epiphany/spec/AUDIT_GMINOR_VOCABULARIES.md

Audit: G-minor reachable vocabularies — a ledger and a reachability matrix

Governed by spec/CONTRACT_GMINOR_VOCABULARY_AUDIT.md. Read-only packet; produces this file only. Method: walked each ChunkKind role's payload encoder transitively (encode_canonical / Codec::enc / canonical_bytes), confirming every discriminant-writing site actually reached from that role, rather than trusting the type graph. grep -rn "push_tag\|fn discriminant" over crates/epiphany-core/src and crates/epiphany-ops/src was used as the starting net (and a comprehensive grep for Additive|appended|append at\b comments across epiphany-core, epiphany-ops, epiphany-layout-ir, epiphany-bundle was used as a second, independent net for "did this vocabulary ever get a documented native append" — see "How completeness was checked" at the end).

Repo state at audit time: git status --short showed only the pre-existing editor-track dirt (M Cargo.toml, untracked spikes/editor-toolkit/**); see the Gate section at the end for the before/after capture.

---

Part 1 — the vocabulary ledger

For each vocabulary: full variant list, discriminant, classification. Unless otherwise noted, discriminants are one byte (u8) and "escape" means a Registered-shaped variant carrying a registry id (native extension point). TypedObjectId is the one 16-bit (u16) exception, noted inline.

1.1 OperationKind (ops/src/payload.rs:116, discriminant() at :275)

Baseline (golden-locked 0..=23 — the value-typed v1 catalog's frozen range; the identifier-only v0 catalog, ops/src/v0.rs::V0OperationKind, only ever had discriminants 0..=7 and is entirely superseded by migration, not a second baseline):

#	Variant		#	Variant
0	InsertEvent		12	ModifyIdentifiedPitch
1	DeleteEvent		13	DeleteCrossCutting
2	RespellPitch		14	ModifyCrossCutting
3	CreateCrossCutting		15	CreateRegion
4	ChangeRegionTimeModel		16	DeleteRegion
5	SetUserSystemBreak		17	CreateStaffInstance
6	DeclareTransaction		18	DeleteStaffInstance
7	Registered (escape)		19	CreateVoice
8	ModifyEvent		20	DeleteVoice
9	Transpose		21	SetMetadata
10	InsertIdentifiedPitch		22	SetMetricGrid
11	DeleteIdentifiedPitch		23	SetUserPageBreak

Post-baseline native (10 variants, exactly matching P13-S14's list):

Discriminant	Variant	Introduction event
24	CreateStaff	Phase-3 first tranche
25	SetTimeSignature	Phase-3 first tranche
26	SetTempoSegment	Phase-3 first tranche
27	SetStaffLayout	Phase-3 first tranche
28	CreateRepeatStructure	schema-major-2 repeat-authoring revision
29	DeleteRepeatStructure	schema-major-2 repeat-authoring revision
30	TransposeInterval	Push 4a
31	CreateInstrument	genesis tranche G1
32	SetCanvasLayoutDefaults	genesis tranche G2a
33	SetSpellingPrecedence	genesis tranche G2a

Escape: 7 (Registered). Out of scope per contract.

1.2 OperationKindTag (ops/src/payload.rs:421, macro-generated at :487)

Independent discriminant space from OperationKind (trap 2 confirmed: RespellPitch is kind 2 / tag 3). Source of truth is the operation_kind_tag_vocabulary! macro (exhaustive, no wildcard arm) — the hand-written OperationKind::discriminant() match was not consulted for this vocabulary; the macro table at :532 was.

Baseline (0..=15, 17..=23 — Registered sits at 16, splitting the range):

Disc.	Variant		Disc.	Variant
0	InsertEvent		12	DeleteStaffInstance
1	DeleteEvent		13	SetUserSystemBreak
2	ModifyEvent		14	SetUserPageBreak
3	RespellPitch		15	DeclareTransaction
4	Transpose		16	Registered (escape)
5	CreateCrossCutting		17	InsertIdentifiedPitch
6	DeleteCrossCutting		18	DeleteIdentifiedPitch
7	ModifyCrossCutting		19	ModifyIdentifiedPitch
8	ChangeRegionTimeModel		20	CreateVoice
9	InsertRegion		21	DeleteVoice
10	DeleteRegion		22	SetMetadata
11	InsertStaffInstance		23	SetMetricGrid

