epiphany/spec/PASS12_WORKLIST.md

# Pass 12 — G-Ratification Worklist (the batch pass)

*Purpose: retire the accumulated `PASS12_BATCH.md` backlog — 28 open rows spanning
six agents — in one deliberate G pass, before the data-model schema-major-2 push
starts consuming graph-model decisions (H2, K8) and the Standard-tier solver push
starts consuming solver-contract decisions (I4/I5/I6).*

*Scope: a **spec revision pass** plus a small, explicitly-listed code tranche.
The architecture stays frozen. Most rows bless an implemented, DECISIONS-recorded
reading; four rows carried genuine forks and were decided by the project lead on
2026-07-07 (see "Key decisions" below); three rows defer to named future tracks
with rationale.*

*Working rule (Pass-11 precedent): **adopt** = bless the implementation's existing
choice in normative spec text. **decide** = a real fork, resolved and recorded
here. **defer** = punt to a *named* landing site with rationale — never a silent
drop. Every disposition lands in `PASS12_RATIFICATION_LOG.md`; every retired row
is struck through in `PASS12_BATCH.md` citing its disposition.*

---

## Key decisions this pass (project lead, 2026-07-07)

| Row | Decision |
|---|---|
| **P12-K12** | Cross-region slur spanning permission = **AND** (both endpoint regions must permit). As implemented; advisory-only, never byte-affecting. |
| **P12-H7** | Authored spelling/decomposition attachments on inference-ineligible events **surface in derived annotations** (authored-only resolution path + new taxonomy buckets). Code work in both pre-passes. |
| **P12-K4** | ResolveConflict: **no supersede** — earliest applied resolve governs universally (concurrent *and* causally-later); later resolves and resolves against `Dismissed` read `AlreadyApplied`. Re-resolution is a future dedicated operation. No `TypedObjectId::Conflict` kind; the meta-conflict names both resolver op ids, as built. |
| **P12-K8** | **Genesis outside the operation set** — the document root and canvas are structural givens (`Score::empty` + bundle creation), never op-minted. The K1 create-score/create-canvas slots are retired as *deliberately outside the operation set*, not "unavailable". Revisit only if multi-canvas becomes a real major-2+ feature. |

---

## Bucket 1 — Adopt-and-pin (spec text only; 19 entries / 20 rows)

No code changes; each blesses a deterministic implemented reading. Golden/test
anchors already exist for the byte-adjacent ones.

### 1.1 — P12-H1 — `SpellingAlgorithmId::Default` ratified
- **Spec locus:** core_spec Ch 2 (spelling pre-pass) + Appendix D §Open Algorithm Hooks.
- **Ratify:** `"default"` = the Temperley-style line-of-fifths preference algorithm,
  v1 (`epiphany-core/src/prepass.rs`). The id is now the *spec's*, not the crate's
  proposal. `CONFORMANCE.md` already declares it; drop its "pending ratification" caveat.

### 1.2 — P12-H3 — chromatic-run convention is algorithm-defined
- **Spec locus:** core_spec Ch 2, same section as 1.1.
- **Ratify:** enharmonic choice in the absence of tonal context is a property of the
  *versioned* spelling algorithm, not spec-pinned; v1's centre-of-gravity rule with
  the ascending-sharps/descending-flats convention **as tiebreak only** is the
  ratified v1 behavior. A voice-leading refinement = a future algorithm version, not
  a spec hole.

### 1.3 — P12-H4 (+ P12-C5 folded) — decomposition v1 scope bounds
- **Spec locus:** core_spec Ch 3 (decomposition pre-pass) + Appendix D hooks;
  cross-ref operation_catalog §SetTimeSignature for C5.
- **Ratify:** the v1 `DecompositionAlgorithmId "default"` bounds become *declared
  normative bounds of the versioned algorithm*: single governing meter per region;
  region origin assumed a barline (no anacrusis); dyadic compound-meter grouping;
  no tuplet nesting / cross-beat members; `MAX_DOTS = 1`. A wider algorithm is a
  version bump that deterministically invalidates derived output (the derived-
  annotation model already guarantees this).
- **C5 disposition:** reduction semantics of a mid-region `SetTimeSignature` are
  already pinned (catalog §Meter and Tempo Overwrites); the derived-notation gap is
  *subsumed by the H4 single-meter bound* — one log entry covers both rows.

### 1.4 — P12-H5 — aleatoric spelling open question closed
- **Spec locus:** core_spec Ch 2 open-question box (aleatoric regions).
- **Ratify:** spelling is region-time-model-**independent** (pitch identity does not
  depend on the time model); there is no aleatoric-specific spelling pass. Close the
  open question with that answer; aleatoric-aware refinements are algorithm-version
  territory.

