epiphany/spec/CONTRACT_GENESIS_G3A_ENTITIES.md

# Contract: Genesis G3a — the four root-level entity mints

**Governed by** `spec/RULING_GENESIS_PERSISTENCE.md` and
`spec/PLAN_GENESIS_OPS.md` §4 (G3 split ratified 2026-07-29) and §6 (rulings 1,
2, 3 ratified 2026-07-29). Predecessor rung: G2b, signed off at `25c4733`.

**Scope.** Four operations that mint the four remaining root-level `Score`
entity vectors:

| Op | Kind | Tag | Carried type | `Score` field | `schema_major()` |
|---|---|---|---|---|---|
| `CreateStaffGroup` | 35 | 35 | `StaffGroup` | `staff_groups` | 0 |
| `CreatePartDefinition` | 36 | 36 | `PartDefinition` | `parts` | 0 |
| `CreateAnalysisLayer` | 37 | 37 | `AnalysisLayer` | `analysis_layers` | 0 |
| `CreateView` | 38 | 38 | `ViewDefinition` | `views` | 0 |

All four ride the `CreateStaff` set-union mint pattern (`reduce.rs:4075`) with
byte-identical re-carry idempotence. Epoch **11** for all four.

**Explicitly out of scope:** `CreateMeasure` (G3b), every delete (§6.1,
deferred), graph invariant 20 (G3b), any new `PreconditionFailureReason` (G3b),
and pruning or compaction of any kind (standing prohibition, see pin 9).

---

## 1. Why this rung exists — a live defect, not a completeness item

All five G3 object kinds become `Live` in the reducer's object map **only**
through base ingest (`reduce.rs:1449`–`:1563`). No operation mints any of them.
Two consequences hold in the tree today:

* `CreateStaff` validates `Staff.group` against a live `StaffGroup`
  (`reduce.rs:4119`). Under **from-empty** reduction — the path G1 created and
  T1b depends on — that precondition is **unsatisfiable**. A document built
  only from operations can never author a grouped staff.
* `TimeAnchor::Measure` (`reduce.rs:1280`) can never resolve from empty. That
  half is G3b's.

G3a completes the four root-level vectors. **How much of the staff-group half
it closes depends on §1.1, which is unresolved.**

---

## 1.1 The pin, UNRESOLVED — `StaffGroup`/`Staff` authorship authority

**Must be ratified before dispatch.** Drafted in the contract, decided by the
user — the shape G2b's `accidental_extensions` pin took.

### The cycle

`CreateStaff` requires its `group` to be a live `StaffGroup`
(`reduce.rs:4117`). `CreateStaffGroup` (pin 4) requires each of its `members`
to be a live `Staff`. Neither can name the other first, so **with mints only,
no authoring order produces a bidirectionally consistent group**:

* `CreateStaffGroup(g, members: [])` → `CreateStaff(s, group: Some(g))` leaves
  `s.group == Some(g)` while `g.members == []`.
* `CreateStaff(s, group: None)` → `CreateStaffGroup(g, members: [s])` leaves
  the mirror image, and re-carrying `CreateStaff` with `group: Some(g)` is
  `RecreateContentMismatch`, not an amendment.

There is no `ModifyStaffGroup` and no `ModifyStaff`, and deletes are deferred
(§6.1). So the inconsistency is not merely unchecked — **it is unrepairable
within this packet.**

### Why nothing in the tree decides it

Invariant 10 checks resolution in **both** directions independently — a staff's
group is declared (`invariants.rs:1126`), a group's members are declared
(`:1135`) — and **agreement in neither**. No agreement check exists anywhere in
the crate. The specification declares `StaffGroup.members`
(`core_spec.tex:4231`) and `Staff.group` (`:5578`, "Visual grouping: which
staff group (if any) this staff belongs to") without stating which is
authoritative or requiring them to agree. **This is genuinely unspecified, not
merely unimplemented.**

### Disposition A — `Staff.group` authoritative, `members` reduction-maintained

`CreateStaffGroup` mints identity, name, and kind, and MUST carry
`members: []`; a non-empty `members` is refused or normalized away at
construction (the "subset over normalization" choice G2b faced). Thereafter
`StaffGroup.members` is maintained **by reduction**: `create_staff` with
`group: Some(g)` appends to `g.members`. Fully authorable from empty; joining
is commutative and set-union, which fits the CRDT discipline.