Post-baseline native (mirrors OperationKind 1:1, same 10 events):

Disc.	Variant	Introduction event
24	InsertStaff	Phase-3 first tranche
25	SetTimeSignature	Phase-3 first tranche
26	SetTempoSegment	Phase-3 first tranche
27	SetStaffLayout	Phase-3 first tranche
28	CreateRepeatStructure	schema-major-2 repeat-authoring revision
29	DeleteRepeatStructure	schema-major-2 repeat-authoring revision
30	TransposeInterval	Push 4a
31	CreateInstrument	genesis tranche G1
32	SetCanvasLayoutDefaults	genesis tranche G2a
33	SetSpellingPrecedence	genesis tranche G2a

Escape: 16 (Registered). Out of scope.

1.3 OperationPayload (ops/src/payload.rs:59, discriminant() at :75)

Baseline (0..=2, no escape variant on this vocabulary):

Disc.	Variant
0	Primitive (carries OperationKind)
1	ResolveConflict
2	UndoTransaction

Post-baseline native:

Disc.	Variant	Introduction event
3	ResolveEquivocation	Push 3 (2026-07); catalog §ResolveEquivocation ratified, epiphany-ops DECISIONS.md:620 "ResolveEquivocation + validation modes (2026-07, Push 3)"; PASS12_RATIFICATION_LOG.md:41 confirms discriminant 3, catalog 0.3.0 → 0.4.0

Trap 1 confirmed live here: binary_format.tex:2384 says "append at ≥4," but discriminant 3 is itself the one and only append this vocabulary has ever had — the ≥N phrasing names the next free slot, not the baseline boundary, exactly as the contract warns.

1.4 ReanchorReason (ops/src/effect.rs:317, discriminant() at :331)

Baseline (0..=5, escape at 5):

Disc.	Variant
0	SameVoiceNearer
1	SameStaffInstanceNearer
2	SameStaffNearer
3	SameRegionNearer
4	ExplicitFallback
5	DeclaredByExtension (escape)

Post-baseline native:

Disc.	Variant	Introduction event
6	SameCanvasNearer	Pass-12 G-pass, item P12-C4 (ratified 2026-07-07; PASS12_RATIFICATION_LOG.md:147)

This is the checklist's "sharpest edge" case realized: the native append (6) sits after the escape variant (5) on the same enum.

1.5 PreconditionFailureReason (ops/src/effect.rs:124, discriminant() at :188)

Baseline (0..=9, escape at 9):

Disc.	Variant
0	TargetMissing
1	TargetTombstoned
2	WrongRegionTimeModel
3	TupletCompensationInvalid
4	EventDurationInvalid
5	PositionOutsideRegion
6	PitchSpaceMismatch
7	VoiceMissing
8	ExtensionPrecondition
9	Registered (escape)

Post-baseline native:

Disc.	Variant	Introduction event
10	ContainerNotEmpty	Operation Catalog M2c ("Group 3": structural-container CRUD, Agent K Phase-2 — ops/DECISIONS.md:165 "M2c (Group 3) — structural containers: empty-only delete")
11	TempoMapMalformed	Phase-3 first tranche (ops/DECISIONS.md:787-796)
12	SystemDerivedContentImmutable	Pass-12 G-pass, item P12-K3 (ratified 2026-07-07; PASS12_RATIFICATION_LOG.md:135)
13	RecreateContentMismatch	Pass-12 G-pass, item P12-K9 (ratified 2026-07-07; PASS12_RATIFICATION_LOG.md:140)
14	AcousticRealizationPinned	Push 4a
15	TranspositionOutOfRange	Push 4a

Note the boundary mismatch with §1.1: OperationKind's own baseline absorbed the whole M2c tranche (kinds 15–20) into its golden-locked 0..=23 range, but PreconditionFailureReason's baseline (0..=9) had already been fixed before M2c landed, so M2c's own contribution to this vocabulary (ContainerNotEmpty = 10) is a genuine post-baseline append even though the OperationKind variants that provoke it (CreateRegion et al.) are baseline. Each vocabulary's baseline boundary is independent — this is the concrete case that makes that true, not merely a caution from the contract.

1.6 The fourteen checked-clean escape-carrying enums

Every entry below was located, its full discriminant match read, and no comment, DECISIONS.md entry, or ratification-log entry recorded a native append after its escape variant. Negative result, recorded as evidence, per the contract's requirement that a clean checklist entry be stated, not omitted.

