KB-49C6

RS4A-12 — Remaining Blockers and Sequencing — 2026-06-21

6 min read Revision 1

rs4ablockerssequencingowner-of-recordrs-validatordesign-only2026-06-21

RS4A-12 — Remaining Blockers and Sequencing — 2026-06-21

Macro: RS4A · Mục tiêu L (blockers + sequencing) Deliverable: 12 of 14 · design-only Gate: REGISTRATION_HOLD · REGISTRATION_CAN_PROCEED = NO

1. Blocker register (carried + live-reconfirmed this macro)

ID	Blocker	Status	Live evidence (this macro)	Closes by
G1	Registrar source unreadable	RESOLVED (RS3C)	source recovered + hash-verified (snapshot id 6022/5963)	—
NF1	Operational registrar unsafe for governed registration	OPEN — controlling; addressed by design (`REPLACE_FOR_GOVERNED_REGISTRATION`, RS4A-10)	24 line-cited defects (RS4A-01)	building the governed replacement (implementation, post-acceptance)
G2	Owner-of-record absent	OPEN — deciding authority	`governance_object_ownership = 0` (live)	Owner decision (authors owner head)
G3	No `register_dot` quorum-bound action	OPEN	`apr_action_types` 14 codes, no `register_dot`; register-shaped codes `unimplemented` (live)	Owner authors governed action + handler
G4	No deployed-artifact-hash carrier	OPEN — sharpened	`dot_tools` 0 hash cols; `context_pack_manifest` checksums are per-pack aggregate (no per-artifact carrier); snapshot binds identity not hash (live)	Interface F carrier hardening (RS4A-06 §5)
G5	No fit replay/idempotency surface	OPEN	`iu_route_attempt` = retry ledger (rejected); no fit surface ⇒ `REPLAY_SURFACE_REQUIRED_NOT_PRESENT`	replay surface design + Owner approval
G6	No durable immutable audit sink	OPEN	`event_outbox` (215,647 rows) only a BEFORE INSERT validate trigger — no immutability (live)	sink hardening (RS4A-08 §5)
G7	Activation side-effect at registration	OPEN — fenced; producer condition read live (P4 closed)	notify fires iff `tier∈["A","B","C"] AND status='active'`; consumer mode `warn` but body unread (`G7-consumer`)	inert-status invariant (RS4A-09) + consumer-body proof

Single-sufficient blockers (each alone blocks registration): NF1, G2, G4, G5, G6. Deciding authority blocker = G2 (Owner-of-record). Upstream code blocker = NF1, now converted into a concrete replacement design.

RS4A closes none of G2–G7 (they are Owner/implementation-gated) — it converts NF1 into a buildable governed-replacement contract and sharpens G4/G7. This is design completion, not a registrar PASS.

2. What RS4A delivers vs what remains

Delivered (design)	Remains (gated)
Source-defect ledger (RS4A-01)	Owner authors owner-of-record head (G2)
Target contract v0.2 (RS4A-02)	Owner authors governed `register_dot` action + quorum binding (G3)
Delta matrix + replace decision (RS4A-03/10)	Interface F carrier hardening proven (G4)
Phase model + proof obligations (RS4A-04)	Replay surface designed + approved (G5)
Authority / Interface F / replay / sink contracts (RS4A-05/06/07/08)	Audit sink immutability/retention hardened (G6)
Trigger closure + P4 condition (RS4A-09)	Consumer-body proof for `context_pack_event` (G7-consumer)
≥80 acceptance cases (RS4A-11)	Implementation of the governed replacement (post-acceptance)

3. Sequencing

RS3C ──(Codex ACCEPT)──> RS4A (this package, design-only)
                              │
                  Codex review of RS4A
                              │
        ┌─────────────────────┴─────────────────────┐
        │ if ACCEPT(RS4A contract)                   │
        ▼                                            │
  G2 Owner-of-record decision (DECIDING) ────────────┤  (Owner-gated; cannot be waived by engineering)
        │  + G3 register_dot action authored          │
        ▼                                            │
  Carrier (G4) / Replay surface (G5) / Sink (G6)     │  each born/tested/rolled-back SEPARATELY
  hardening designs (each its own macro)             │
        ▼                                            │
  Governed-registrar IMPLEMENTATION (replacement)    │  (NOT before Owner + gate + design acceptance)
        ▼                                            │
  REGISTRATION (still gated)                          │

RS-VALIDATOR-HARDENING: the validator stays pure (it is not the replay-state owner, not the nonce owner). RS-VALIDATOR may begin only after Codex accepts the RS4A source-aware contract, because the validator's reject-code surface must match this contract (RS4A-02 reject table) and the C1 replay model (RS4A-07). It must not start before acceptance (must-not-do #29). RS2B residue closure is sequenced after, not bundled.

Implementation: must not open before Owner (G2/G3) + gate + design acceptance (must-not-do #30). The governed replacement is built only after that.

4. Single next recommendation

Codex reviews RS4A. On acceptance, the single deciding next step is the G2 Owner-of-record decision (author the owner head + governed register_dot action), which unblocks the per-block hardening designs (carrier G4 / replay G5 / sink G6) and ultimately the governed-registrar implementation. Do not open RS-VALIDATOR or implementation before Codex accepts this contract package.

5. Status

Blockers: G1 RESOLVED; NF1 addressed-by-design; G2–G7 OPEN (G4/G7 sharpened, P4 closed at producer).
Sequencing fixed; RS-VALIDATOR gated on Codex acceptance; implementation gated on Owner + acceptance.
Gate REGISTRATION_HOLD · CAN_PROCEED = NO.