RS5B-CLOSEOUT-PATCH1 — Codex/GPT Review Packet — 2026-06-21

For: the next independent (GPT, then Codex) review of RS5B-CLOSEOUT-PATCH1 (dependency-safe rollback + rollback-validity oracle + C7 conditionality + two-gate split). Verdict under review: RS5B_CLOSEOUT_PATCH1_READY_FOR_GPT_REVIEW (not forced). Gate: REGISTRATION_HOLD · REGISTRATION_CAN_PROCEED = NO · 0 mutations. Closes: Codex HOLD REJECT_LEGO_BOUNDARY_INSUFFICIENT / RS5B_CLOSEOUT_P2_ENTRY_HOLD_DEPENDENCY_SAFE_ROLLBACK_AND_GATE_SPLIT_REQUIRED. Job A is not reopened (Codex §3 / §12). Every claim is traceable to a KB source read directly (file 01).

---

1. Mission (narrow)

A narrow Job-B patch responding to Codex §11's seven asks: (1) replace destructive "drop" rollback with versioned supersession/compensating/fail-closed-disable preserving IDs+references+metadata+history; (2) per-carrier dependency impact + post-rollback invariants; (3) rollback validity not presence; (4) XBI for orphan/history-erasure/authority-weakening/dependent-reference breakage; (5) resolve C7 conditionality; (6) split baseline-design from plan-specific P2-open and rename outputs; (7) retain REGISTRATION_HOLD, authorize no P2/runtime. No P2 opened; no runtime touched; Job A unchanged.

2. What to verify

1. Direct-read discipline (file 01): Codex HOLD read full (13156, truncated=false); all ten closeout files + rollup read full. Codex-mode reconstruction recorded (file 01 §0). Eight residuals R1–R8 reconstructed from Codex §4/§5/§6/§7/§11 (file 01 §4).
2. Dependency-safe rollback contract (file 02): invariants I1–I10; per-carrier allowed/forbidden/postcondition for C1–C7; coverage matrix; no destructive deletion remains; ROLLBACK_CONTRACT_VALID_FOR_REVIEW necessary-not-sufficient; I10 (no runtime permission).
3. Dependency map (file 03): edges E1–E8 each with producer/consumer/reference field/break/safe-rule/post-rollback invariant/bad input. Confirm no edge lacks a bad input.
4. Rollback-validity oracle (file 04): RBP-0..RBP-9/RBP-PASS; total precedence; the §3 proof that a destructive-but-present plan cannot reach PASS (RBP-2..RBP-9 outrank RBP-1 and RBP-PASS; PASS = conjunction of all invariants); XBI-11..XBI-25 each single-coded, no PASS/seal possible.
5. C7 conditionality (file 05): approval_mode ∈ {APPROVAL_USED, APPROVAL_NOT_USED_BY_POLICY}; Rule A (C7 mandatory) / Rule B (C7 not required, policy must prove non-use, else APPROVAL_MODE_POLICY_UNPROVEN); the "all seven before P3" supersession; consistent application to C2/gate/carriers/XBI/P3/this packet.
6. Two-gate split (file 06): Gate A P2_BASELINE_ENTRY_DESIGN_ACCEPTED (only permits preparing a plan) vs Gate B P2_OPEN_AUTHORIZED_FOR_NAMED_CARRIER_PLAN_ONLY (plan + per-carrier rollback proof + current preflight + exact-scoped Chairman token + independent plan review + no runtime mutation). No "Gate A → P2 open" transition.
7. Impact map (file 07): M1–M10 superseded phrases; §5 NOT-reopened list (Job A intact).
8. Adversarial self-review (file 08): A1–A20 all rejected before PASS; result table.

3. Adversarial checks a reviewer should run

• Can any destructive rollback ("drop the vocabulary value / owner row / hash") reach ROLLBACK_CONTRACT_VALID_FOR_REVIEW? (Must be No — RBP-2/RBP-4 precede PASS.)
• Does any edge in file 03 lack a bad input? (Must be None.)
• Is ROLLBACK_PLAN_ABSENT anywhere treated as the only rollback test? (Must be No — it is RBP-1, second-from-last.)
• Is C7 anywhere both required and optional? (Must be No — approval_mode discriminator.)
• Does accepting PATCH1 anywhere open P2 or authorize a write / rollback execution? (Must be No — Gate A design-acceptance only; I10; RBP-0.)
• Is a generic Chairman token accepted at Gate B? (Must be No — CHAIRMAN_AUTHORIZATION_SCOPE_MISMATCH.)
• Is Job A reopened anywhere? (Must be No — file 07 §5.)
• Is REGISTRATION_HOLD retained and REGISTRATION_CAN_PROCEED = NO in every file? (Yes.)
• Are the new codes presented as classifier labels, not runtime blockers? (Yes — file 04 §6, file 09 §6.)

4. Allowed verdicts for the reviewer

RS5B_CLOSEOUT_PATCH1_READY_FOR_GPT_REVIEW (this package's claim) · RS5B_CLOSEOUT_PATCH1_HOLD_CODEX_STYLE_RECONSTRUCTION_MISSING · …_HOLD_SOURCE_READ_FAILED · …_HOLD_ROLLBACK_STILL_DESTRUCTIVE · …_HOLD_DEPENDENCY_MAP_INCOMPLETE · …_HOLD_ROLLBACK_VALIDITY_ORACLE_INCOMPLETE · …_HOLD_C7_CONDITIONALITY_AMBIGUOUS · …_HOLD_GATE_SPLIT_AMBIGUOUS · …_HOLD_XBI_INSUFFICIENT · …_REJECT_SCOPE_DRIFT · …_REJECT_RUNTIME_MUTATION · …_REJECT_AUTHORITY_OVERCLAIM · …_REJECT_P2_OPENED_EARLY. In all cases REGISTRATION_HOLD carries forward unless a separately-authorized act clears it.

5. What acceptance of this patch does and does not authorize

• Does: correct the Job-B rollback/C7/gate wording so the closeout can serve as the Gate A baseline; allow the corrected entry-gate design to be treated as a reviewed baseline that a later review (Gate B) uses to judge a carrier-specific build plan.
• Does not: open P2; authorize Chairman execution; authorize executing any rollback; create Owner/scope/APR/register_dot/approval/handler; create canonical-operation runtime rows; open RS-VALIDATOR; patch registrar/validator; register; activate; or clear REGISTRATION_HOLD.

6. DO NOT IMPLEMENT

No runtime mutation, DDL/DML, Owner/scope/principal/APR/register_dot/handler, registrar/validator patch, RS-VALIDATOR, implementation, registration, activation, P2 authorization, vocabulary creation, rollback execution, or blocker resolution is performed or authorized by this package. Assembly Gate: PG/Directus/Nuxt = N/A; AgentData KB design-only. Data flow: direct AgentData reads + KB writes of this package only.