#	Vocabulary	Site	Discriminants	Escape at	Result
1	RepairKind	ops/src/effect.rs:248	0..=7	7	clean — no append
4	IntegrityAnomalyKind	ops/src/anomaly.rs:143	0..=3	3	clean — no append
5	ReplicaAnomalyReason	ops/src/anomaly.rs:70	0..=1	1	clean — no append
6	TransactionCategory	ops/src/payload.rs:1007	0..=4	4	clean — no append
7	ResolutionAction	ops/src/conflict.rs:181	0..=5	5	clean — no append
8	ConflictKind (via ExtensionConflict)	ops/src/conflict.rs:74	0..=5	5	clean — no append
9	BarrierScope	layout-ir/src/barrier.rs:60	0..=7	7	clean — no append
10	BarrierCondition	layout-ir/src/barrier.rs:75	0..=6	6	clean — no append
11	TieClass	core/src/graph.rs:1080, codec at core/src/codec.rs:2302	0..=4	4	clean — no append
12	StaffGroupKind	core/src/graph.rs:1599, codec at core/src/codec.rs:2267	0..=4	4	clean — no append
13	PitchSpacePosition	core/src/pitch.rs:436, codec at core/src/codec.rs:938	0..=3	3	clean — no append
14	SpellingNominal	core/src/pitch.rs:896, codec at core/src/codec.rs:1066	0..=2	2	clean — no append
15	TypedObjectId	core/src/ids.rs:490, discriminant() at :525 (16-bit, the one exception)	0..=27	27	clean — no append. All 28 values were assigned in one batch, epiphany-core/DECISIONS.md:52-68 (P11-1, Pass 11, 2026-06-21): the spec named kinds only through AnalysisLayer=21; this crate extended the table to 27 (Tuplet, RepeatStructure, LyricLine, ChordSymbol, View, Registered) in the same ratifying pass, then locked it with a golden-bytes test. There is no second, later append on top of that lock.
16	barrier ObjectKind's open value space	layout-ir/src/barrier.rs:30	n/a — see below	n/a	clean, but structurally different — see note

Note on #16. This is not an enum with a discriminant() match; it is pub struct ObjectKind(pub u16), a transparent wrapper that stores whatever TypedObjectId::discriminant() produced for the referenced object (barrier.rs:30-35). Its "open value space" is open only in the sense that the wire form accepts any u16 without independently validating it against a known set on decode (barrier.rs:476-488); it carries no discriminant vocabulary of its own and has no append story separate from TypedObjectId's (checked clean at #15). Naming collision flagged for the record: this is a different type from epiphany-ops::support::ObjectKind (ops/src/support.rs:172, the Voice/Pitch/Registered enum used inside IntegrityAnomalyKind::SystemIdentifierCollision) — same name, two unrelated types in two crates. Checked separately below as part of IntegrityAnomalyKind's reachable set (it has no Registered-adjacent append of its own either: 0..=2, escape at 2, clean).

1.7 Vocabularies reached with no Registered escape at all, checked and clean

These are the "closed value-layer unions" the contract's IN-scope clause covers (binary_format.tex:2386: closed unions may still gain variants through a ratified document revision, and such appends are minor-additive too). Located via the reachability walk below; each was checked against the "Additive / appended" comment net (see the completeness note) with no hits.

Vocabulary	Site	Discriminants	Result
OperationEffect	ops/src/effect.rs:29	0..=4	clean — no append
NoOpReason	ops/src/effect.rs:76	0..=4	clean — no append
ObjectState	ops/src/reduce.rs:416	0..=1	clean — no append
PendingReason	ops/src/reduce.rs:455	0..=4	clean — no append
ConflictResolutionState	ops/src/conflict.rs:230	0..=2	clean — no append
UndoPolicy	ops/src/undo.rs:32	0..=2	clean — no append
epiphany-ops::support::ObjectKind	ops/src/support.rs:172	0..=2 (escape 2)	clean — no append

BracketKind, MetadataValue, PedalKind and similar new enums introduced at schema major 2 (core/src/graph.rs:1038,1479 etc.) were checked and are not in scope: they were minted whole at a major bump, not appended-to afterward — they have no post-baseline history of their own to record.

