RS5A-PATCH4-05 — Decision Packet — 2026-06-21

Macro: RS5A-PATCH4 · Deliverable: 05 of 5 · consolidated. Verdict: RS5A_PATCH4_READY_FOR_CODEX_REVIEW (not forced) Gate: REGISTRATION_HOLD · REGISTRATION_CAN_PROCEED = NO · 0 mutations

1. One-screen summary

dimension	result
Verdict	RS5A_PATCH4_READY_FOR_CODEX_REVIEW
Scope	total code-level quorum precedence + evaluation unit + compound fixtures + G02 partition-domain narrowing only; does NOT overwrite RS5A / PATCH1 / PATCH2 / PATCH3; does NOT reopen accepted lifecycle, G02a/b/c mutual exclusion, owner, bootstrap, handler, identity, U1/U2/U3, or hard-prerequisite semantics
R1 — P1 multi-code ambiguity	CLOSED — total order Q10 FREE_TEXT_PRESIDENT_REJECTED < Q11 SELF_DECLARED_COUNCIL_IDENTITY_REJECTED ([[rs5a-patch4-02]])
R2 — P3 multi-code ambiguity	CLOSED — total order Q30 PRESIDENT_ROLE_UNRESOLVED < Q31 COUNCIL_PRINCIPAL_UNRESOLVED ([[rs5a-patch4-02]])
R3 — evaluation unit	CLOSED — primary = single vote claim (claimed vs resolved slots); APR-level over valid claims; Q00 = context precondition; per-vote before APR count ([[rs5a-patch4-02]])
R4 — compound fixtures	CLOSED — CQ01–CQ09, each one canonical code by lowest-Q ([[rs5a-patch4-03]])
R5 — G02 partition overclaim	CLOSED — partition narrowed to domain D (prior durable decision exists); in-flight case named NO_PRIOR_DURABLE_DECISION_STATE_UNSPECIFIED, out of oracle domain, no code, no scenario ([[rs5a-patch4-04]])
Total quorum order	Q00 < Q10 < Q11 < Q20 < Q21 < Q22 < Q23 < Q30 < Q31 < Q40 < Q41 < Q50 (authoritative; overrides band labels)
Scenario count	84 parent IDs / 86 executable scenarios unchanged; DEFINED_NOT_EXECUTED
Registration gate	REGISTRATION_HOLD retained
Single next step	Codex reviews RS5A-PATCH4 → on accept, proceed to RS5B (G2 Owner-of-record execution-design / authorization-design), non-mutating

2. R1+R2+R3 — total quorum reject oracle (the core fix)

PATCH3-03 asserted within-band mutual exclusivity but did not prove it for P1/P3, leaving a single multi-fault input mapping to two codes. PATCH4-02 replaces that with a single total order over all twelve identity codes and the rule predicates may overlap; the lowest matching Q-code at the evaluation unit wins — strictly stronger than an exclusivity assertion and removing any need for a future implementer to invent a tie-break.

• Total order: Q00 CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT < Q10 FREE_TEXT_PRESIDENT_REJECTED < Q11 SELF_DECLARED_COUNCIL_IDENTITY_REJECTED < Q20 DELEGATION_REVOKED < Q21 DELEGATION_SCOPE_MISMATCH < Q22 DELEGATION_NOT_YET_EFFECTIVE < Q23 DELEGATION_EXPIRED < Q30 PRESIDENT_ROLE_UNRESOLVED < Q31 COUNCIL_PRINCIPAL_UNRESOLVED < Q40 APPROVER_ALIAS_DOUBLE_COUNT < Q41 CANONICAL_PRINCIPAL_DOUBLE_COUNT < Q50 QUORUM_NOT_SATISFIED.
• Evaluation unit: primary = a single vote claim within one APR (per-vote codes Q10–Q31, comparing claimed role slots against resolved/canonical role slots); APR-level = the whole APR over its valid vote claims (Q40/Q41/Q50); Q00 = context precondition. Per-vote invalidity is evaluated before APR-level count, so spoof/delegation/resolution faults are never mixed with the count. A multi-faulty-vote APR's single canonical outcome = lowest Q across emitted per-vote codes.
• Totality: every APR maps to exactly one of the twelve codes or IDENTITY_PASS (necessary-not-sufficient; effect-binding orthogonal, carried).
• Surface-present, not P0-masked: the order resolves P1/P3 even when Q00 does not fire; the compound fixtures assume the surface is present.

3. R4 — compound adversarial fixtures

PATCH4-03 adds CQ01–CQ09. Highlights covering the Codex blocking inputs: CQ01 (free-text president + self-declared council → FREE_TEXT_PRESIDENT_REJECTED), CQ03 (president unresolved + council unresolved → PRESIDENT_ROLE_UNRESOLVED), CQ04/CQ05 (delegation compound), CQ06/CQ07 (alias vs identical-reference double-count), CQ08 (count), CQ09 (cross-unit APR rollup). Each states input shape, matched predicates, lowest-Q winner, expected code, and evaluation unit. These are predicate-resolution fixtures, not new executable scenarios.

4. R5 — G02 partition domain narrowing

PATCH4-04 restates the G02 partition as exhaustive-and-exclusive only within domain D = same-nonce inputs with a prior durable decision (all three branches require that prior decision). The same nonce + same effect + same envelope + no prior durable decision in-flight case is out of this oracle's domain, named NO_PRIOR_DURABLE_DECISION_STATE_UNSPECIFIED (design-only label, no reject code, no executable scenario), and deferred to the future replay-surface implementation under the carried hard pre-runtime prerequisite. Accepted G02a/b/c mutual exclusion not reopened. Count unchanged.

5. Blockers & must-not-do

Carried unchanged: G2–G7 + STATUS_DOMAIN_NOT_DB_ENFORCED + U3_PARTIAL_UNIQUE_SURFACE_ABSENT + OWNER_MINT_PATH_FAIL_CLOSED + QUORUM_EFFECT_BINDING_INSUFFICIENT + QUORUM_APPROVER_IDENTITY_UNVERIFIED + BOOTSTRAP_AUTHORITY_UNRESOLVED + CANONICAL_PRINCIPAL_SURFACE_REQUIRED_NOT_PRESENT. No new blocker and no new reject code — PATCH4 adds only the total order, the evaluation unit, compound fixtures, and one out-of-domain label (NO_PRIOR_DURABLE_DECISION_STATE_UNSPECIFIED, not a code). All must-not-do held; REGISTRATION_HOLD not cleared; no Owner / scope / principal-registry / APR / register_dot / approval / handler / activation created; no DDL/DML; no validator/registrar patch; no RS-VALIDATOR opened; no implementation, registration, or activation.

6. Single next step

Codex reviews RS5A-PATCH4 (this package only). On ACCEPT_RS5A_PATCH4 → proceed to RS5B (G2 Owner-of-record execution-design / authorization-design), non-mutating, which must solve bootstrap authority and itself be authorized before any write; the canonical-principal surface and DOT_APPROVAL_QUORUM_AUTHORITY scope must exist and pass before any real register_dot. Further residual ⇒ RS5A-PATCH5.