Elnor Repo Reader

ELNOR REPO READER TEXT MIRROR
Original path: Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/E1_E2_R2_Adjudication_Card.md
Source repo: /Users/OpenClaw1/Elnor/Elnor Specs
Git branch: main
Git commit: dbaa25962edc11ab30e8d4ca1715f9ae5bf77331
Generated: 2026-06-09T01:23:58.539Z

---

# E1/E2 (DOC81) R2 Design-Review Adjudication Card → R3 Commission Basis

**Date:** 2026-06-07 · **Adjudicator:** Cowork orchestrator (architect-supervised) · **Target:** `DOC81_Scope_Policy_Charter_Draft.md` (R2 + 2 fidelity fixes; 2,310 lines)
**Source reviews (this folder, `Reviews/`):**
- **CL** = `E1_E2_R2_Design_Review_Claude_Opus_4.8.md` — **3 rounds** (R1 + 2 deep-dive addenda incl. self-critique + 2 retractions). Verdict `MINOR_FIXES_THEN_RATIFY` ("do not ratify the current text"). 5 Blocking, ~14 Substantive, 9 Minor, walked cases shown, fix-composition map, NI-1 delta gate.
- **GPT** = `RT-0001_CHATGPT_CHATGPT_CONSOLIDATED_REVIEW.md` — **3 passes** (initial + deeper wiring pass + quantitative/function audit QF1–QF17). Verdict `DESIGN_REVISION_NEEDED`. 6 Blocking, ~31 Substantive incl. the QF pack.
- CODEX scoped re-audit of the two prior fidelity fixes: running via the agent rig at card time; **both design reviews independently re-confirmed the CODEX R2-B1 obligation-path fix holds** (CL walked scenario (b) PASS; GPT "confirmed, subject to B3"). Verdict folded in at R3 commissioning.

**Synthesis discipline (binding):** all positive-net-value fixes in; exclusions only low-value AND high-cost, reasoning shown. The R1 card's settled record (§1-bis R-1…R-5, F1–F10, D1–D12) remains binding — **neither review re-litigated it**; both produced `ARCHITECT_STOP`-free reviews whose findings are implementation gaps *against* the rulings, not disagreements with them.

---

## §0. Verdict reconciliation + the headline

| Reviewer | Verdict | Substance |
|---|---|---|
| CL | MINOR_FIXES_THEN_RATIFY (but don't ratify as-is) | 5 Blocking in R2's new machinery; fixes localized §3.0/§3.2/§4.0/§4.2/§4.6; NI-1 delta gate then ratify |
| GPT | DESIGN_REVISION_NEEDED (+ "required quantitative/function pass") | Same core defects + a wiring/function audit: tables defined but not consumed, formulas named but not specified |

**Adjudicated outcome: one focused R3 "executable-pipeline" revision, then the NI-1 property gate + a narrow §3.2 delta re-check, then ratification.** The two verdicts describe identical work (GPT's "R2.1 executable-functions patch" ≡ CL's "focused fix + delta-recheck"); the label difference is calibration, not substance. Architecture, ownership, E0 bindings, and the R1 33-cluster adjudication: **untouched by both reviews across six total passes** — that part of the convergence is final.

**The headline root cause (both reviews, independently):** R2 manipulates the scalar `disclosure_class` (inside `PolicyPoint`) and the `DisclosurePermissionVector` as **two separate carriers** — so every path that tightens one but not the other (floor, domain, sticky-prior, malformed-input, crosswalk) is a potential leak, and the CODEX R2-B1 obligation fix was the **third** member of this same bug family. CL's B.3 ("drop the scalar from `PolicyPoint`; vector is the sole source") and GPT's `PolicyEffectiveState` (point+vector met together, finalized once) are **the same cure**.

**HEADLINE ADJUDICATION (architect veto-able): adopt the unified-state pipeline NOW, not as a later A+ pass.** R3 §3.0/§3.2 are rebuilt around `PolicyEffectiveState { point /* 4 capability axes */, disclosure_vector }` with `meetPolicyState` / `applyScopeFloor` / `applyDestinationCrosswalk` / `applyStickyPrior` / `applyObligations` / `finalizeDisclosureAndCoherence` / `evaluateActionPredicate` (GPT §15 shape + CL B.3 semantics; scalar `disclosure_class` derived exactly once at finalize; scalar-only sources project in via CL's `disclosureVectorCeilingFor`). Rationale: third recurrence of the leak family; both reviewers converged on the cure; the refactor is **less total spec text** than five path-patches and makes the bug class unrepresentable. This subsumes CL A-B1 and GPT Q1/Q4 structurally.

