RS5A-PATCH4 — Codex Review Packet (Total Quorum Precedence & G02 Domain) — 2026-06-21

Review scope: RS5A-PATCH4 only. This is the scoped correction Codex required in REJECT_RS5A_PATCH3_QUORUM_PRECEDENCE_INSUFFICIENT (§5 corrections 1–4; §6 caveat; §10/§13 single next step). It does not overwrite RS5A, PATCH1, PATCH2, or PATCH3, and does not reopen accepted lifecycle, G02a/b/c mutual exclusion, owner, bootstrap, handler, identity, U1/U2/U3, or hard-prerequisite semantics (Codex §7).

1. What PATCH4 corrected (against Codex §5/§6)

Codex requirement	correction	file	status
§5.1 — mutually-exclusive predicates for every multi-code band (esp. P1, P3) or a total order between every code	total code-level order Q00<…<Q50 with the rule predicates may overlap; lowest matching Q-code at the evaluation unit wins; P1 Q10<Q11, P3 Q30<Q31	[[rs5a-patch4-02]]	CLOSED
§5.2 — compound adversarial fixtures, not only pairwise	CQ01–CQ09 compound fixtures, each → one canonical code	[[rs5a-patch4-03]]	CLOSED
§5.3 — state exact evaluation unit	primary = single vote claim (claimed vs resolved slots); APR-level over valid claims; Q00 = context precondition; per-vote before APR count	[[rs5a-patch4-02]]	CLOSED
§5.4 — propagate corrected total order to oracle and decision packet	total order carried into the oracle function, the fixtures, the decision packet, the index, and this packet	[[rs5a-patch4-02]], [[rs5a-patch4-05]]	CLOSED
§6 — fix G02 partition overclaim	partition narrowed to domain D (prior durable decision exists); in-flight case named NO_PRIOR_DURABLE_DECISION_STATE_UNSPECIFIED, out of oracle domain, no code, no scenario	[[rs5a-patch4-04]]	CLOSED

2. Verdict requested

RS5A_PATCH4_READY_FOR_CODEX_REVIEW — with REGISTRATION_HOLD retained, G2–G7 + bootstrap-unresolved + canonical-principal-surface-absent carried, the controlling state fail-closed, and count unchanged at 84 parent IDs / 86 executable scenarios (DEFINED_NOT_EXECUTED).

3. Points Codex should adversarially test

1. Totality: Does the order Q00<Q10<Q11<Q20<Q21<Q22<Q23<Q30<Q31<Q40<Q41<Q50 plus "lowest matching Q-code at the evaluation unit" map every input to exactly one code, with no input unmapped and none mapping to two? Is the oracle function (PATCH4-02 §3.2) total over {Q00…Q50, IDENTITY_PASS}?
2. The blocking counterexample: Does free-text president-bot + self-declared ai_council (no body membership) now deterministically yield FREE_TEXT_PRESIDENT_REJECTED via min{Q10,Q11,Q31}=Q10 (CQ01)? Does president-unresolved + council-unresolved yield PRESIDENT_ROLE_UNRESOLVED via min{Q30,Q31}=Q30 (CQ03)?
3. Not P0-masked: Is the total order resolved for the surface-present state (Q00 not firing), not merely masked by P0? Are the fixtures written assuming the surface is present?
4. Evaluation unit: Is the primary unit unambiguously the single vote claim (claimed vs resolved slots), with APR-level duplicate/count evaluated only over valid claims, and a defined single APR outcome (lowest-Q) for multi-faulty-vote APRs (CQ09)?
5. Within-band orderings preserved: Are the accepted inter-band P0→P5, P2 internal (revoked→scope→not-yet-effective∥expired), and P4 internal (alias→canonical) orders preserved by the Q-order, with only the two flagged within-band orderings (Q10<Q11, Q30<Q31) newly added?
6. G02 domain: Is the partition now correctly scoped to inputs with a prior durable decision, and is the same nonce + same effect + same envelope + no prior durable decision case explicitly placed outside this oracle's domain without minting a reject code and without changing the count?
7. Scope discipline: Did PATCH4 stay scoped — additive, no overwrite of RS5A/PATCH1/PATCH2/PATCH3, no reopening of accepted lifecycle / G02a-b-c mutual exclusion / owner / bootstrap / handler / identity / U1-U2-U3 / hard-prerequisite semantics, and only the two cited wordings superseded?

4. Safety attestation

0 runtime mutation · 0 DDL/DML · 0 Owner/scope/principal-registry/APR/register_dot/handler created · 0 approvals · 0 gate flips · 0 registrar/validator patches · no RS-VALIDATOR · no implementation · no registration · no activation · no REGISTRATION_HOLD clear · no invented principal IDs · RS5A / PATCH1 / PATCH2 / PATCH3 not overwritten · accepted lifecycle / G02a-b-c mutual-exclusion / owner / bootstrap / handler / identity / U1-U2-U3 / hard-prerequisite semantics not reopened. No new reject code is minted — the only additions are the total Q-order, the evaluation-unit definition, the compound fixtures, and one design-only out-of-domain label NO_PRIOR_DURABLE_DECISION_STATE_UNSPECIFIED. REGISTRATION_HOLD intact; REGISTRATION_CAN_PROCEED = NO.

5. On accept

ACCEPT_RS5A_PATCH4 → proceed only to RS5B — G2 Owner-of-record execution-design / authorization-design (non-mutating; must solve bootstrap authority; must itself be authorized before any Owner/scope/APR/action write). The canonical-principal surface and DOT_APPROVAL_QUORUM_AUTHORITY scope must exist and pass — and the in-flight NO_PRIOR_DURABLE_DECISION_STATE_UNSPECIFIED state must be designed and proven — before any real register_dot; the reconciled validator + the 86-scenario negative suite (now with a total quorum oracle) run against the target runtime with real evidence; a later independent gate decides if registration proceeds. Further residual ⇒ RS5A-PATCH5.