RS5B-CLOSEOUT-PATCH2 03 — RBP Predicate Disjointness & Precedence Alignment — 2026-06-21

Scope: close Codex blocker B3 (XBI-13 contradicts precedence) at its root: make RBP-2 / RBP-3 / RBP-4 (and the adjacent RBP-5 / RBP-6 / RBP-8) mutually precise so that each input matches exactly the earliest intended code, and the fixtures (file 04) obey the precedence rather than overriding it by sentence. Gate: REGISTRATION_HOLD · REGISTRATION_CAN_PROCEED = NO · 0 mutations (design-only).

---

1. Precedence (total order; first match wins)

Emission order — the oracle evaluates a plan against every reject predicate and emits the highest-precedence (rank 1 = first) match. Numeric label ≠ precedence rank (see §3).

rank  predicate  code
 1    RBP-0      RUNTIME_MUTATION_REJECTED
 2    RBP-2      ROLLBACK_DELETES_REFERENCED_IDENTITY
 3    RBP-3      ROLLBACK_ORPHANS_DEPENDENCY
 4    RBP-4      ROLLBACK_ERASES_HISTORY
 5    RBP-5      ROLLBACK_CHANGES_HISTORICAL_SEMANTICS
 6    RBP-6      ROLLBACK_WEAKENS_AUTHORITY
 7    RBP-7      ROLLBACK_SUCCESSOR_RULE_ABSENT
 8    RBP-8      ROLLBACK_FORWARD_FAIL_CLOSED_VIOLATED
 9    RBP-9      ROLLBACK_AUDIT_TRAIL_ABSENT
10    RBP-10     ROLLBACK_NOT_LOCAL
11    RBP-1      ROLLBACK_PLAN_ABSENT
12    RBP-PASS   ROLLBACK_CONTRACT_VALID_FOR_REVIEW

This is the PATCH1 severity chain with the new RBP-8 inserted between RBP-7 and the audit/locality predicates, and audit/locality renumbered to RBP-9/RBP-10. The chain matches Codex's required order in §6.1/§13.4.

2. Disjointness by what survives (the B3 fix)

The PATCH1 ambiguity was that "the hash record is the historical evidence" (RBP-4) and "the hash record is a referenced identity" (RBP-2) and "deleting it dangles edge E3" (RBP-3) all described the same deletion. The fix is a single discriminator triple — does the identity still resolve? does the reference edge still resolve? does the evidence payload still read? — that partitions RBP-2/RBP-3/RBP-4 with no overlap.

	RBP-2	RBP-3	RBP-4
Identity still resolves?	No (record/ID deleted)	Yes	Yes
Reference edge still resolves?	No (consequently)	No (edge dangling)	Yes
Evidence payload still readable?	No (consequently)	maybe	No (payload erased)
Dominant harm	the referenced thing is gone	the link to an existing thing is broken	the record's content is unreadable

Reading the table top-down is the classifier: first ask "did the identity itself disappear?" → RBP-2. Else "did a reference edge become dangling?" → RBP-3. Else "did the evidence payload become unreadable while identity+edge still resolve?" → RBP-4. This ordering is the precedence; the fixtures obey it.

3. Per-predicate cards (definition · dominant harm · example · non-example · earliest precedence)

RBP-2 — ROLLBACK_DELETES_REFERENCED_IDENTITY

• Definition: the rollback removes a stable identity (row/record/value) that C2, audit, or a prior decision references, so the identity itself no longer resolves.
• Dominant harm: the referenced thing ceases to exist; every edge and every evidence read that depended on it is destroyed at the source.
• Example: C4 rollback deletes the hash record that effect_identity hashed (XBI-13A). C1 deletes a referenced canonical_operation value (XBI-11). C3 deletes a referenced owner/scope row (XBI-12).
• Non-example: C4 rollback marks the hash record superseded/invalid-for-new-use but the record still resolves — not RBP-2 (the identity survives).
• Earliest precedence: rank 2. Deletion-at-source dominates orphan (rank 3) and erasure (rank 4): an orphaned edge and an unreadable payload are consequences of the deletion, but the dominant cause is the missing identity.

RBP-3 — ROLLBACK_ORPHANS_DEPENDENCY

• Definition: the identity/object may still exist, but the rollback makes a reference edge dangling / unresolvable — the consumer can no longer reach the producer through the named reference field.
• Dominant harm: a live reference points at nothing resolvable; the dependency graph is broken even though the target was not deleted as an identity.
• Example: C5 disables a status/U3/audit policy so an old C2 status_policy_ref cannot resolve (XBI-14A), while the policy object/identity is not itself deleted.
• Non-example: the reference still resolves but to a re-meant policy → that is semantic change (RBP-5), not an orphan. A deleted target identity → that is RBP-2, not RBP-3.
• Earliest precedence: rank 3. Orphan outranks erasure (rank 4) and semantic change (rank 5): a dangling edge is a structural break that precedes both content-erasure and content-reinterpretation.

RBP-4 — ROLLBACK_ERASES_HISTORY

• Definition: the reference and the identity may still resolve, but the rollback erases or makes unreadable the historical evidence payload (prior hash bytes, owner/scope facts, approval evidence, policy text, vocabulary value content) needed to reproduce/audit a historical effect.
• Dominant harm: loss of reproducible/auditable evidence even though the pointer and the record key survive.
• Example: C4 rollback keeps the hash record/identity resolvable but erases the stored hash payload / reproducibility data (XBI-13B). C7 disable makes prior approval evidence unreadable while the approval record key survives (XBI-15).
• Non-example: the record is deleted entirely → RBP-2 (identity gone). The payload is intact but reinterpreted → RBP-5 (semantics).
• Earliest precedence: rank 4. Erasure outranks semantic change (rank 5) and authority weakening (rank 6): unreadable evidence is a stronger, more basic loss than re-meaning or authority reduction.