Costs, stated honestly: it makes `members` a *derived* field of a stored type,
so byte-identical re-carry of `CreateStaffGroup` MUST compare against the
**carried** value (empty), never the current derived state — an explicit
sub-pin, and exactly the class of confusion `canonical_value!` cannot catch. It
also expands G3a beyond a pure mint packet, which is the property that made
this rung cheap.

### Disposition B — declare the authority, defer the enforcement

`Staff.group` is authoritative; `StaffGroup.members` is a denormalized
projection that **G3a does not maintain**. `CreateStaffGroup` carries `members`
as given and validates resolution only. Bidirectional agreement is stated as a
**known, filed gap** — a P13 candidate and a candidate invariant 21 — and G3a
claims nothing about it.

Cost: a from-empty score can hold a grouped staff whose group lists no members.
That is *incomplete* data under a stated deferral, not silently wrong data —
but it is real, and the contract must not describe the defect as closed.

### Recommendation

**Disposition B**, and narrow the claim to match. A is the better end state,
but it invents an authoritative/derived split the specification does not make,
in the packet whose entire value is that it moves no bound and adds no
semantics. Ruling the authority now costs nothing and unblocks A later;
implementing A here buys a consistency property no consumer reads yet, at the
cost of turning a mint into a mint-plus-maintenance.

**Under either disposition, t8's claim is narrowed** — see §4. The unqualified
"the defect closes" framing was wrong: what closes is that
`CreateStaff.group`'s precondition becomes *satisfiable*, not that a consistent
group becomes *authorable*.

---

## 2. Design pins

### Pin 1 — kinds and tags are 35–38, in **both** spaces, and they are aligned here

Next free is kind 35, tag 35 (`payload.rs:390`, `:714`, re-verified
2026-07-29). The two spaces are **not** aligned in general —
`OperationKind::discriminant()` is a hand-written match (`payload.rs:253`)
while `OperationKindTag` is macro-generated (`payload.rs:440`); `RespellPitch`
is kind 2 and tag 3. They happen to coincide from 24 upward. **Assign each
space explicitly and never derive one from the other**; pin 1's test asserts
both independently.

Assignment order is fixed as the table in §Scope: StaffGroup 35, PartDefinition
36, AnalysisLayer 37, View 38.

### Pin 2 — `schema_major()` gains **no arm**; the catch-all `_ => 0` is correct

This is G2a's shape, not G2b's. All four carried types have exactly one byte
layout: no versioned walk exists for any of them, and both `decode_v0_score`
(`codec.rs:2698`) and the live walk (`:3274`) read all four through plain
`Codec::dec`. **Adding them to the `=> 2` arm would be the bug.** Verify by
reading the walks, not by assuming.

Consequence: **no `epiphany-bundle` change of any kind.** The op-block
accept-set stays at 3 where G2b left it. If the implementation touches a bundle
file, something is wrong.

### Pin 3 — the four types need `canonical_value!` entries, and nothing else in core

Each already has a `Codec` — `struct_codec!(PartDefinition …)`
(`codec.rs:1790`), `AnalysisLayer` (`:1791`), `ViewDefinition` (`:1792`),
`StaffGroup` (`:2329`) — and each is already exported from `lib.rs`. **None is
in `canonical_value!`** (`codec.rs:3518`); G3a adds exactly four entries, in
the §Scope order, under one comment naming this contract.

`canonical_value!` introduces **no new byte layout** — it makes the existing
whole-score layout reachable per-value, and its generated `decode_canonical`
gives strict canonical-form enforcement (decode → `finish()` → re-encode →
reject on mismatch) for free.

**No `textvalue_graph.rs` work.** `struct_codec!` generates the `TextValue`
impl as well as the `Codec` (`codec.rs:510`, `:522`), so all four types already
project and parse. This is the one place G3a is *cheaper* than G2b, which had
to hand-write `TextValue for TuningContextSettings`. Confirm it by compiling,
not by assuming.