1.8 CompressionAlgorithm — EXCLUDED by ruling (2026-07-28)

bundle/src/chunk.rs:119: None=0, Zstd{level}=1, Reserved(u8)=2 ("Reserved for future format major versions"). This audit surfaced it as a boundary case — it is in neither the contract's checklist nor the plan's §3 table — and it is now ruled out of scope for schema-minor epochs.

Two independent grounds, both read from the tree:

1. It is not a discriminant emitted by the payload that SchemaVersion governs. It is transport metadata riding ChunkRef alongside the chunk's offset and length, structurally parallel to ChunkKind — which the contract already excludes — rather than a value- or operation-layer discriminant inside the payload bytes.
2. It is deliberately outside chunk identity. chunk_content_hash's preimage is domain || kind || schema || uncompressed_length || payload (bundle/src/chunk.rs:177), and both the function's own doc comment and the type's (:110, "Not part of content identity") state the exclusion as intentional. A minor is content-addressed because it enters that preimage (plan §2); compression never does, so it has no minor to raise.

Recorded here explicitly so the question is settled rather than reopened each time the enum's Reserved(u8) slot is noticed. Its Reserved variant is a format-major escape, consistent with its own doc comment.

---

Part 2 — the reachability matrix

Chunk role	Encoded payload type	Discriminant vocabulary	Post-baseline variants	Introduction event	Derivation site
OperationEnvelopeBlock	OperationEnvelope → OperationPayload	OperationPayload	ResolveEquivocation = 3	Push 3	ops/src/payload.rs:100 (push_tag in OperationPayload::encode_canonical)
OperationEnvelopeBlock	↳ OperationPayload::Primitive	OperationKind	24–33 (10 variants, §1.1)	Phase-3 / schema-major-2 / Push 4a / G1 / G2a	ops/src/payload.rs:373
OperationEnvelopeBlock	↳ OperationKind::DeclareTransaction → TransactionDescriptor	TransactionCategory	none	— (baseline only)	ops/src/payload.rs:1029
OperationEnvelopeBlock	↳ OperationPayload::ResolveConflict → ResolveConflictPayload	ResolutionAction	none	— (baseline only)	ops/src/conflict.rs:211
OperationEnvelopeBlock	↳ OperationPayload::UndoTransaction → UndoTransactionPayload	UndoPolicy	none	— (baseline only)	ops/src/undo.rs:57
OperationEnvelopeBlock	↳ every primitive op's embedded graph value (Event, Region, Instrument, PitchSpelling, Tie, Slur, Beam, Spanner, …)	the four escape vocabularies (TieClass, StaffGroupKind, PitchSpacePosition, SpellingNominal) + all closed value-layer unions	none found	—	core/src/codec.rs (per-type Codec::enc, embedded via push_lp_bytes(out, &value.canonical_bytes()) at each op site, e.g. ops/src/payload.rs:1513, :1528)
OperationIndex	(ChunkRef, Vec<(id, block, offset)>)	—	—	—	(b) emits no additive discriminant. Payload is block_count × ChunkRef + entry_count × {id bytes, block ordinal, offset} (bundle/src/opindex.rs:26-38); the only discriminant present is each ChunkRef's ChunkKind tag, out of scope by the contract's own exclusion.
Snapshot (canonical base)	MaterializedState	OperationEffect	none	—	ops/src/reduce.rs:548
Snapshot (canonical base)	↳ OperationEffect::AppliedWithRepair → RepairRecord	RepairKind	none	—	ops/src/effect.rs (RepairKind::encode_canonical)
Snapshot (canonical base)	↳ RepairKind::Reanchored	ReanchorReason	SameCanvasNearer = 6	Pass-12 G-pass (P12-C4)	ops/src/effect.rs:331
Snapshot (canonical base)	↳ OperationEffect::NoOp	NoOpReason	none	—	ops/src/effect.rs:96
Snapshot (canonical base)	↳ NoOpReason::PreconditionFailedUnderReduction	PreconditionFailureReason	10–15 (6 variants, §1.5)	M2c / Phase-3 / Pass-12 G-pass ×2 / Push 4a	ops/src/effect.rs:188
Snapshot (canonical base)	↳ conflicts: ConflictRegistry → ConflictRecord	ConflictKind	none	—	ops/src/conflict.rs (ConflictKind::encode_canonical)
Snapshot (canonical base)	↳ ConflictRecord::resolution_state	ConflictResolutionState	none	—	ops/src/conflict.rs:230
