RS5A-PATCH3-03 — Quorum Reject-Code Precedence & Delegation Interval — 2026-06-21

Macro: RS5A-PATCH3 · Residual R2-precedence · Deliverable: 03 of 6. Class: scoped semantic-closure correction. Additive. Does NOT overwrite RS5A-PATCH2-03; the PATCH2 reject-code register stands. This file adds the deterministic precedence, the mutually-exclusive predicates, and the precise delegation interval that PATCH2-03 left ambiguous (Codex §5, §3 GOV-COUNCIL PARTIAL, §9.2). Scope guard: design-only requirements contract for a future quorum surface. Creates no scope, no principal registry, no APR, no vote, no binding row. DOT_APPROVAL_QUORUM_AUTHORITY remains REQUIRED_NOT_PRESENT; the canonical-principal surface remains CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT. Fail-closed until created and proven. Gate carried: REGISTRATION_HOLD · REGISTRATION_CAN_PROCEED = NO · 0 mutations.

1. The defect (Codex §5)

PATCH2-03 defined the correct canonical fields and nine reject codes, but several reject conditions overlap with no stated precedence, so one input could map to more than one code and an implementation could be contract-compliant while disagreeing with the oracle:

• a free-text "president" with no authoritative binding satisfies both FREE_TEXT_PRESIDENT_REJECTED and PRESIDENT_ROLE_UNRESOLVED;
• a self-declared ai_council with no canonical principal satisfies both SELF_DECLARED_COUNCIL_IDENTITY_REJECTED and COUNCIL_PRINCIPAL_UNRESOLVED;
• two aliases resolving to one principal satisfy both APPROVER_ALIAS_DOUBLE_COUNT and CANONICAL_PRINCIPAL_DOUBLE_COUNT.

Additionally, PATCH2-03 §2 wrote the delegation window as [effective_from, effective_to] (closed) but §3 required the vote "strictly inside," and provided no boundary outcome and no "not-yet-effective" code.

2. Deterministic precedence ladder (one input → one code)

Quorum identity evaluation runs the ladder top-down; the first band whose predicate matches emits that band's code and evaluation stops. Bands are checked in order P0 → P5. Within a band, the listed predicates are mutually exclusive (no input matches two predicates in the same band).

band	code(s)	fires when	precedence rationale
P0 structural / missing surface	CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT	the canonical-principal surface (registry / role-slot binding / membership-of-record) is absent, so no identity claim can be authoritatively resolved at all	a missing surface dominates everything; this is the live fail-closed state today
P1 explicit spoof / type claim	FREE_TEXT_PRESIDENT_REJECTED · SELF_DECLARED_COUNCIL_IDENTITY_REJECTED	an approver asserts an authority/type it has not proven: president claimed via free-text approver string; or approver_type='ai_council' self-declared without canonical_voting_body membership	a specific spoof signal is more diagnostic than a generic "unresolved"; report the spoof, not the absence
P2 delegation invalid	DELEGATION_REVOKED → DELEGATION_SCOPE_MISMATCH → (DELEGATION_NOT_YET_EFFECTIVE ∥ DELEGATION_EXPIRED)	a vote is cast via a delegation that is revoked, out-of-scope, or outside its effective window	a broken delegation chain invalidates the vote before any resolution/count question
P3 principal resolution	PRESIDENT_ROLE_UNRESOLVED · COUNCIL_PRINCIPAL_UNRESOLVED	no spoof was asserted and any delegation is valid, but the principal still cannot be resolved to the required slot / to a canonical principal	generic non-resolution, only after spoof (P1) and delegation (P2) are ruled out
P4 duplicate / double-count	APPROVER_ALIAS_DOUBLE_COUNT → CANONICAL_PRINCIPAL_DOUBLE_COUNT	the principal resolved, but is counted more than once	a counting fault only arises after a vote resolves to a valid principal
P5 quorum count insufficient	QUORUM_NOT_SATISFIED	every individual vote is valid and de-duplicated, but the resolved tally is below threshold (president ≥ 1 ∧ council_member ≥ 2 distinct canonical principals)	the terminal count check, only after all per-vote faults are excluded

Effect/artifact binding (QUORUM_EFFECT_BINDING_MISSING, carried from PATCH1-04 §3 / live QUORUM_EFFECT_BINDING_INSUFFICIENT) is orthogonal to identity and is evaluated separately; identity-valid quorum remains necessary-not-sufficient for admission (carried, unchanged).

3. Precise overlap-resolution rules (the four cases Codex named)

1. Free-text president, no authoritative binding ⇒ FREE_TEXT_PRESIDENT_REJECTED (P1), never PRESIDENT_ROLE_UNRESOLVED (P3). Rationale: an asserted-but-unproven president claim is a spoof signal; P1 precedes P3.
2. Self-declared ai_council, no membership binding ⇒ SELF_DECLARED_COUNCIL_IDENTITY_REJECTED (P1), never COUNCIL_PRINCIPAL_UNRESOLVED (P3). Same rationale.
3. Two distinct aliases / delegations resolving to one canonical principal ⇒ APPROVER_ALIAS_DOUBLE_COUNT (P4, checked first). Discriminator: the two counted votes present different approver/delegate surface strings that resolve to one canonical_principal_id.
4. Exact repeat of one canonical principal with the same canonical identity reference ⇒ CANONICAL_PRINCIPAL_DOUBLE_COUNT (P4, checked second). Discriminator: the two counted votes present the same canonical identity (no distinct alias/delegation surface).

