 9.

**The sentinel must not be 0.** `0` is a real baseline minor for V1–V3.

Two sites, both required: the `@ Some(11)` annotations in the tag vocabulary
(`payload.rs:714` region) and the ratified-table transcription in test `s1`
(`payload.rs:2475` region). **An epoch omitted from the s1 table is an epoch
that test cannot see go wrong** — that comment is already in the file; honour it.

Append the epoch-11 row to `spec/PLAN_GMINOR_SCHEMA_MINOR.md` §4's ladder,
naming the introducing commit once it exists.

### Pin 8 — the four-document append ritual applies in full

An operation-vocabulary append is a documented event in **four** specification
documents. G1 shipped five normative falsehoods by declaring them out of scope;
that is not repeatable.

**Two of the four carry pin 4b's normative additions on top of the routine
sweep**: `core_spec.tex` gains the authority rule at the `Staff`/`StaffGroup`
declarations, and `operation_catalog.tex` gains explicit stale-form semantics
in **both** the new `CreateStaffGroup` section and the existing `CreateStaff`
section (`:1104`). Neither is optional, and neither is satisfied by the routine
append alone.

* `operation_catalog.tex` — a `\section` per kind (four), version bump,
  changelog paragraph.
* `binary_format.tex` — payload-layout and tag rows per kind, version bump,
  Revision History row.
* `core_spec.tex` — the normative `OperationKind`/`OperationKindTag` listings
  and the spelled-out payload counts.
* `text_projection.tex` — four new kind productions are a document-surface
  change, so `COMPANION_VERSION` bumps **0.11.0 → 0.12.0**, re-sweeping five
  live version sites plus a changelog row and re-flipping the negative
  `superseded_companion_version` vector so it rejects **0.11.0**.
  **The tree is already at 0.11.0** — G2b bumped it (`textproj/src/lib.rs:47`
  and its doc comment). An earlier draft of this contract repeated G2b's
  0.10.0 → 0.11.0, which would have re-declared the current version as new and
  left the negative vector rejecting a version no longer superseded.

Use `\sectionsc{...}` for cross-document references. **`\ref` cannot cross
documents** — `operation_catalog.tex` shipped an undefined reference that way.

Regenerate all four PDFs; they are tracked.

### Pin 9 — explicit non-goal: G3a authorizes **no** pruning or compaction

The standing prohibition holds and has had real teeth since G2b: pruning would
discard **authored** genesis state, not merely re-derivable state. G3a adds
four more authored families to that surface. Blocked on disposition C.

### Pin 10 — P13-S15 stays open, and these kinds stay outside the golden lock

The `[(OperationKind, u8); 30]` golden lock (`payload.rs:2011`) ends at
discriminant 29. Kinds 35–38 are **outside** it, exactly as 30–34 already are.
**Do not extend the lock in this packet.** P13-S15 lands as its own rung with
its own mutation evidence; widening it here would ship the extension without
that evidence.

---

## 3. Touch table

Derived from `git show 3b09595 --name-only` (G1, the closest mint precedent)
and `git show 13c3d2f --name-only` (G2b), minus what pins 2 and 3 exclude.
Every line number below re-verified against the working tree 2026-07-29.

### Core

| File | What |
|---|---|
| `crates/epiphany-core/src/codec.rs` | four `canonical_value!` entries (`:3518` list) |
| `crates/epiphany-core/src/invariants.rs` | pin 6: invariant-10 doc comment (`:59`–`:62`) |
| `crates/epiphany-core/src/graph.rs` | **pin 4b**: write the authority doc comment on `Staff.group` (`:848`) and the projection doc comment on `StaffGroup.members` (`:1650`) — **neither field is documented today** |
| `crates/epiphany-core/DECISIONS.md` | the rung's record |

**Not touched:** `textvalue_graph.rs` (pin 3), `lib.rs` (already exported). No
*type* changes anywhere in core — `graph.rs` gains documentation only, per pin
4b; the four carried types already exist unchanged.