---

## §1. Unified clusters (V-numbers; sources by reviewer ID; paste-ready bodies live in the reviews)

### §1.1 BLOCKING — gate ratification (9)

| V | Cluster | Sources | Adjudication + merge decisions |
|---|---|---|---|
| **V1** | **Unified policy state (the refactor).** Point+vector met together at EVERY step; scalar derived once at finalize; coherence last; scalar-only inputs projected to vector bounds. | CL A-B1 + B.3 + A2-IDEA-2; GPT Q1/Q4/№4 + §15 `PolicyEffectiveState` | **ACCEPT (headline).** Merge: GPT's state object + pipeline functions; CL's `disclosureVectorCeilingFor` projection (keyed to `DISCLOSURE_ALLOWS`); CL's lint/fixture set (incl. extending `fixture.property.monotone_down_under_add_and_remove` to the disclosure axis — it doesn't exercise it today). NI-1 laws preserved (CL's composition check: AND/MIN meets only). |
| **V2** | **Domain 9→5 crosswalk derivation** — `domainContribution()` has nothing to compute it; the meet's always-present input is unbuildable; E0 L238 says DOC81 owns the per-level semantics. Under V1 it must also emit a disclosure vector. | CL A2-B5 (paste-ready LVL_* maps + per-action axis selection); GPT Q1 (contribution vector) | **ACCEPT** — CL's seed maps land (constants architect-confirm, §13.6); per-action source selection (export→v.export etc.; internal actions unconstrained by egress axes; `source_authority` stays DOC82 warrant). Vector emitted via `disclosureVectorCeilingFor(LVL_DISCLOSE[…])`. **Do with V1 (CL: co-#1; A-B1's domain fix has nothing to read without this).** |
| **V3** | **`deriveDisclosureClass` corrected in BOTH directions** — `generic_reason_only` falls through to `full` (over-class leak, CL); source-title/exact-count/full-reason cases under-class as `generic` (GPT). | CL A-B2; GPT №7 | **ACCEPT — merged single function:** `!existence→not_disclosable`; only-existence→`existence_only`; `source_title ∨ count=exact ∨ summary=full_reason → full`; `reason_summary ∨ summary∈{generic_reason_only, redacted_reason} → redacted_summary`; else `generic_safe_label_only`. Never falls through to full. + GPT's property test (every true flag allowed by `DISCLOSURE_ALLOWS[derived]`) + CL's 4-value enumeration fixture. |
| **V4** | **R-1 enforced inside the meet (two violation paths).** (a) empty-applicable internal use hard-blocks (`policy.no_applicable_decision`) = a fifth block basis (GPT B1, walked); (b) §4.6 fail-closed rule 3 floors internal cross-matter/personal/unclassified retrieves to reference-only (CL A-B3, walked scenario (d)) — both defeat the binding R-1 ruling. | GPT B1/№5; CL A-B3 + A2-S12 | **ACCEPT both, one coherent edit:** (a) empty-applicable + same-principal internal action + no R-1 basis ⇒ **domain-profile-only baseline** (GPT's refined fix; reason code `policy.domain_profile_only_internal_baseline`); hard block retained for egress/write/learn/delegate/carryover/cross-principal. (b) §4.6 rule-3 floors apply to **egress actions**; internal actions floor only on the R-1 four; `ScopeResolutionResult.conservatism_floor_basis { r1_qualifying, flags }` (CL A2-S12) is the carrier; extended lint `policy.internal_use_floor_raised_without_qualifying_basis` (degradation counts, not just hard blocks) + CL's cross-matter fixture. **Architect confirm (flagged by CL, consistent with §1-bis):** for INTERNAL actions, unclassified material is usable (classification gates sharing) — R-1 governs over Round D §3.6's internal reading. |