P4 mutual exclusivity is defined on surface-string equality: distinct surfaces → APPROVER_ALIAS_DOUBLE_COUNT; identical canonical reference → CANONICAL_PRINCIPAL_DOUBLE_COUNT. An input cannot satisfy both because "surfaces differ" and "surfaces identical" partition the space.

4. Delegation interval — single half-open convention

Convention: [effective_from, effective_to) (half-open). A delegation is time-valid iff:

effective_from <= vote_timestamp < effective_to

Boundary and out-of-window outcomes (deterministic):

condition	outcome
vote_timestamp == effective_from	valid (lower bound inclusive)
effective_from < vote_timestamp < effective_to	valid
vote_timestamp == effective_to	invalid → DELEGATION_EXPIRED (upper bound exclusive)
vote_timestamp > effective_to	invalid → DELEGATION_EXPIRED
vote_timestamp < effective_from	invalid → DELEGATION_NOT_YET_EFFECTIVE

New canonical reject code (declared in PATCH3 only): DELEGATION_NOT_YET_EFFECTIVE — a vote cast before the delegation's effective_from. This sharpens the interval boundary that PATCH2-03 left to the single DELEGATION_EXPIRED code (Codex §5 explicitly permits adding this code to sharpen interval semantics). It is declared canonical here for the interval boundary; PATCH2-03's register is not edited (additive only).

Revocation precedence (overrides interval): if the delegation or its principal binding is revoked at vote time, DELEGATION_REVOKED fires regardless of the interval result. Per the P2 order, revocation is checked before scope, and scope before interval: DELEGATION_REVOKED → DELEGATION_SCOPE_MISMATCH → (DELEGATION_NOT_YET_EFFECTIVE ∥ DELEGATION_EXPIRED).

5. Canonical reject-code register after PATCH3 (ten identity codes)

The nine PATCH2-03 §4 codes stand unchanged; PATCH3 adds one. This register is authoritative for these ten, ordered by precedence band.

band	reject code	source
P0	CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT	carried (PATCH2-03 §5; live fail-closed state)
P1	FREE_TEXT_PRESIDENT_REJECTED	PATCH2-03
P1	SELF_DECLARED_COUNCIL_IDENTITY_REJECTED	PATCH2-03
P2	DELEGATION_REVOKED	PATCH2-03
P2	DELEGATION_SCOPE_MISMATCH	PATCH2-03
P2	DELEGATION_NOT_YET_EFFECTIVE	NEW — PATCH3-03 §4
P2	DELEGATION_EXPIRED	PATCH2-03 (now upper-bound only)
P3	PRESIDENT_ROLE_UNRESOLVED	PATCH2-03
P3	COUNCIL_PRINCIPAL_UNRESOLVED	PATCH2-03
P4	APPROVER_ALIAS_DOUBLE_COUNT	PATCH2-03
P4	CANONICAL_PRINCIPAL_DOUBLE_COUNT	PATCH2-03
P5	QUORUM_NOT_SATISFIED	terminal count code (carried; separate from QUORUM_EFFECT_BINDING_MISSING)

(CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT is the present-state P0 gate, not one of the nine per-vote identity codes; counting only the per-vote identity codes, PATCH2's nine become ten with DELEGATION_NOT_YET_EFFECTIVE.)

6. Identity-case mapping is unchanged

The RS5A-09 identity cases A11, A12, F07, F08 keep the canonical outcomes assigned in PATCH2-04 §4; the precedence ladder makes those assignments deterministic rather than merely declared:

• A11 (approver='president-bot') → FREE_TEXT_PRESIDENT_REJECTED (P1 beats P3) ✔
• A12 (self-declared ai_council) → SELF_DECLARED_COUNCIL_IDENTITY_REJECTED (P1 beats P3) ✔
• F07 (approver='vice-president') → FREE_TEXT_PRESIDENT_REJECTED (P1) ✔
• F08 (two aliases of one principal) → APPROVER_ALIAS_DOUBLE_COUNT (P4 alias before exact) ✔

No scenario is added or renumbered; count stays 84 parent IDs / 86 executable scenarios (see [[rs5a-patch3-04]]).

7. Present-state and fail-closed posture (carried)

The canonical-principal surface is CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT; DOT_APPROVAL_QUORUM_AUTHORITY is REQUIRED_NOT_PRESENT; governance_object_ownership = 0; the live president mechanism is the fail-open approver ILIKE '%president%' text match and the only live anti-double-count is UNIQUE(apr_id, approver) literal-string. Because the surface is absent, the P0 band fires today and every quorum-identity decision fails closed. No principal ID is invented; no scope, registry, or binding row is created.

8. LEGO / non-mega check

Adding precedence and one boundary code does not widen DOT_APPROVAL_QUORUM_AUTHORITY. It still owns exactly one decision class — who may approve and what quorum means — and confers no registration/admission/activation authority (MUST_NOT_IMPLICIT_INHERIT carried). No mega-registry, mega-graph, or mega-birth pipeline is introduced.

9. Status

R2-precedence residual CLOSED (design-only, fail-closed): a deterministic P0→P5 ladder maps one input to one code; spoof codes precede generic unresolved; distinct-alias double-count precedes exact-identity double-count; the delegation window is the single half-open interval [effective_from, effective_to) with DELEGATION_NOT_YET_EFFECTIVE for the lower boundary and DELEGATION_EXPIRED for the upper; revocation overrides interval. …QUORUM_PRECEDENCE_INSUFFICIENT HOLD condition does not apply.