### Pin 4 — referential preconditions are **graph-aware**, mirroring `CreateStaff`

Per ruling §2, and copying `create_staff`'s structure (`reduce.rs:4102`–`:4125`)
including its `if self.graph.is_some()` guard — base-free reduction has no
universe to check against and MUST NOT enforce these:

| Op | Precondition | Failure reason |
|---|---|---|
| `CreateStaffGroup` | every `members[i]` is a live `Staff` | `TargetMissing` |
| `CreatePartDefinition` | every `staves[i]` is a live `Staff` | `TargetMissing` |
| `CreateAnalysisLayer` | *(none — no outbound references)* | — |
| `CreateView` | every `active_layers[i]` is a live `AnalysisLayer` | `TargetMissing` |

**Reuse `TargetMissing` (discriminant 0). Add no new
`PreconditionFailureReason`** — that space stays at 0–15 until G3b.

Mint preconditions are `CreateStaff`'s exactly: a live id re-carried with a
byte-identical value is `NoOp { AlreadyApplied }`; a live id with a differing
value is `NoOp { PreconditionFailedUnderReduction { RecreateContentMismatch } }`;
a tombstoned id is `NoOp { TargetTombstoned }`.

### Pin 4a — byte-identical re-carry needs a **carried-value map**, at seven sites each

The first draft of pin 4 promised re-carry idempotence without the machinery
that makes it work, which would have shipped the promise and not the property.
Comparing "the same value" requires *retaining* the value; the object map holds
only `Live`/`Tombstoned`.

Exactly three such maps exist today — `staff_values`,
`time_signature_values`, `instrument_values` (`reduce.rs:999`–`:1007`) — and
each is threaded through **seven** sites. G3a adds four more
(`staff_group_values`, `part_definition_values`, `analysis_layer_values`,
`view_values`), so this is **28 touch points**, none of which appeared in the
first draft's touch table:

| # | Site | Existing lines |
|---|---|---|
| 1 | reducer state declaration | `reduce.rs:999`–`:1007` |
| 2 | `WorkingSnapshot` declaration | `:1106`–`:1108` |
| 3 | initialization | `:1388`–`:1390` |
| 4 | **base seeding** in `seed_from_graph` | `:1437`, `:1445`, `:1460` |
| 5 | mint insertion in the reducer | `:4134`, `:4183`, `:4219` |
| 6 | snapshot | `:7637`–`:7639` |
| 7 | restore | `:7677`–`:7679` |

**Site 4 is the one that fails silently.** Without a base seed, a re-carry
against an entity that came from the *base* score — not from the log — finds no
retained value and misclassifies. G1 already documents this exact hazard and
its mutation for `instrument_values` (`reduce.rs:13264`–`:13268`); copy that
shape. **Each of the four omitted seeds must be killed separately** (t13), and
a base-recarry test must exist (t5b) — a re-carry test that only ever reduces
from empty cannot see a missing seed at all.

**The packet is self-contained**: `CreateView`'s precondition target is minted
by `CreateAnalysisLayer` in this same packet, so the ordering is testable
end-to-end without a base score.

### Pin 5 — every precondition must correspond to an existing invariant-10 check

Invariant 10's **body** already resolves a staff's group, a group's members, a
part's staves, and a view's active layers (`core/src/invariants.rs:1122`–`:1156`).
The reducer's new preconditions and that checker must agree: **a score reduced
from empty through these operations MUST pass `check_invariants`.** This is the
oracle, and it is stronger than any assertion the reducer can make about itself.

### Pin 6 — the invariant-10 **prose** reconciliation (§6.3), and it is doc-only

Invariant 10's doc comment (`invariants.rs:59`–`:62`) names only cross-cutting
structures and event-internal references. Its body checks materially more: the
four reference classes above, plus measure and grid time-signature references
(`:1180`–`:1212`). **G3a repairs the doc comment to describe what the check
actually enforces.**

**No enum entry, no discriminant, no behaviour change, no `all()` count
change.** `GraphInvariant` stays at 19. It does not reach the wire — no
reference from `epiphany-ops` or `epiphany-bundle` — so this is not a schema
event. Invariant 20 is G3b's.