| **V5** | **R-2 restore reachable: `restamp_reeval` mode.** Sticky step-4 re-clamps restamp candidates to the prior value ⇒ restamps can only keep/downgrade; autonomous restore-up-to-ceiling is structurally unreachable; "over-tightens irrecoverably." | CL A-B4 (paste-ready mode split) | **ACCEPT:** `mode='ordinary'` (sticky applies) vs `mode='restamp_reeval'` (no sticky; clamp to `MIN(root ceiling, current scope floor)` per axis + ceiling vector). §3.4 prose names the mode. + GPT QF10's guard folded: batch-quota `manual_resource_approval_required` approves **resources only**, never individual routine restamps (R-2). Lint + restore fixture per CL. |
| **V6** | **`DestinationPolicyCrosswalk` actually consumed** — defined, seeded, "RESOLVES §13.5," and never called by meet_v2 (floors/attestation/allowed-classes decorative). | CL A-S3; GPT Q2/№2 (both graded it top-tier) | **ACCEPT:** new step 0c — resolve row by `relation_to_destination`; block/`block_until_resolved` dispositions enforced; `destination ∈ allowed_outbound_destination_classes`; `combined_floor = meetFloors([scope floor, crosswalk floor])`; `egress_attestation_required` carried onto `EffectiveMemoryPolicy` (+ `destination_crosswalk_ref`). Render-may-leave included (CL/GPT converge). Lint `egress.destination_crosswalk_not_consulted` + fixtures. |
| **V7** | **Sticky prior in the cache key** — `EffectivePolicyCacheKey` omits `priorEffective`; cache reuse can serve a wider policy where the sticky prior should bind ⇒ silent monotonicity violation. | GPT Q3/№3 (CL missed) | **ACCEPT:** `sticky_prior_effective_policy_ref?` + `…_hash?` on the cache key AND on `EffectiveMemoryPolicy`; lint `cache.effective_policy_reused_across_different_sticky_prior` + fixture. |
| **V8** | **Egress precondition order** — step 0b checks raw `decisions` before step 1 builds `applicable`; a stale/context-incompatible destination-matching decision can satisfy 0b, be excluded at 1, and export proceeds on destinationless decisions. | CL A-S1 (walked); GPT initially read it as correct — CL's break stands | **ACCEPT:** split — structural 0b (destination present+typed); post-filter **1b** requires ≥1 *applicable* destination-matching decision. (Graded Blocking here: it is an egress hole adjacent to V6.) |
| **V9** | **Typed obligation union completed** — `PolicyObligation` union covers a subset of `PolicyObligationKind`; `hide_existence`/`show_generic_existence_only` (used by the vector-ceiling table) aren't concrete members. | GPT B3/Q5/№6 | **ACCEPT:** GPT's **parameter-map pattern** (`PolicyObligationParametersByKind` + mapped union) so every kind has a typed contract and future kinds can't drift; lint `policy.obligation_kind_without_typed_parameter_contract`. CL A-M4 folded: `require_safe_label → ≤ generic_safe_label_only` vector ceiling added to the table (cheap belt-and-suspenders). |