Snapshot (canonical base)	↳ anomalies: Vec<IntegrityAnomaly>	IntegrityAnomalyKind	none	—	ops/src/anomaly.rs:143
Snapshot (canonical base)	↳ IntegrityAnomalyKind::SystemIdentifierCollision	epiphany-ops::support::ObjectKind	none	—	ops/src/support.rs:191
Snapshot (canonical base)	↳ objects: BTreeMap<TypedObjectId, ObjectState>	TypedObjectId (map key) + ObjectState	none / none	—	ops/src/reduce.rs:437, core/src/ids.rs
Snapshot (canonical base)	↳ spellings: BTreeMap<PitchId, PitchSpelling>	SpellingNominal	none	—	core/src/codec.rs:1066 (via PitchSpelling::canonical_bytes)
Snapshot (canonical base)	↳ pending: Vec<(OperationId, PendingReason)>	PendingReason	none	—	ops/src/reduce.rs:494
Snapshot (canonical base)	—	Notably absent: no OperationKind, OperationKindTag, or OperationPayload discriminant anywhere. Confirms the plan's §3 claim for this role.
Snapshot (acceleration cache, full Score)	Score (whole-graph codec)	the four escape vocabularies + all closed value-layer unions	none found	—	core/src/codec.rs (Score's Codec impl, transitively over every graph type)
Blob	caller-supplied bytes	—	—	—	(d) truly producer-owned opaque bytes. ChunkKind::Blob doc: "audio, image, font, ML model" (bundle/src/chunk.rs:26); no core encoder produces the content, only stages/verifies it (bundle/src/bundle.rs:482,1018).
ExtensionData	extension-supplied bytes	—	—	—	(d) truly producer-owned opaque bytes, per contract's own framing — no core encoder, no core derivation possible.
TextProjection	—	—	—	—	(b) emits no additive discriminant — because no producer exists. ChunkKind::TextProjection is declared (bundle/src/chunk.rs:31,54) and named in the text-projection kind↔string table (textproj/src/project.rs:262, parse.rs:545), but no site in this codebase ever builds a chunk of this kind. The role is reserved, unwired.
LayoutCache	—	—	—	—	(b) emits no additive discriminant — because no producer exists. epiphany-layout-ir::cache::LayoutCache (layout-ir/src/cache.rs:82) is a pure in-memory incremental-layout index (DependencyIndex + BTreeSet<LayoutObjectId> stage caches) with no CanonicalEncode impl at all and no wiring to ChunkKind::LayoutCache. Every use of ChunkKind::LayoutCache in bundle/src/bundle.rs is a test planting literal placeholder bytes (e.g. b"layout-cache-bytes ", bundle.rs:2323).
IntegrityIndex	—	—	—	—	(b) emits no additive discriminant — because no producer exists. Referenced only in the kind↔string round-trip table and in testkit/src/generators.rs's random ChunkRef fuzzing (never given real integrity-index content).
Manifest	Manifest body (bundle/src/manifest.rs:459)	— (own fields: ids, ChunkRefs, SemVers — no discriminant vocabulary)	—	—	bundle/src/manifest.rs:459-513
Manifest	↳ ExtensionDeclaration::edit_barriers: Vec<u8>	(c) normatively typed bytes, opaque only to the bundle layer. Producer: layout_ir::barrier::EditBarrier::encode_canonical			layout-ir/src/barrier.rs:387
Manifest	↳ ↳ EditBarrier::scope	BarrierScope	none	—	layout-ir/src/barrier.rs:317
Manifest	↳ ↳ EditBarrier::condition	BarrierCondition	none	—	layout-ir/src/barrier.rs:352
Manifest	↳ ↳ EditBarrier::prohibited_operation_kinds: Vec<OperationKindTag>	OperationKindTag	24–33 (10 variants, §1.2)	Phase-3 / schema-major-2 / Push 4a / G1 / G2a	ops/src/payload.rs:499 (macro-generated encode_canonical at :568)
Manifest	↳ ExtensionDeclaration::affected_object_kinds: Vec<u8>	(c), producer: layout_ir::barrier::ObjectKind (u16 wrapper of TypedObjectId::discriminant())	none (see §1.6 #16)	—	layout-ir/src/barrier.rs:39

Nine roles, all accounted for: OperationEnvelopeBlock (a), OperationIndex (b), Snapshot/canonical-base (a), Snapshot/acceleration (a — clean), Blob (d), ExtensionData (d), TextProjection (b, unwired), LayoutCache (b, unwired), IntegrityIndex (b, unwired), Manifest (c, crossing into layout-ir's barrier encoder).