### Pin 7 — G-minor interaction: all four kinds carry epoch 11

`introduced_minor()` returns `Option<u16>` and has **no wildcard arm** by
design, so a new variant cannot compile without an epoch. All four take
`Some(11)` — one epoch for one additive event, per the ratified policy
(`spec/PLAN_GMINOR_SCHEMA_MINOR.md` §4); G2a's precedent put two kinds at the
single epoch 9.

**The sentinel must not be 0.** `0` is a real baseline minor for V1–V3.

Two sites, both required: the `@ Some(11)` annotations in the tag vocabulary
(`payload.rs:714` region) and the ratified-table transcription in test `s1`
(`payload.rs:2475` region). **An epoch omitted from the s1 table is an epoch
that test cannot see go wrong** — that comment is already in the file; honour it.

Append the epoch-11 row to `spec/PLAN_GMINOR_SCHEMA_MINOR.md` §4's ladder,
naming the introducing commit once it exists.

### Pin 8 — the four-document append ritual applies in full

An operation-vocabulary append is a documented event in **four** specification
documents. G1 shipped five normative falsehoods by declaring them out of scope;
that is not repeatable.

* `operation_catalog.tex` — a `\section` per kind (four), version bump,
  changelog paragraph.
* `binary_format.tex` — payload-layout and tag rows per kind, version bump,
  Revision History row.
* `core_spec.tex` — the normative `OperationKind`/`OperationKindTag` listings
  and the spelled-out payload counts.
* `text_projection.tex` — four new kind productions are a document-surface
  change, so `COMPANION_VERSION` bumps **0.11.0 → 0.12.0**, re-sweeping five
  live version sites plus a changelog row and re-flipping the negative
  `superseded_companion_version` vector so it rejects **0.11.0**.
  **The tree is already at 0.11.0** — G2b bumped it (`textproj/src/lib.rs:47`
  and its doc comment). An earlier draft of this contract repeated G2b's
  0.10.0 → 0.11.0, which would have re-declared the current version as new and
  left the negative vector rejecting a version no longer superseded.

Use `\sectionsc{...}` for cross-document references. **`\ref` cannot cross
documents** — `operation_catalog.tex` shipped an undefined reference that way.

Regenerate all four PDFs; they are tracked.

### Pin 9 — explicit non-goal: G3a authorizes **no** pruning or compaction

The standing prohibition holds and has had real teeth since G2b: pruning would
discard **authored** genesis state, not merely re-derivable state. G3a adds
four more authored families to that surface. Blocked on disposition C.

### Pin 10 — P13-S15 stays open, and these kinds stay outside the golden lock

The `[(OperationKind, u8); 30]` golden lock (`payload.rs:2011`) ends at
discriminant 29. Kinds 35–38 are **outside** it, exactly as 30–34 already are.
**Do not extend the lock in this packet.** P13-S15 lands as its own rung with
its own mutation evidence; widening it here would ship the extension without
that evidence.

---

## 3. Touch table

Derived from `git show 3b09595 --name-only` (G1, the closest mint precedent)
and `git show 13c3d2f --name-only` (G2b), minus what pins 2 and 3 exclude.
Every line number below re-verified against the working tree 2026-07-29.

### Core

| File | What |
|---|---|
| `crates/epiphany-core/src/codec.rs` | four `canonical_value!` entries (`:3518` list) |
| `crates/epiphany-core/src/invariants.rs` | pin 6: invariant-10 doc comment (`:59`–`:62`) |
| `crates/epiphany-core/DECISIONS.md` | the rung's record |