### Ops

| File | What |
|---|---|
| `crates/epiphany-ops/src/payload.rs` | four op structs + `CanonicalEncode`; `OperationKind` variants; `discriminant()` (`:390` region); `schema_major()` — **no arm**, pin 2; `introduced_minor()` (`:449` region); `tag()` (`:497` region); `encode_canonical` (`:543` region); tag vocabulary `@ Some(11)` (`:714` region); s1 epoch table (`:2475` region) |
| `crates/epiphany-ops/src/envdecode.rs` | decode arms (`:599` region) and the tag-dispatch arms (`:901` region), plus validation |
| `crates/epiphany-ops/src/reduce.rs` | four dispatch arms + four mint reducers, on `create_staff`'s shape (`:4075`, `:4148`); **plus four carried-value maps at seven sites each — 28 touch points, see pin 4a** |
| `crates/epiphany-ops/src/textproj_kind.rs` | production arms (`:232` region) **and** parse arms (`:572` region) |
| `crates/epiphany-ops/src/migrate.rs` | both directions (`:192`, `:356` regions) |
| `crates/epiphany-ops/src/v0.rs` | `V0OperationKind` variants (`:118` region) |
| `crates/epiphany-ops/src/fuzz.rs` | generator arms (`:304` region) |
| `crates/epiphany-ops/src/valuegen.rs` | value generators |
| `crates/epiphany-ops/src/vectors.rs` | four envelope decode vectors, pinned to **literal bytes** (trap 4) |
| `crates/epiphany-ops/src/lib.rs` | re-exports (`:135` region) |
| `crates/epiphany-ops/DECISIONS.md` | the rung's record |

### Boundary crossings — budgeted up front (trap 6)

An `OperationKind` append is **not** containable to core + ops. **Six
crossings: one exhaustive-match site plus five literal/prose sentinels.** All
six re-verified 2026-07-29; earlier revisions of the plan carried three drifted
citations, and earlier revisions of this contract alternated between five and
six by counting the exhaustive-match site inconsistently.

The two classes fail differently, which is why they are counted together but
named apart. The **exhaustive-match** site fails loudly — the workspace will
not compile. The five **sentinels** fail silently: each stays green while
meaning something narrower than it says.

| File | What | Why it bites |
|---|---|---|
| `crates/epiphany-editor-core/src/barriers.rs` | four arms in `subjects_of` (`:313`, pattern at `:444`) | Rust exhaustiveness; testkit depends on editor-core, so a missing arm blocks conformance **and** `requirement_labels` — the gate cannot run at all |
| `crates/epiphany-layout-ir/src/barrier.rs` | the "one past the vocabulary" tag `35` → `39` (`:1156`, assertion at `:1170`/`:1176`) and its comment | Deliberately a literal; unbumped, it pins a bug — a barrier prohibiting a new op encodes fine and cannot read back |
| `crates/epiphany-testkit/tests/text_projection_grammar.rs` | count `35` → `39` and the message string (`:315`) | Hand-maintained literal parallel to a derived list |
| `crates/epiphany-testkit/src/generators.rs` | drawn range `30..=34` → `30..=38` (`:1908`) and the never-drawn guard (`:1947`) | A kind never drawn is a kind never fuzzed |
| `crates/epiphany-testkit/src/layout_stub.rs` | the `30..=34` range in the s10/row-29 comment (`:1373`) | Prose, but it states the coverage claim the test rests on; stale text here is how a narrowed guard reads as a broad one |
| `crates/epiphany-textproj/src/vectors.rs` | the negative vector whose "wrong version" moves with each bump | Silently passes for the wrong reason otherwise |

**Both `barriers.rs` and `barrier.rs` are editor-track files.** Authorization
is per-packet and **does not generalise**. Granted 2026-07-29, narrowly:

* `barriers.rs` — **the four required exhaustive `subjects_of` arms, and
  nothing else.**
* `barrier.rs` — **the invalid-tag literal, its comment, and its assertions,
  35 → 39, and nothing else.**

**No other change in either crate is authorized by this packet.** If the
workspace appears to need one, stop and report rather than widening.

### Text projection

| File | What |
|---|---|
| `crates/epiphany-textproj/src/lib.rs` | `COMPANION_VERSION` **0.11.0 → 0.12.0** (`:47`) and the live version sites |
| `crates/epiphany-textproj/src/parse.rs` | kind productions |
| `crates/epiphany-textproj/src/vectors.rs` | four positive document vectors + the negative-vector flip |

**Bind vector sources by name, never by positional index.** Inserting a
document repointed positionally-bound negative vectors in G2b and broke
generation. `by_name(...)` exists for this.

**Do not conflate version domains.** A corpus fixture's
`manifest_schema_version` is the *manifest's* version, not the epoch a block
requires. G2b shipped `SchemaVersion::new(0, 10)` here with a comment making
exactly the inference `text_projection.tex:1367` forbids. Use
`SchemaVersion::V0`.

### Normative documents (pin 8)

`spec/operation_catalog.tex` + `.pdf`, `spec/binary_format.tex` + `.pdf`,
`spec/core_spec.tex` + `.pdf`, `spec/text_projection.tex` + `.pdf`.

### Vectors and tracking

`spec/vectors/decode_vectors.txt`, `spec/vectors/textproj_document_vectors.txt`
(regenerated; any hardcoded corpus **count** moves with them),
`spec/PLAN_GENESIS_OPS.md`, `spec/PLAN_GMINOR_SCHEMA_MINOR.md` §4.