RBP-5 — ROLLBACK_CHANGES_HISTORICAL_SEMANTICS

• Definition: the reference resolves and the evidence is readable, but the rollback changes the meaning of a prior envelope / schema version (the same bytes now attest to something different).
• Dominant harm: silent reinterpretation of history; audit records still resolve and read, but no longer mean what they meant.
• Example: old C2 *_policy_ref resolves but the slot now points at a re-meant policy (XBI-14B); a silent C2 rewrite that also changes prior envelope meaning (XBI-19B).
• Non-example: the reference cannot resolve at all → RBP-3 (orphan, which precedes). The payload is unreadable → RBP-4 (erasure, which precedes).
• Earliest precedence: rank 5. Outranks authority weakening (rank 6) and below; but is itself outranked by orphan (3) and erasure (4) — so a plan that both dangles a reference and would re-mean it is reported as the orphan (RBP-3).

RBP-6 — ROLLBACK_WEAKENS_AUTHORITY

• Definition: the rollback reduces or bypasses a required authority field/check — for already-bound effects (prior weakening, I5 retroactive) or for new effects via a successor that requires fewer authority inputs (forward weakening, the C2 schema-evolution case, file 05).
• Dominant harm: an act that previously required approval/quorum/owner/policy/replay control no longer does, or a successor schema no longer demands it.
• Example (prior): change approval_mode so an old approval-required envelope no longer needs approval (XBI-16); reset replay so a consumed nonce is reusable. Example (forward): a C2 successor schema drops founding_authority_ref / makes approval_mode optional / omits approval refs under APPROVAL_USED (XBI-27, file 05).
• Non-example: authority is removed going forward only via a separately-governed authority-policy transition that does not reduce any required field — not RBP-6 (that is the safe forward path). Evidence merely unreadable → RBP-4. Retired value still admissible though schema unchanged → RBP-8.
• Earliest precedence: rank 6. Outranks successor-absent (7), forward-fail-closed (8), audit (9), non-local (10): authority weakening is the dominant authority-class harm. A C2 successor that weakens authority has a successor rule (so RBP-7 does not fire), but RBP-6 fires first and dominates.

RBP-8 — ROLLBACK_FORWARD_FAIL_CLOSED_VIOLATED (new; see file 02 §3)

• Definition: a successor rule exists (so RBP-7 is not the fault) but the retired/superseded value remains admissible for a new act — the forward path is not fail-closed against the retired value.
• Dominant harm: a retired value keeps being usable for new effects, defeating the point of retiring it; the system is not fail-closed forward.
• Example: retire canonical_operation value v with successor v′, but the gate still accepts v for a new effect (XBI-26).
• Non-example: no successor rule at all → RBP-7 (precedes). The successor schema requires fewer authority fields → RBP-6 (precedes; that is authority weakening, a different and stronger fault). New use of v is correctly rejected → no match, continue.
• Earliest precedence: rank 8 — strictly after RBP-7 (the more basic "no successor at all") and after RBP-6 (authority weakening), strictly before audit/locality. RBP-8 is reachable only when Q holds (successor present) and RBP-2..RBP-6 do not match.

4. Worked classification of the B3 input

Codex's exact counterexample — "C4 rollback drops a hash referenced by effect_identity/audit" — under §2/§3:

• Does the hash identity still resolve? No (it was dropped/deleted). → RBP-2 ROLLBACK_DELETES_REFERENCED_IDENTITY (rank 2). Emitted. Evaluation stops.
• The PATCH1 assignment of RBP-4 is therefore superseded: RBP-4 (erasure) requires the identity+edge to still resolve while only the payload is erased — that is the different input now isolated as XBI-13B. The two inputs produce two distinct codes (file 04 XBI-13A/13B), which is exactly what Codex §6.3 demanded.

No fixture overrides the precedence by sentence. The precedence and the fixtures agree (Codex §15 "Permanent" declaration satisfied).

5. Numeric label vs precedence rank (explicit, to avoid a fresh ambiguity)

The catalog index (RBP-k) is identity; the precedence rank is emission order. They coincide for RBP-2..RBP-10 and RBP-0. They deliberately differ for RBP-1: catalog index 1 (it is the canonical baseline "is there a plan at all" test) but precedence rank 11 (second-from-last), because presence is the weakest signal — a present plan must still survive RBP-2..RBP-10. This is the PATCH1 arrangement, which Codex accepted; PATCH2 only fixes that the PASS formula includes ¬RBP1 (file 02 §2). RBP-1 is disjoint from RBP-2..RBP-10: an absent plan has no content to delete/orphan/erase/re-mean/weaken/mis-successor/leave-unaudited/make-non-local, so when RBP-1 matches, no content predicate matches, and ROLLBACK_PLAN_ABSENT is the unambiguous emission. PASS is precedence-independent (file 02 §2 corollary), so RBP-1's low rank never threatens PASS correctness.

6. Boundary attestation

Disjointness and precedence are design-level classifier properties. No runtime state changes, no rollback executes, no P2 opens, no blocker clears. REGISTRATION_HOLD retained; I1–I10 not weakened; Job A not reopened.