That is ten rows of disposition against nine ChunkKind variants because Snapshot is payload-polymorphic (trap 3) and gets one disposition per form, as the contract requires.

---

Completeness statement

• Which roles emit no additive discriminant, and why: OperationIndex (its payload is ids, ordinals, and offsets — no discriminant besides the out-of-scope ChunkKind tag inside each ChunkRef); TextProjection, LayoutCache, IntegrityIndex (all three: no producer exists in this codebase at all — the chunk kind is declared and named but unwired, which is a different finding from "encodes nothing interesting").

• Every escape-carrying enum from the sixteen-entry checklist, with its result: recorded in §1.6, all sixteen present, two with native post-baseline appends (ReanchorReason #2, PreconditionFailureReason #3 — both outside the sixteen but reached via #1/#4's neighborhood and recorded in §1.4/§1.5) and fourteen clean.

  The tally: sixteen checklist entries, sixteen checked, sixteen results recorded. Fourteen clean (§1.6). Two with native post-baseline appends — ReanchorReason (position 2, §1.4) and PreconditionFailureReason (position 3, §1.5), which is why §1.6's table skips those two numbers. No entry is unchecked and none is counted twice.

• Variants whose introduction event could not be established: none. Every post-baseline native variant found (OperationKind/OperationKindTag 24–33, OperationPayload 3, ReanchorReason 6, PreconditionFailureReason 10–15) has a sourced introduction event from at least one of: a code comment naming the tranche, crates/epiphany-ops/DECISIONS.md, or spec/PASS12_RATIFICATION_LOG.md. Where more than one source existed (OperationPayload 3: both payload.rs:80 comment and PASS12_RATIFICATION_LOG.md:41 state Push 3 / discriminant 3), they agreed; no dispute was found to adjudicate.

• Where the spec and the code disagree about what was appended when: one place, binary_format.tex:2373. The bullet list at :2373-2385 says OperationKind and OperationKindTag "append at ${\geq}30$", and its parenthetical history names only the Phase-3 tranche (24–27) and the schema-major-2 repeat pair (28/29). Kinds 30–33 — TransposeInterval (Push 4a), CreateInstrument (G1), SetCanvasLayoutDefaults and SetSpellingPrecedence (G2a) — are absent from both the number and the narrative, and 30 is no longer free.

  This audit initially recorded "no disagreement," which was wrong, and wrong in a way worth naming: it adopted trap 1's next-free-slot reading of "≥N" and then declared the ≥30 consistent. Both cannot hold. Read as a floor the sentence survives (34 ≥ 30); read as next-free-slot — the reading this audit uses everywhere else, and the reading that made OperationPayload's "≥4 while 3 is itself the append" legible — it is stale by four.

  Disposition: stale narrative, not table drift. The normative kind and tag tables are current — binary_format.tex:1443-1457 carries 30–33 with their catalog cross-references and :1526-1527 repeats them in the tag table. The tables are authoritative; :2373 is prose that stopped being maintained. So this is not the Push-4a failure (an enumeration the decoder contradicted) but its milder cousin: a count-and-history sentence drifting from a listing that is correct.

  The .tex correction is deferred to the G-minor implementation, which must touch this paragraph anyway — it is the paragraph defining the minor-additive mechanism the rung implements. Recorded here so the fix is owed rather than rediscovered.

