Macro-RS5A-PATCH2 — Semantic-Closure Precision (rollup) — 2026-06-21

Opened after: Codex NEED_RS5A_PATCH2 (HOLD · SCOPE_DRIFT · GOV_COUNCIL_EDGE_INSUFFICIENT · TEST_ORACLE_INSUFFICIENT) on RS5A-PATCH1. Verdict: RS5A_PATCH2_READY_FOR_CODEX_REVIEW (not forced) · Gate: REGISTRATION_HOLD · REGISTRATION_CAN_PROCEED = NO · 0 mutations. Class: scoped semantic-closure correction. Does NOT overwrite RS5A or RS5A-PATCH1. Does NOT reopen accepted RS4A/PATCH2 identity, U3, handler, bootstrap, or prerequisite-graph semantics (Codex §9).

1. Scope

Single scoped item (Codex §10): semantic-closure precision — three corrections only: (1) remove the "deferrable" taxonomy bucket and classify activation separately from replay/audit; (2) complete the approval/quorum identity requirement with authoritative role binding, canonical principal IDs, anti-double-counting, and valid scoped delegation; (3) make test outcomes canonical with one accepted code per scenario and an unambiguous parent-ID vs executable-scenario count.

2. Closures

• Residual 1 — scope taxonomy contradiction: the post-registration "deferrable" bucket that lumped activation + replay + audit is deleted. Final classification = 8 hard pre-runtime prerequisite scopes (DOT_REGISTRAR_CONTRACT, DOT_REGISTRATION_AUTHORITY, DOT_ARTIFACT_ADMISSION, DOT_HASH_CARRIER, DOT_HEAD_UNIQUENESS, DOT_STATUS_DOMAIN, DOT_REPLAY_SURFACE, DOT_AUDIT_SINK) + 1 hard pre-runtime approval/quorum scope (DOT_APPROVAL_QUORUM_AUTHORITY) + 1 post-registration-capable activation scope (DOT_ACTIVATION_AUTHORITY). DOT_REPLAY_SURFACE and DOT_AUDIT_SINK MUST exist+pass before real register_dot; DOT_ACTIVATION_AUTHORITY is the only post-registration-capable scope; no wording permits replay/audit after runtime registration. CLOSED. ([[rs5a-patch2-02]])
• Residual 2 — GOV-COUNCIL canonical principal identity: quorum identity contract now requires canonical_principal_id, canonical_role_slot (president / council_member), canonical_voting_body (GOV-COUNCIL), principal_resolution_ref, and delegation_ref/scope/effective_window/revocation. President resolves via authoritative ref (never approver text); council resolves to distinct canonical principals; one canonical principal counts once per APR; aliases/delegations cannot double-count; delegation must be active+scoped+unrevoked+time-valid; self-declared approver_type and free-text "president" rejected. Nine canonical reject codes: PRESIDENT_ROLE_UNRESOLVED, COUNCIL_PRINCIPAL_UNRESOLVED, CANONICAL_PRINCIPAL_DOUBLE_COUNT, APPROVER_ALIAS_DOUBLE_COUNT, DELEGATION_SCOPE_MISMATCH, DELEGATION_EXPIRED, DELEGATION_REVOKED, SELF_DECLARED_COUNCIL_IDENTITY_REJECTED, FREE_TEXT_PRESIDENT_REJECTED. Design-only; scope and surface REQUIRED_NOT_PRESENT / CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT; fail-closed; nothing created. CLOSED. ([[rs5a-patch2-03]])
• Residual 3 — test oracle alias/count: one canonical expected outcome per executable scenario — D07→REGISTER_DOT_RISK_TIER_MISMATCH; H03→STATUS_VALUE_OUT_OF_VOCABULARY; H07→SUCCESS_AUDIT_FORBIDDEN_BY_PHASE4_CONTRACT; I03→DRAFT_WRITE_EMITTED_ACTIVATION_NOTIFY; G02a→IDEMPOTENT_PRIOR_DECISION_RETRIEVAL; G02b→NONCE_REUSE_DIFFERENT_EFFECT; G02c→NONCE_REUSE_AUTHORIZATION_MISMATCH; G08→IDEMPOTENT_PRIOR_DECISION_RETRIEVAL. Aliases (REGISTER_DOT_ACTION_CONTRACT_VIOLATION, SUCCESS_AUDIT_NOT_PART_OF_REGISTER_DOT_CONTRACT, ACTIVATION_SIDE_EFFECT_ON_INERT_WRITE) are documentation_alias_only, never accepted. Count = 84 parent IDs / 86 executable scenarios (84 − 1 + 3 = 86). Identity cases A11/A12/F07/F08 re-canonicalized to the specific codes without adding scenarios. Suite DEFINED_NOT_EXECUTED. CLOSED. ([[rs5a-patch2-04]])

3. Deliverables (8 files)

reports/rs5a-patch2/: index, 01-codex-patch1-hold-closure-map, 02-scope-taxonomy-final-classification, 03-gov-council-canonical-principal-and-quorum-identity-contract, 04-test-oracle-canonical-outcomes-and-count, 05-rs5a-patch2-decision-packet, codex-review-packet-… — plus this reports/macro-rs5a-patch2-… rollup. All revision=1, readback-confirmed.

4. Carried blockers & must-not-do

G2–G7 + STATUS_DOMAIN_NOT_DB_ENFORCED + U3_PARTIAL_UNIQUE_SURFACE_ABSENT + OWNER_MINT_PATH_FAIL_CLOSED + QUORUM_EFFECT_BINDING_INSUFFICIENT + QUORUM_APPROVER_IDENTITY_UNVERIFIED + BOOTSTRAP_AUTHORITY_UNRESOLVED + new CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT. All must-not-do held; REGISTRATION_HOLD not cleared; no Owner/scope/principal-registry/APR/register_dot/approval/handler/activation created; no DDL/DML.

5. Next step

Codex reviews RS5A-PATCH2 only → on accept, proceed to RS5B (G2 Owner-of-record execution-design / authorization-design, non-mutating, bootstrap-solving, separately-authorized-before-write). Further residual ⇒ RS5A-PATCH3.

Builds on / corrects [[project_laws_new_macro_rs5a_patch1_prerequisite_sequencing_correction_2026_06_21]]; consumes accepted RS4A/PATCH2 effect-identity semantics (not reopened).