### §1.2 SUBSTANTIVE — fold all (mandatory; severity below Blocking)

| V | Cluster | Sources | Adjudication |
|---|---|---|---|
| **V10** | Lattice-error containment: `isMember` guards extend to domain/floor/prior inputs; any `PolicyLatticeError` ⇒ fail closed (today it throws uncaught — the always-present input F1 just made mandatory is unguarded). **Plus the scalar/vector-mismatch runtime guard:** an applicable decision whose stored `disclosure_class ≠ deriveDisclosureClass(its vector)` is malformed — bottom the disclosure axis + vector, exclude with `malformed_disclosure_vector` (F1 catches unknown chain values only, not internal inconsistency). | CL A-S2; GPT №5 | ACCEPT both (one malformed-input containment edit; lints `policy.decision_scalar_vector_mismatch_not_failed_closed`, `policy.lattice_error_not_failed_closed`). |
| **V11** | Disclosure rendering integrity: `meetDisclosureVectors` preserves `count_bucket_policy_ref`/`reason_summary_template_ref` (conflict ⇒ drop-to-none/fail-closed); `PolicyUIExport.scope_items` carry **per-action** `disclosure_class`+`vector` (R-3 split — a single top-level vector can't represent specific-in-app vs generic-output); `PolicyStampInvalidation` gains `notice_disposition` with `user_visible_summary_ref` optional and **forbidden** on `no_notice` (walls produce nothing); **+ per-axis `binding_constraint` attribution** on `EffectiveMemoryPolicy` (optional: which input — decision/domain/floor/obligation/prior/coherence — was the binding constraint per axis; the natural feed for the Inspector's "why is this reference-only?" surface; one assignment per axis during the meet). | GPT №8 + CL A-S4 + GPT №13 + CL A2-IDEA-1 | ACCEPT all four (one disclosure-rendering/export edit). |
| **V12** | Protection-state unification + R-1-aware effects: one 8-value enum; `active_scope_protection_state` **derived** from `protection_derivation`; GPT's `ProtectionPolicyEffects` computes `internal_use_block_basis` (the R-1 four or none) **from preserved flags, never the max-rank summary** + egress floor + notice posture. A combined `firewalled+privileged` object can't hide its wall flag behind a rank. | CL A-S5; GPT №7/№11 | ACCEPT merged — this is also V4's carrier (the flags feed `conservatism_floor_basis`). |
| **V13** | Derived/durable split actually implemented: the six named derived objects (`ScopeResolutionResult`, `ScopeBoundary`, meet result, `PolicyMembraneDecision`, `PolicyCappedDAMSInput`, `PolicyEvaluationContext`) get `persistence_kind: 'derived_projection'` + `canonical_source_refs` + `rebuild_key` (or are explicitly re-classed `audit_durable` — charter must choose per object; current text asserts both). | GPT №6/№10 (R1-card U28's incomplete landing) | ACCEPT-MODIFIED: **local `persistence_kind` marker, NOT a new `E0DerivedProjection` base** (naming a new E0-owned base would require an E0 edit; declined — D-R2 below). |
| **V14** | Capability-axis obligation consistency: **emission lint** — EC rejects a `MemoryPolicyDecision` whose axis contradicts its own blocking capability obligation (`learning_scope='global_allowed'` + `forbid_global_learning`); normative consumer-precedence line (blocking obligation governs over axis if ever inconsistent). Runtime step-5b reconciliation deferred unless non-EC producers arrive (Phase-2 DOC5). | CL A2-S7 (R3-minimized per CL's own self-critique) | ACCEPT the minimal form. |
| **V15** | Equivalence cluster correctness: `lifecycle_state` + `equivalence_generation_id` (stale-cluster invalidation on spanning-binding change) + deterministic `spanning_selection_algorithm: 'maximum_bottleneck_spanning_tree'` + contradiction disposition. F2 settlement preserved. | CL A2-S8; GPT QF5 | ACCEPT merged. |
| **V16** | Cascade execution correctness: the DOC83 freeze MUST reach `completed` before fan-out (else block/re-scan — the TOCTOU re-derivation hole); `cascadeComplete()` denominator formula; `doc84_published_views` nested under the DOC84 plane entry (F10 representation); **lawful-edge predicate** (QF12/№22): per-edge `SupportEdgeStatus` evaluations, `last_active_support_edge_lost` becomes three-state (`true/false/'unknown_due_to_unsearched_edges'`), true only when unsearched=0 AND lawful-remaining=0. | CL A2-S9; GPT QF11 + QF12 | ACCEPT merged. |
| **V17** | **Quantitative helper pack** (the GPT function audit): required-confidence-component selector (QF1); coverage math w/ uniqueness/disjointness + zero-denominator guard (QF2); threshold **polarity** model (`higher_is_safer`/`lower_is_safer`) replacing generic comparators, with `contamination_ceiling=0.0` demoted to no-profile-fallback-only (QF3 — converges with CL's seed split); contamination `minimum_measurement_confidence` + low-confidence disposition (QF4); `UnitInterval` finite-range guards (QF6); **zero-bucket ⇒ requires coverage proof** (QF7 — "none" may render only when `may_emit_not_found`); topic-match ambiguity formula (enter threshold + top1−top2 margin + suppress-candidate threshold) (QF8); canonical hash spec (sha256, canonical JSON, sorted keys, incl. disclosure vector + valid-time) (QF15); **quota-envelope math** (QF10/№20: `estimate_method` + confidence/upper-bound multiplier, progress numerator/denominator/pending/failed, chunk size/sequence/total, and `affected_items_disposition_while_pending` — quarantined-fail-closed / sticky-previous / blocked). | GPT QF1–QF8, QF10, QF15; CL seed-split | ACCEPT all (numeric seeds architect-confirm, §13.6). |