---

## 4. Tests — each with the mutation that must kill it

Each row names a mutation that MUST be **observed failing** and then reversed
**by editing back** — never `git checkout`, never `git stash`. A mutation that
does not compile produces no test output and signs nothing. A mutation absorbed
by the compiler (e.g. deleting a match arm) proves nothing about the test:
prefer a mutation that keeps the workspace compiling and isolates the behaviour
under test. **A shared mutation that leaves a test green signs nothing** — the
t9 lesson from G2b.

| # | Test | Mutation that must kill it |
|---|---|---|
| t1 | All four kinds and tags are 35–38 in **both** spaces, and the discriminant byte leads each canonical encoding | Move any one kind to 39; then, separately, move its tag. Both must fail — the spaces are asserted independently (pin 1) |
| t2 | `schema_major()` returns **0** for all four | Add them to the `=> 2` arm; must fail (pin 2's stated bug) |
| t3 | A block containing all four stamps major **0**, and the op-block accept-set is untouched at 3 | Make one kind report major 2; must fail |
| t4 | Each op round-trips through `encode` → `envdecode` → reduce, byte-identical, with its decode vector pinned to **literal bytes** | **Four independent mutations, one per carried type** — swap two fields in each `struct_codec!` declaration: `PartDefinition { id, name, staves }` → `{ id, staves, name }` (`core/src/codec.rs:1790`), and likewise `AnalysisLayer` (`:1791`), `ViewDefinition` (`:1792`), `StaffGroup` (`:2329`). Each type's literal-byte vector must fail on its own. **These are four separate layouts; one mutation signs one of them.** Collapse to a single mutation only if the implementation consolidates all four behind one shared mechanism, and say so explicitly if it does. *(A create op's `encode_canonical` is a single `push_lp_bytes` line over one carried value, so there is nothing in the op to reorder — the first draft's mutation was impossible. The reorder must go where the layout actually lives, and because `struct_codec!` moves both halves at once it is self-consistent and passes round-trip tests: trap 4, the 3b-i lesson. Literal-byte vectors are the only thing that catches it.)* |
| t5 | Re-carrying a live id with a **byte-identical** value is `AlreadyApplied`; with a **differing** value is `RecreateContentMismatch`; a tombstoned id is `TargetTombstoned` | Return `Applied` for the differing-value case; must fail |
| t5b | **Re-carry against a base-derived entity**: reduce `new_onto` a score whose four vectors are already populated, re-carry each byte-identically, and get `AlreadyApplied` | Covered by t13 per-seed. A re-carry test that only reduces from empty **cannot see a missing base seed at all** — that is why this row is separate from t5 |
| t6 | All three referential loops refuse under a graph, **each asserted separately**: `CreateStaffGroup.members`, `CreatePartDefinition.staves`, and `CreateView.active_layers` naming a non-live target are each `TargetMissing` | **Three independent mutations**, one per loop: drop the members loop from `create_staff_group`; drop the staves loop from `create_part_definition`; drop the active-layers loop from `create_view`. Each must fail on its own row. *(The first draft omitted `PartDefinition.staves` entirely — one uncovered loop is one loop that can be deleted green.)* |
| t7 | Those same preconditions are **not** enforced base-free | Remove the `if self.graph.is_some()` guard from one reducer; must fail — base-free has no universe to check against |
| t8 | From empty, `CreateInstrument` → `CreateStaffGroup` → `CreateStaff` **with `group: Some(...)`** succeeds and reaches a note — i.e. `CreateStaff`'s group precondition becomes **satisfiable**. **Claim narrowed per §1.1: this asserts satisfiability, NOT that a bidirectionally consistent group is authorable** | Replace the `CreateStaffGroup` dispatch arm with `OperationKind::CreateStaffGroup(_) => OperationEffect::Applied`, keeping the match exhaustive; must fail at the grouped-staff assertion while the spine stays applied |
| t8b | **Both permitted stale forms are pinned** (§1.1): the missing form (`CreateStaffGroup(g, [])` → `CreateStaff(s, Some(g))` ⟹ `s.group == Some(g)`, `g.members == []`) and the spurious form (`CreateStaff(s, None)` → `CreateStaffGroup(g, [s])` ⟹ `g.members == [s]`, `s.group == None`). Both asserted to **hold**, as states the ruling permits | **Two mutations, each in the reducer that actually runs second in its order.** Missing form → mutate **`create_staff`**: when `group` is `Some(g)`, append the newly minted staff to `g.members` (disposition A's maintenance rule); the missing-form assertion must fail. Spurious form → mutate **`create_staff_group`**: reject or normalize away a non-empty carried `members`; the spurious-form assertion must fail. *(An earlier draft assigned these the other way round, which is impossible in both directions: `create_staff_group` runs first in the missing order and cannot append a staff that does not exist yet, and `create_staff` runs first in the spurious order and has no later group to repair. A mutation in the operation that runs first cannot reach the state the assertion names.)* **A test pinning only one order leaves the other free to change silently** |
| t9 | A score reduced from empty through all four ops **passes `check_invariants`**, and each skipped reducer check **independently** makes invariant 10 fire (pin 5) | **The fixture is constant across all mutations**: the baseline input already attempts a dangling reference in each of the three loops, and passes because the reducer refuses them. Then mutate **only production**, one skipped check at a time — three separate mutations, each of which must let its dangling reference through and make invariant 10 fire. *(The first draft moved the fixture and the production code together, which proves only that a hand-built bad score fails a checker — not that the reducer's refusal is what was holding the line.)* |
| t10 | All four kinds carry **epoch 11**, and a block containing them stamps minor **11** | Assign epoch 10 to one kind; must fail. Run against **both** epoch sites separately (vocabulary annotation, s1 table) — each must be independently able to fail |
| t11 | Text projection round-trips all four kinds, and the companion version is **0.12.0**, with the negative vector rejecting **0.11.0** | Drop one parse arm; must fail. Separately, leave `COMPANION_VERSION` at 0.11.0; the negative vector must fail |
| t12 | Invariant 10's doc comment names the four reference classes its body checks (pin 6) | Grep-assert the repaired prose is present **within the invariant-10 doc block only** — slice the source from the `/// 10.` line to the `CrossCuttingRefsResolve,` line and search *that*. Revert the comment to see it fail. **Searching the whole file passes on the implementation body**, which contains the same identifiers the doc comment is supposed to gain — a guard that cannot fail |
| t13 | **Each of the four base seeds is load-bearing** (pin 4a, site 4) | **Four separate mutations**: skip seeding each of `staff_group_values`, `part_definition_values`, `analysis_layer_values`, `view_values` in `seed_from_graph`, one at a time. Each must make t5b fail. Model on G1's documented precedent for `instrument_values` (`reduce.rs:13264`–`:13268`) |
| t14 | **The authority rule reached the field declarations** (pin 4b): `Staff.group`'s doc comment states it is authoritative, and `StaffGroup.members`' states it is a non-authoritative projection that may be stale in both directions | Grep-assert each, **slicing to that field's doc block only** — same discipline as t12, since `graph.rs` mentions both identifiers throughout and a file-wide search cannot fail. Delete either doc comment to see the corresponding assertion fail. *(The `.tex` halves of pin 4b are not machine-checkable here; they are gate items, reported explicitly.)* |