**Not touched:** `graph.rs` (all four types exist), `textvalue_graph.rs` (pin
3), `lib.rs` (already exported).

### Ops

| File | What |
|---|---|
| `crates/epiphany-ops/src/payload.rs` | four op structs + `CanonicalEncode`; `OperationKind` variants; `discriminant()` (`:390` region); `schema_major()` — **no arm**, pin 2; `introduced_minor()` (`:449` region); `tag()` (`:497` region); `encode_canonical` (`:543` region); tag vocabulary `@ Some(11)` (`:714` region); s1 epoch table (`:2475` region) |
| `crates/epiphany-ops/src/envdecode.rs` | decode arms (`:599` region) and the tag-dispatch arms (`:901` region), plus validation |
| `crates/epiphany-ops/src/reduce.rs` | four dispatch arms + four mint reducers, on `create_staff`'s shape (`:4075`, `:4148`); **plus four carried-value maps at seven sites each — 28 touch points, see pin 4a** |
| `crates/epiphany-ops/src/textproj_kind.rs` | production arms (`:232` region) **and** parse arms (`:572` region) |
| `crates/epiphany-ops/src/migrate.rs` | both directions (`:192`, `:356` regions) |
| `crates/epiphany-ops/src/v0.rs` | `V0OperationKind` variants (`:118` region) |
| `crates/epiphany-ops/src/fuzz.rs` | generator arms (`:304` region) |
| `crates/epiphany-ops/src/valuegen.rs` | value generators |
| `crates/epiphany-ops/src/vectors.rs` | four envelope decode vectors, pinned to **literal bytes** (trap 4) |
| `crates/epiphany-ops/src/lib.rs` | re-exports (`:135` region) |
| `crates/epiphany-ops/DECISIONS.md` | the rung's record |

### Boundary crossings — budgeted up front (trap 6)

An `OperationKind` append is **not** containable to core + ops. All five
re-verified 2026-07-29; earlier revisions of the plan carried three drifted
citations.

| File | What | Why it bites |
|---|---|---|
| `crates/epiphany-editor-core/src/barriers.rs` | four arms in `subjects_of` (`:313`, pattern at `:444`) | Rust exhaustiveness; testkit depends on editor-core, so a missing arm blocks conformance **and** `requirement_labels` — the gate cannot run at all |
| `crates/epiphany-layout-ir/src/barrier.rs` | the "one past the vocabulary" tag `35` → `39` (`:1156`, assertion at `:1170`/`:1176`) and its comment | Deliberately a literal; unbumped, it pins a bug — a barrier prohibiting a new op encodes fine and cannot read back |
| `crates/epiphany-testkit/tests/text_projection_grammar.rs` | count `35` → `39` and the message string (`:315`) | Hand-maintained literal parallel to a derived list |
| `crates/epiphany-testkit/src/generators.rs` | drawn range `30..=34` → `30..=38` (`:1908`) and the never-drawn guard (`:1947`) | A kind never drawn is a kind never fuzzed |
| `crates/epiphany-testkit/src/layout_stub.rs` | the `30..=34` range in the s10/row-29 comment (`:1373`) | Prose, but it states the coverage claim the test rests on; stale text here is how a narrowed guard reads as a broad one |
| `crates/epiphany-textproj/src/vectors.rs` | the negative vector whose "wrong version" moves with each bump | Silently passes for the wrong reason otherwise |

**Both `barriers.rs` and `barrier.rs` are editor-track files.** Authorization
is per-packet and **does not generalise**. Granted 2026-07-29, narrowly:

* `barriers.rs` — **the four required exhaustive `subjects_of` arms, and
  nothing else.**
* `barrier.rs` — **the invalid-tag literal, its comment, and its assertions,
  35 → 39, and nothing else.**

**No other change in either crate is authorized by this packet.** If the
workspace appears to need one, stop and report rather than widening.

### Text projection

| File | What |
|---|---|
| `crates/epiphany-textproj/src/lib.rs` | `COMPANION_VERSION` **0.11.0 → 0.12.0** (`:47`) and the live version sites |
| `crates/epiphany-textproj/src/parse.rs` | kind productions |
| `crates/epiphany-textproj/src/vectors.rs` | four positive document vectors + the negative-vector flip |

**Bind vector sources by name, never by positional index.** Inserting a
document repointed positionally-bound negative vectors in G2b and broke
generation. `by_name(...)` exists for this.

