Closes the three remaining item-5 sub-parts found in the audit.
② Typed tolerance + overflow (tempo.rs, invariants.rs):
- Replace the ad-hoc `f64::EPSILON` speed-degeneracy guards with a named
TempoIntegration `Tolerance` (relative, non-finite-safe), per Appendix D
"no ad-hoc epsilons"; aligns code with the module's own claim.
- Guard the continued-fraction convergent recurrence with checked i128 ops
(break on overflow) and bound the residual-fraction stop by 1/max_den
instead of f64::EPSILON, so a pathological input can't silently wrap.
- Endpoints::of: wall-clock event end uses checked_add -> Endpoints::Unknown
on overflow, not saturating_add (which could mask an ordering violation).
- Regression tests: equal-endpoint linear segment uses the constant limit;
extreme inversion inputs don't overflow.
① Region-overlap honesty (invariants.rs):
- Unresolvable region-overlap checks (symbolic anchors + shared staff extent)
were silently treated as valid. Add DeferredCheck + deferred_checks() to
surface them explicitly; check_invariants stays sound (no false positives).
- Test proves an undecidable overlap is reported as deferred, not passed, and
that a wall-clock-resolvable disjoint pair is neither violation nor deferred.
③ Identifier-derivation lock-down (graph.rs, pitch.rs, ids.rs):
- Golden-bytes tests pin derive_promoted_voice_id (MUSCSVCE 64-byte preimage),
derive_system_pitch_id (MUSCSPCH input layout), and the TypedObjectId
discriminant table + Registered layout, so an accidental layout change is
caught (the derivations were concrete but unlocked).
- canonical_pitch_bytes NFC-normalizes strings at the derivation boundary,
making the documented NFC guarantee explicit (no-op for the already-NFC
catalog ids).
- DECISIONS P11-1/3/6 updated to record the pinned-and-locked layouts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Levi Neuwirth
306871ea29