Findings the plan's §3 table did not name

1. The canonical base (MaterializedState) reaches more than the plan's §3 list states. Plan §3 lists OperationEffect, NoOpReason, PreconditionFailureReason, ConflictKind, IntegrityAnomalyKind, PendingReason, ObjectState, TypedObjectId for the canonical base. Missing from that list, and confirmed reachable by this audit: RepairKind (via OperationEffect::AppliedWithRepair), ReanchorReason (nested inside RepairKind::Reanchored — and the one with a real post-baseline append, SameCanvasNearer = 6), and SpellingNominal (via the spellings: BTreeMap<PitchId, PitchSpelling> field). This is not a cosmetic omission: ReanchorReason is one of only two vocabularies this audit found with an actual native append, and it is missing from the plan's inventory of what the canonical base emits.
2. The manifest role reaches OperationKindTag, BarrierScope, and BarrierCondition — none of which appear in the plan's §3 table at all. The plan's table (§3) enumerates only OperationKind, OperationKindTag, OperationPayload, and "value-layer unions closed under req:binfmt:frozen-layout" as the four floor vocabularies, framed entirely around the operation layer. But OperationKindTag is also reachable through the manifest, independently of any operation envelope, via ExtensionDeclaration::edit_barriers → EditBarrier::prohibited_operation_kinds: Vec<OperationKindTag> (layout-ir/src/barrier.rs:205). A manifest that declares an edit barrier naming CreateInstrument (tag 31) needs the same G-minor stamping discipline as an operation-envelope block that contains one — and the manifest chunk's minor is a wholly separate stamping decision from any op block's. This is exactly the disposition-(c) crossing the contract warned would be "the single most important vocabulary in the whole matrix" if skipped, realized concretely, and it lands in a role the plan's table never mentions.
3. Two roles are declared and named end-to-end but have no producer at all: TextProjection and LayoutCache (chunk-kind), plus IntegrityIndex. This isn't in the plan's scope (it predates vocabulary concerns entirely), but it matters for whoever drafts the G-minor implementation contract next: there is currently no code path that needs an introduced_minor for these three roles, because there is no code path that writes them at all.
4. ConflictResolutionState and UndoPolicy are closed unions (no Registered escape) reachable from the canonical base and the operation block respectively, present in neither the plan's table nor the contract's sixteen-entry checklist (the checklist is escape-carriers only). Checked and clean, but worth naming since the contract's own framing ("every reachable discriminant vocabulary") is broader than its worked checklist.
5. A same-named-type trap: layout_ir::barrier::ObjectKind (a u16 wrapper around TypedObjectId::discriminant(), no independent vocabulary) and epiphany_ops::support::ObjectKind (a three-variant enum, Voice/Pitch/Registered, feeding IntegrityAnomalyId derivation) are two unrelated types sharing one name across two crates. Neither the plan nor the contract distinguishes them; this audit treats them as separate ledger entries (§1.6 #16 and §1.7 respectively) to avoid the two being silently merged by a later reader.

Where this audit's own working assumptions turned out to need correction

• A vocabulary's "baseline" is not one format-wide date. Reading PreconditionFailureReason's baseline (locked at 0..=9, evidently before the M2c tranche) against OperationKind's baseline (locked at 0..=23, evidently including M2c's CreateRegion et al.) shows two vocabularies whose own golden-lock moments are not simultaneous, even though one vocabulary's post-baseline variant (ContainerNotEmpty = 10) is produced by an operation (CreateRegion = kind 15) that is itself baseline in the other vocabulary. The contract's Part 1 definition ("baseline — present at the format's initial ratification") reads as if there is one initial-ratification instant; in practice each vocabulary's own code-documented golden lock is the operative boundary, and they disagree with each other by design (the M2c precedent shows the same tranche can be baseline for one vocabulary and a genuine append for another). This audit's ledger records introduction events per variant rather than asserting a single global baseline date, which is the only way the two observations above are both representable.
• The sixteen-entry checklist, read carefully, already includes ReanchorReason and PreconditionFailureReason at positions 2 and 3 — an early pass through this audit almost treated the checklist as "fourteen escape-carriers plus these two extras," which would have been a double-count. Rereading the contract's list resolved this without any discrepancy in the final tally (still sixteen numbered entries, all checked); flagged here only because it was a live risk of self-inflicted miscounting during the audit, worth naming so a future reader doesn't repeat the confusion.
• OperationKindTag's reachability is not confined to the op layer. The contract frames the audit around "vocabularies reachable from an affected chunk payload," in a document whose motivating example is entirely about operation envelopes and ResolveEquivocation. It would have been easy to conclude OperationKindTag is reachable only through prohibited_operation_kinds inside an op-adjacent structure and stop there. It is in fact reachable through the manifest, a chunk role with no operation envelope in it at all. Finding 2 above is the concrete correction; the general lesson is that "affected chunk payload" needed checking against all nine roles independently, not inferred from the one role (OperationEnvelopeBlock) the motivating example was about.

What this audit hands to the epoch ratification (ruled 2026-07-28)

The epoch space stays global — one globally meaningful minor per additive revision, as ratified in PLAN_GMINOR_SCHEMA_MINOR.md §4. This audit does not reopen that.