**Do not conflate version domains.** A corpus fixture's
`manifest_schema_version` is the *manifest's* version, not the epoch a block
requires. G2b shipped `SchemaVersion::new(0, 10)` here with a comment making
exactly the inference `text_projection.tex:1367` forbids. Use
`SchemaVersion::V0`.

### Normative documents (pin 8)

`spec/operation_catalog.tex` + `.pdf`, `spec/binary_format.tex` + `.pdf`,
`spec/core_spec.tex` + `.pdf`, `spec/text_projection.tex` + `.pdf`.

### Vectors and tracking

`spec/vectors/decode_vectors.txt`, `spec/vectors/textproj_document_vectors.txt`
(regenerated; any hardcoded corpus **count** moves with them),
`spec/PLAN_GENESIS_OPS.md`, `spec/PLAN_GMINOR_SCHEMA_MINOR.md` §4.

---

## 4. Tests — each with the mutation that must kill it

Each row names a mutation that MUST be **observed failing** and then reversed
**by editing back** — never `git checkout`, never `git stash`. A mutation that
does not compile produces no test output and signs nothing. A mutation absorbed
by the compiler (e.g. deleting a match arm) proves nothing about the test:
prefer a mutation that keeps the workspace compiling and isolates the behaviour
under test. **A shared mutation that leaves a test green signs nothing** — the
t9 lesson from G2b.

| # | Test | Mutation that must kill it |
|---|---|---|
| t1 | All four kinds and tags are 35–38 in **both** spaces, and the discriminant byte leads each canonical encoding | Move any one kind to 39; then, separately, move its tag. Both must fail — the spaces are asserted independently (pin 1) |
| t2 | `schema_major()` returns **0** for all four | Add them to the `=> 2` arm; must fail (pin 2's stated bug) |
| t3 | A block containing all four stamps major **0**, and the op-block accept-set is untouched at 3 | Make one kind report major 2; must fail |
| t4 | Each op round-trips through `encode` → `envdecode` → reduce, byte-identical, with its decode vector pinned to **literal bytes** | **Swap two fields in the carried type's `struct_codec!` declaration** — e.g. `PartDefinition { id, name, staves }` → `{ id, staves, name }` (`core/src/codec.rs:1790`); the literal-byte vector must fail. *(A create op's `encode_canonical` is a single `push_lp_bytes` line over one carried value, so there is nothing in the op to reorder — the first draft's mutation was impossible. The reorder must go where the layout actually lives, and because `struct_codec!` moves both halves at once it is self-consistent and passes round-trip tests: trap 4, the 3b-i lesson. Literal-byte vectors are the only thing that catches it.)* |
| t5 | Re-carrying a live id with a **byte-identical** value is `AlreadyApplied`; with a **differing** value is `RecreateContentMismatch`; a tombstoned id is `TargetTombstoned` | Return `Applied` for the differing-value case; must fail |
| t5b | **Re-carry against a base-derived entity**: reduce `new_onto` a score whose four vectors are already populated, re-carry each byte-identically, and get `AlreadyApplied` | Covered by t13 per-seed. A re-carry test that only reduces from empty **cannot see a missing base seed at all** — that is why this row is separate from t5 |
| t6 | All three referential loops refuse under a graph, **each asserted separately**: `CreateStaffGroup.members`, `CreatePartDefinition.staves`, and `CreateView.active_layers` naming a non-live target are each `TargetMissing` | **Three independent mutations**, one per loop: drop the members loop from `create_staff_group`; drop the staves loop from `create_part_definition`; drop the active-layers loop from `create_view`. Each must fail on its own row. *(The first draft omitted `PartDefinition.staves` entirely — one uncovered loop is one loop that can be deleted green.)* |
| t7 | Those same preconditions are **not** enforced base-free | Remove the `if self.graph.is_some()` guard from one reducer; must fail — base-free has no universe to check against |
| t8 | From empty, `CreateInstrument` → `CreateStaffGroup` → `CreateStaff` **with `group: Some(...)`** succeeds and reaches a note — i.e. `CreateStaff`'s group precondition becomes **satisfiable** | Replace the `CreateStaffGroup` dispatch arm with `OperationKind::CreateStaffGroup(_) => OperationEffect::Applied`, keeping the match exhaustive; must fail at the grouped-staff assertion while the spine stays applied. **Claim narrowed per §1.1: this asserts satisfiability, NOT that a bidirectionally consistent group is authorable.** Under disposition B the test must additionally assert the known gap explicitly — `g.members` is empty while `s.group` is `Some(g)` — so the deferral is pinned rather than merely unmentioned |
| t9 | A score reduced from empty through all four ops **passes `check_invariants`**, and each skipped reducer check **independently** makes invariant 10 fire (pin 5) | **The fixture is constant across all mutations**: the baseline input already attempts a dangling reference in each of the three loops, and passes because the reducer refuses them. Then mutate **only production**, one skipped check at a time — three separate mutations, each of which must let its dangling reference through and make invariant 10 fire. *(The first draft moved the fixture and the production code together, which proves only that a hand-built bad score fails a checker — not that the reducer's refusal is what was holding the line.)* |
| t10 | All four kinds carry **epoch 11**, and a block containing them stamps minor **11** | Assign epoch 10 to one kind; must fail. Run against **both** epoch sites separately (vocabulary annotation, s1 table) — each must be independently able to fail |
| t11 | Text projection round-trips all four kinds, and the companion version is **0.12.0**, with the negative vector rejecting **0.11.0** | Drop one parse arm; must fail. Separately, leave `COMPANION_VERSION` at 0.11.0; the negative vector must fail |
| t12 | Invariant 10's doc comment names the four reference classes its body checks (pin 6) | Grep-assert the repaired prose is present **within the invariant-10 doc block only** — slice the source from the `/// 10.` line to the `CrossCuttingRefsResolve,` line and search *that*. Revert the comment to see it fail. **Searching the whole file passes on the implementation body**, which contains the same identifiers the doc comment is supposed to gain — a guard that cannot fail |
| t13 | **Each of the four base seeds is load-bearing** (pin 4a, site 4) | **Four separate mutations**: skip seeding each of `staff_group_values`, `part_definition_values`, `analysis_layer_values`, `view_values` in `seed_from_graph`, one at a time. Each must make t5b fail. Model on G1's documented precedent for `instrument_values` (`reduce.rs:13264`–`:13268`) |