**On t12's grep shape:** a self-matching needle is a real hazard — G2b hit it
twice, once when a multi-line needle matched the test's own source and once
when the assertion *message* contained the searched phrase. Keep the needle
short, keep it out of the message, and if the guard reads more than one file,
iterate `include_str!` over each.

---

## 5. Gate

* `cargo test --workspace` — full pass, zero failures, with the count reported.
* `cargo clippy --workspace --all-targets` — zero warnings.
* `cargo fmt --check` — clean.
* `git diff --check` — clean.
* All four PDFs regenerated; no undefined LaTeX references.
* Every t-row mutation **observed failing** and reversed by editing back, with
  the observed failure quoted. **Not** "would fail".
* **Stage only the files in §3's touch table, explicitly named.** Never
  `git add -A`. The editor track has parallel work in `spikes/` and elsewhere
  that MUST NOT be staged.

## 6. Report

State, with evidence: kinds/tags assigned and the two spaces asserted
separately; that `schema_major()` gained **no** arm and no bundle file was
touched; the four `canonical_value!` entries; that `textvalue_graph.rs` needed
no change; **the four carried-value maps at all seven sites each, named site by
site**; each of the three referential loops and its invariant-10
correspondence; **that §1.1's ruling reached all four pin-4b sites — both field
doc comments, `core_spec.tex`, and both `operation_catalog.tex` sections —
quoting the text written at each**, and what t8 therefore does and does not
claim; epoch 11 at both sites; the companion bump
0.11.0 → 0.12.0 with the negative vector rejecting 0.11.0; the four-document
sweep; and the six boundary crossings — the one exhaustive-match site and the
five sentinels, each with its new value. Report
each mutation's **observed** output — t6, t9, and t13 are multi-mutation rows
and each sub-mutation must be reported separately. Anything not done, say so
plainly.