But baseline/post-baseline classification and introduction events are established per variant, per vocabulary. §1.5's M2c case is the proof rather than the caution: the same tranche is baseline for OperationKind (absorbed into the golden-locked 0..=23) and a genuine append for PreconditionFailureReason (ContainerNotEmpty = 10, whose own lock at 0..=9 predates it). A global epoch numbering and a per-vocabulary baseline boundary are not in tension — the epoch answers "which revision introduced this variant," the boundary answers "was this variant present at that vocabulary's own lock." Only the second varies by vocabulary.

The tentative ladder is therefore incomplete. PLAN_GMINOR_SCHEMA_MINOR.md §4's Phase 3 → 2, repeats → 3, Push 4a → 4, G1 → 5, G2a → 6 was drawn against OperationKind alone. Three families this audit exposed are unplaced:

Family	Variants	Introduction event	Placement
OperationPayload	ResolveEquivocation = 3	Push 3	unplaced — Push 3 predates every rung on the tentative ladder
ReanchorReason	SameCanvasNearer = 6	Pass-12 G-pass (P12-C4)	unplaced — Pass-12 G-pass has no rung
PreconditionFailureReason	10–15	M2c / Phase-3 / Pass-12 G-pass ×2 / Push 4a	partly placeable — Phase-3 and Push 4a map to existing rungs; M2c and the Pass-12 G-pass do not

So ratification owes at least two new epochs (Push 3, Pass-12 G-pass) and a decision on M2c, and must confirm that Phase-3 and Push 4a rungs cover their PreconditionFailureReason contributions as well as their OperationKind ones. The ladder must not be ratified as written.

How completeness was checked (methodology note)

Two independent nets were run and cross-checked against each other:

1. grep -rn "push_tag\|fn discriminant" over epiphany-core/src and epiphany-ops/src (the contract's suggested net, ~65 hits), then every fn discriminant site outside those two crates (epiphany-layout-ir, epiphany-bundle) located separately, since the contract's net is scoped to only two crates but BarrierScope/BarrierCondition live in epiphany-layout-ir.
2. grep -rn "Additive|appended|append at|append past|appended past" across epiphany-core/src, epiphany-ops/src, epiphany-layout-ir/src, epiphany-bundle/src — every hit was read in context (§1.4, §1.5's sourcing, plus confirmation that every schema-major-2 "appended" comment found was a struct field addition, out of scope by the contract's own "field additions are always major" rule, not a discriminant append).

Every discriminant vocabulary named in the contract's checklist, the plan's §3 table, and everything found via nets 1–2 was traced to a concrete encode_canonical (or Codec::enc) call site and confirmed reachable from at least one ChunkKind role's payload before being entered in Part 2. No vocabulary was entered on the strength of its type declaration alone.

Gate

git status --short before:

 M Cargo.toml
?? spikes/editor-toolkit/Cargo.lock
?? spikes/editor-toolkit/Cargo.toml
?? spikes/editor-toolkit/a11y-verifier/
?? spikes/editor-toolkit/probe-egui/
?? spikes/editor-toolkit/probe-iced/
?? spikes/editor-toolkit/probe-vello/
?? spikes/editor-toolkit/target/

git status --short after (expected — this file is the only addition):

 M Cargo.toml
?? spec/AUDIT_GMINOR_VOCABULARIES.md
?? spikes/editor-toolkit/Cargo.lock
?? spikes/editor-toolkit/Cargo.toml
?? spikes/editor-toolkit/a11y-verifier/
?? spikes/editor-toolkit/probe-egui/
?? spikes/editor-toolkit/probe-iced/
?? spikes/editor-toolkit/probe-vello/
?? spikes/editor-toolkit/target/

No Rust, .tex, vector, or golden file was modified.

cargo was not invoked at any point during this audit — no build, no test run, no fmt. Every fact above was established by reading source and spec/decision-log text.

No test result is claimed by this packet. cargo fmt --check and cargo test --workspace were not run, so this document asserts nothing about their state; it neither reports them green nor relies on their being so.

What the gate actually proves is the status delta above: the packet's only effect on the working tree is the addition of ?? spec/AUDIT_GMINOR_VOCABULARIES.md. No source file, build input, or Cargo.lock changed, which is what makes the read-only claim checkable without running anything.