**On t12's grep shape:** a self-matching needle is a real hazard — G2b hit it
twice, once when a multi-line needle matched the test's own source and once
when the assertion *message* contained the searched phrase. Keep the needle
short, keep it out of the message, and if the guard reads more than one file,
iterate `include_str!` over each.

---

## 5. Gate

* `cargo test --workspace` — full pass, zero failures, with the count reported.
* `cargo clippy --workspace --all-targets` — zero warnings.
* `cargo fmt --check` — clean.
* `git diff --check` — clean.
* All four PDFs regenerated; no undefined LaTeX references.
* Every t-row mutation **observed failing** and reversed by editing back, with
  the observed failure quoted. **Not** "would fail".
* **Stage only the files in §3's touch table, explicitly named.** Never
  `git add -A`. The editor track has parallel work in `spikes/` and elsewhere
  that MUST NOT be staged.

## 6. Report

State, with evidence: kinds/tags assigned and the two spaces asserted
separately; that `schema_major()` gained **no** arm and no bundle file was
touched; the four `canonical_value!` entries; that `textvalue_graph.rs` needed
no change; **the four carried-value maps at all seven sites each, named site by
site**; each of the three referential loops and its invariant-10
correspondence; **which §1.1 disposition was implemented and what t8 therefore
does and does not claim**; epoch 11 at both sites; the companion bump
0.11.0 → 0.12.0 with the negative vector rejecting 0.11.0; the four-document
sweep; and the six boundary-crossing literals with their new values. Report
each mutation's **observed** output — t6, t9, and t13 are multi-mutation rows
and each sub-mutation must be reported separately. Anything not done, say so
plainly.