### 1.5 — P12-H6 — decomposition precedence is FIXED (decided: not configurable)
- **Spec locus:** core_spec Ch 3 §decomposition precedence.
- **Ratify:** decomposition precedence is the fixed default source order
  (`UserChosen > Imported > Propagated > Inferred`, canonical attachment order as
  tie-break) — **not** configurable. Rationale: configurability requires a new
  canonical `Score` field (a schema-major) with no consumer; `DecompositionAttachment`
  deliberately carries no `priority`. Revisit at a future major only if a use case
  appears. The "same precedence machinery as spelling" sentence is reworded to "same
  source-rank discipline" (spelling's *configurability* is spelling-specific).

### 1.6 — P12-K1 — v0 RespellPitch migration fallback
- **Spec locus:** operation_catalog §RespellPitch, §Migration.
- **Ratify:** context-recovery (explicit per-pitch attachment whose canonical bytes
  hash to the fingerprint) + `MigrationError::Irreversible` → bundle read-only when
  absent is the **long-term** disposition. No richer v0 corpus will be required
  (there is no production v0 corpus).

### 1.7 — P12-K4 — ResolveConflict beyond the concurrent case *(decided above)*
- **Spec locus:** operation_catalog §ResolveConflict; core_spec Ch 6 §Conflict Records.
- **Ratify:** earliest-applied-resolve-governs applies to causally-later resolves
  (they read `AlreadyApplied`); resolves against `Dismissed` read `AlreadyApplied`;
  intentional re-resolution is out of the v1 operation set (a future `ReopenConflict`-
  class op is the sanctioned path). Conflict records get **no** addressable
  `TypedObjectId` kind; the meta-conflict names both resolver operation ids.

### 1.8 — P12-K6 — ResolveEquivocation edge semantics
- **Spec locus:** operation_catalog §ResolveEquivocation.
- **Ratify as implemented:** single-pass promotion (a promoted candidate that is
  itself a resolve does not govern a further promotion — no fixpoint); the set-level
  rule (a resolve held pending by its own causal gaps still *governs promotion* while
  its own effect stays pending); invalid-target/chosen no-ops reuse `TargetMissing`
  (consistent with the K9 disposition below, which scopes its new reason to
  differing-value *re-creates* only). **Execution note:** read
  `epiphany-ops` and write down the implemented quarantine interaction verbatim
  (may a quarantined resolve govern?) — the ratification text records what the code
  does; if the code turns out to have no defined behavior there, the text says
  "quarantined resolves are excluded from governing" only if a test proves it.

### 1.9 — P12-K8 — genesis outside the operation set *(decided above)*
- **Spec locus:** operation_catalog K1 chapter (retire the two slots) + core_spec
  Ch 5 (root/canvas genesis note) + Ch 6 (operation-set completeness statement).

### 1.10 — P12-K10 — undo strand-blocks keep `TransactionConflict`
- **Spec locus:** operation_catalog §UndoTransaction.
- **Ratify:** a StrictInverse strand-block (refusing to tombstone a minted object
  still referenced by a live non-member) **is** a transaction-scoped conflict;
  `ConflictKind::TransactionConflict` reuse is blessed — no new conflict kind. The
  refusal detail lives in the conflict record's affected-objects/description, as built.

### 1.11 — P12-K11 — undo idempotence asymmetry ratified
- **Spec locus:** operation_catalog §UndoTransaction.
- **Ratify:** an undo's value restorations are ordinary chain writes by the undo op
  (no distinguished provenance); a second undo of the same transaction sees the first
  as superseding (`Conflicted` under StrictInverse, skipped under BestEffort) while
  absence-restorations repeat idempotently. The asymmetry is documented normative
  behavior. Revisit only under the deferred undo-as-operation (streaming-consistent
  undo) track, which subsumes it.

### 1.12 — P12-K12 — cross-region slur permission = AND *(decided above)*
- **Spec locus:** core_spec validation/advisory section that defines the
  `permits_spanning_slurs` advisory (schema-major-1 Phase A text) + catalog
  §CreateCrossCutting advisory note.
- **Ratify:** a region boundary is permeable to a spanning slur only when **both**
  endpoint regions permit. Advisory-only; never alters reduction.

### 1.13 — P12-C1 — multi-source cue re-anchoring = cascade
- **Spec locus:** core_spec §Re-Anchoring Rule Table (Cue row rationale).
- **Ratify:** the table's action column is normative as written — **any** source
  deletion cascade-deletes the cue (like Tie). Fix the rationale prose to match
  ("a cue that loses any source loses its quotation integrity"); truncate-while-any-
  survives is a rejected alternative, recorded in the log.

### 1.14 — P12-C2 — graphic-gesture Range "truncate" defined
- **Spec locus:** core_spec §Re-Anchoring Rule Table (graphic gesture row).
- **Ratify:** a dead event-anchored range endpoint moves to its containing region's
  edge — start endpoint → region Start, end endpoint → region End, zero offset. As
  implemented.

### 1.15 — P12-C3 — inexpressible reconstructed ranges orphan
- **Spec locus:** core_spec §Re-Anchoring Rule Table (analytical annotation row).
- **Ratify:** a wall-clock (region-relative) or indeterminate event span that cannot
  be expressed as a stored `Range` anchor **orphans** (recorded as such); an
  expressible form is future model work, not required.

### 1.16 — P12-E4 — conservative barrier matching
- **Spec locus:** core_spec Ch 8 (edit barriers / extension declarations).
- **Ratify:** operations with no graph target (`SetMetadata`, `DeclareTransaction`)
  are matched by **score-wide barriers only**; opaque `Registered` operations match
  **fully conservatively**. As implemented in editor-core's barrier gate.

### 1.17 — P12-I4 — constraint strength is kind-determined
- **Spec locus:** core_spec Ch 9 (normalized constraint form) + Ch 7 `LayoutConstraint`.
- **Ratify:** no per-instance strength field. Strength is determined by constraint
  kind: break constraints by `BreakKind` (Hard → Required, Soft → Preferred{1.0});
  the other core families Required; `Registered` conservatively Required. Future
  (Standard-tier) constraint families **declare their strength in their normative
  definition** — the channel is the kind, not the instance. This is a deliberate
  Push-3 design input.

### 1.18 — P12-I5 — sub-conformant solver report shape
- **Spec locus:** core_spec Ch 9 (SolveStatus semantics; next to the Pass-12-tranche-1
  `SolverTier::Stub` text).
- **Ratify:** a below-conformance passthrough solver reports constraints-present-but-
  not-evaluated as `SolvedWithWarnings` + `satisfied_hard_constraints == false` + a
  dedicated warning. Renderable, honest, makes no conformance claim.

### 1.19 — P12-I6 — the Minimal-tier constraint-emission floor
- **Spec locus:** core_spec Ch 9 (spacing-pass requirements).
- **Ratify:** the normative Minimal floor = successive-notehead-column no-collision
  chains + per-glyph region containment + user-break constraints, exactly the
  implemented emission set. Standard's floor is defined when the Standard tier lands
  (Push 3). Makes the Minimal acceptance surface testable.

---

## Bucket 2 — Decide-then-build (spec text + code; 5 rows)

Spec-first discipline: the normative text lands in the same pass, the code follows
in a separate commit, each change regression-tested.

### 2.1 — P12-H7 — surface authored annotations for ineligible events *(decided above)*
- **Spec:** core_spec Ch 2 + Ch 3 pre-pass sections — derived annotations include, for
  events/pitches the algorithm produces no output for, the winning **authored**
  attachment (same source-rank discipline); taxonomy counts them in dedicated
  authored-only buckets.
- **Code:** `epiphany-core/src/prepass.rs` — authored-only resolution path in both
  `resolve_spelling`-adjacent and `resolve_decomposition` surfaces; new
  `TaxonomyReport` buckets (e.g. `spellings_authored_uninferred`,
  `decompositions_authored_uninferred`), serialized into the derivation fingerprint
  (derived annotations only — **no canonical-byte impact**; the fingerprint is not
  canonical state). Regression tests: an authored attachment on an ungriddable event
  surfaces; an outranked one does not; fingerprint changes deterministically.

### 2.2 — P12-K3 — refuse content rewrites of SYSTEM_DERIVED pitches
- **Spec:** operation_catalog §ModifyEvent + §Identified-Pitch Operations gain the
  precondition; core_spec Ch 5 Invariant 11 rationale cross-ref.
- **Code:** reduction-time precondition — a `ModifyEvent`/`ModifyIdentifiedPitch`
  that would rewrite the *intrinsic content* of a `SYSTEM_DERIVED` pitch refuses as a
  clean no-op with a **new appended** `PreconditionFailureReason` (proposed:
  `SystemDerivedContentImmutable`). Append-only vocabulary = sanctioned minor
  evolution (precedent: `TempoMapMalformed = 11`). Tests: direct refusal, reduce ==
  reduce_onto agreement, wire golden for the new discriminant.

### 2.3 — P12-K9 — dedicated reason for differing-value re-creates
- **Spec:** operation_catalog (CreateStaff, carried TimeSignature, container creates).
- **Code:** appended `PreconditionFailureReason` (proposed: `RecreateContentMismatch`)
  replacing the misnamed `TargetMissing` on live-id-re-carried-with-different-content
  refusals. Same test discipline as 2.2.

### 2.4 — P12-C4 — appended `ReanchorReason::SameCanvasNearer`
- **Spec:** core_spec §Re-Anchoring Rule Table (rank-4 survivor recording).
- **Code:** append the discriminant (after `ExplicitFallback = 4`; before
  `DeclaredByExtension`'s registered space — confirm the discriminant table allows a
  clean append; if `DeclaredByExtension` already owns 5, take 6 and record why).
  Rank-4 (same-canvas) survivors record it instead of `ExplicitFallback`. Wire golden
  + one re-anchoring test updated.

### 2.5 — P12-E5 — unsafe-edit tombstone: semantics now, encoding deferred
- **Spec (this pass):** core_spec Ch 8 ratifies the *semantics*: crossing a barrier
  via `apply_unsafe` immediately deactivates the extension's remaining barriers for
  the session; the crossing MUST be durably recorded at the next bundle commit; a
  tombstoned `required = true` extension makes the bundle open **read-only** for
  writers that honor the extension (they can no longer trust its invariants).
- **Deferred (named site):** the manifest-side *encoding* of the tombstone record —
  the manifest is major-0-forever (schema-major-1 design decision), so the record
  must ride the extension-declaration blob layer or a new chunk kind; that design
  belongs to the next bundle-format tranche. Add an `openquestion` box to
  `binary_format.tex` naming the constraint. Editor-core's
  `extensions_requiring_tombstone()` is the implemented producer awaiting that
  consumer.

---

## Bucket 3 — Defer-with-rationale (3 rows, named landing sites)

### 3.1 — P12-H2 — key/clef model: premise stale, remainder deferred
- **Finding (verified 2026-07-07):** the row's premise is stale — the content model
  *exists* (I-0: `Clef`, `KeySignature`, content-bearing `ClefChange`/
  `KeySignatureChange`) and layout consumes it (`PlacedKeySignature`, `active_clef`).
  What remains is algorithmic: the spelling pre-pass never consults declared keys
  (0 references in `prepass.rs`), and notation does no key-aware accidental
  suppression / cancelling naturals.
- **Defer:** key-aware spelling → a **spelling algorithm v2** (versioned-algorithm
  rev, invalidates derived output deterministically — no spec hole); key-aware
  accidental display + cancelling naturals → the **notation/engraving refinement
  backlog** (major-2 / Standard-tier neighborhood). Batch row struck with the
  narrowed statement.

### 3.2 — P12-K2 — Transpose interval algebra → Chapter-4 tuning track
- **Defer:** the faithful interval representation (diatonic/chromatic, octave/nominal
  renormalization, non-CMN pitch spaces) lands with the tuning catalog (Push 4).
  **Pin now (one sentence each):** the v1 payload's `chromatic_steps: i32` semantics
  = CMN alteration shift with documented `i8` saturation — a declared prototype whose
  replacement is a *payload schema-major* under the companion's evolution rule; and
  Transpose stays excluded from undo inversion (already documented).

### 3.3 — P12-K5 — profile-declared equivocation selection → profile track
- **Defer:** the third resolution path (profile-declared deterministic selection
  function) stays unpinned; v1 profiles declare **none** (ratify that sentence in the
  catalog §ResolveEquivocation rationale). The hook's definition belongs to the
  Profile Conformance companion, which does not exist yet — named landing site.

---

## Execution plan

Order of work (each tranche gated; spec-first before code):

1. **Tranche A — core_spec pre-pass text** (H1, H3, H4+C5, H5, H6, H7-normative,
   H2-narrowing): Ch 2/Ch 3 edits, two open-question boxes closed.
2. **Tranche B — operation_catalog text** (K1, K4, K6, K8, K10, K11, K12, K2-pin,
   K5-pin, K3/K9-normative): catalog version bump 0.5.0 → 0.6.0.
3. **Tranche C — core_spec re-anchoring + barriers + solver** (C1, C2, C3, C4-normative,
   E4, E5-semantics, I4, I5, I6) + binary_format openquestion (E5 encoding).
4. **Both PDFs rebuild clean** (lualatex core_spec; xelatex catalog; check
   binary_format too), zero undefined refs. → **Commit 1 (spec).**
5. **Tranche D — code** (H7 surfacing + taxonomy; K3 + K9 reasons; C4 variant), full
   gate (fmt, clippy -D warnings, workspace tests, conformance scale 1), review pass,
   → **Commit 2 (code).**
6. **Process trail:** PASS12_RATIFICATION_LOG "G-pass tranche" section (dispositions
   table, version movements, key decisions); PASS12_BATCH rows struck (28 → 0 open);
   crate DECISIONS cross-refs (core, ops, layout-ir, editor-core); CONFORMANCE.md
   H1 caveat dropped. Rides Commit 1/2 as appropriate.

After this pass the batch is **empty** and Push 2 (data-model major 2) starts with
no pending graph-model questions: H2 narrowed, K8 decided, H6 decided.