| **V18** | Collection empty-mode disambiguation: `no_topic_match → admit_collect` vs `governance unresolved/stale → defer_review_fail_closed` — two different empties, one helper today; `evaluateCollectionDisposition()` with `governance_resolution_state`. R-4 preserved. | GPT №9/QF9 | ACCEPT. |
| **V19** | Restamp lifecycle precision: MFC field becomes post-issuance `issued_memory_flow_certificate_ref?` + invariant (required once disposition commits) — resolves the decision-requires-its-own-certificate phase ambiguity; disclosure-vector ceiling comparison defined (field-wise implication + rank order + aggregate) for restamp legality over the vector. | GPT №10/QF14 + №11/QF13 | ACCEPT-MODIFIED: the **lighter optional-field form**, not GPT's second `RestampIssuance` object (mudpit guard; alternative recorded). Vector-order definition accepted verbatim. |
| **V20** | Schema-integrity batch: `ConservatismFloorEffect.effect_id` (dangling ref today); `DomainPolicyThresholdsRef` (foreign `DomainProfileId` was doubling as a DOC81 primary ID); `LegalHoldState` discriminated union (released ⇒ clearance required) + `LegalHoldClearance.hold_ref` branded; **`archive_or_suppress` split into destructive vs non-destructive visibility effects** (a hold must not block suppression/safe-labeling — R-1: holds block destruction ONLY); `contextCompatible()` contract (exact-match rule + exclusion reasons; unknown context never widens); `principal_scope` sentinel union replacing optional `principal_ref` on `ScopeResolutionResult`/cache keys (R-5 bleed risk); safe-label vocab version conditionally REQUIRED on label-bearing artifacts; **`PolicyStampScope` collapsed into `PolicyStamp.scope_items`** (duplicate object post-U4 — two must-stay-in-sync carriers invite divergence; Owner Map line 83 repoints at discharge). | GPT №12/№13/№14 + legal-hold items + CL A2-M7 (vocab, converged) + CL B-S6 | ACCEPT all. |
| **V21** | Wall integrity one-liners (Phase-2, NON-GATING, dormant for solo user): coverage-proof `required_scope_refs` exclude walled/other-principal scopes (the can't-say-not-found leak); `internal_suppressed_manifest_label_ref`/`inspector_label_ref` forbidden for `firewalled` material relative to a walled-off principal; `user_disambiguation` floor **cause-parameterized** (firewall/sealed causes ⇒ bottom vector + no prompt unless independently safe — merges GPT's `DisambiguationCause` into V4's `conservatism_floor_basis`). | CL A2-S10/S11 (self-downranked) + GPT №9 | ACCEPT as one-line invariants + lints; explicitly non-gating (CL's own anti-over-protection critique honored). |
| **V22** | **Action/exposure/relation mapping** — internal same-principal context movement (incl. `automatic_packet_injection`/`explicit_memory_attach`) is the INTERNAL retrieve/context path, NEVER `carryover`; `carryover`/`export`/`delegate` are outbound-only; internal `relation_to_destination` values never appear on egress actions (kills the latent carryover-with-internal-relation contradiction AND protects the headline cross-task injection feature from the egress tax). | CL A3-S14 | ACCEPT (one normative paragraph + 2 lints + 2 fixtures; coheres with V4/V6 — "one coherent edit to what counts as egress," CL's composition map). |
| **V23** | Action predicates actually called: pipeline step 7 `evaluateActionPredicate` + closure check; `ActionPermissionResult` + disposition carried on `EffectiveMemoryPolicy`. (Defined-but-never-called today.) | GPT №12-gap/QF17 | ACCEPT (part of the V1 pipeline finalize). |
| **V24** | Forward/cross-charter notes (non-gating): `default.ordinary` domain profile + assignment-at-creation (→ E0/PropA obligation; conservative_fallback reserved for true unknowns); `DelegatedAgentPolicyEnvelope` (→ DOC11 charter; keys exist, envelope deferred); as-of policy-history read contract named (+ CL A2-M6's honest scoping note that current valid-time filtering ≠ historical replay — the §3.2 claim is scoped accordingly NOW). | CL A2-S13/A2-M6 + GPT S4/S5 (repeat of R1 forwards) | ACCEPT as notes/stubs; no machinery built. |

### §1.3 MINOR (fold; cheap)

CL A-M1 (cascade×restamp race attribution → EC per-object CAS, not epoch chain), A-M2 (fixture-name align), A-M3 (`[proposed]` bracket consistency), A2-M5 (attestation-required compose rule = **fail-safe OR** across crosswalk/closure/predicate — one line), A2-M8 (`user_instruction_policy_bound` invariant: instructions may narrow context, never widen any axis), A3-M9 (unknown `ExposureContextSchema` value fails closed — most-restrictive exposure). GPT minors folded into V-clusters above.

### §1.4 CONFIRMED (both reviews, shown work — carry as evidence, no action)

Lattice/rank maps + `same_firewall_only` placement (both); CODEX R2-B1 obligation fix (both, walked); restamp root-anchoring/no-ratchet (both; CL attempted the ratchet); R-2 firewalled-only authority decidable (both); legal-hold default-block registry "A-grade/structural" (both); suppression ambiguity fail-closed sans prompt (GPT); traversal closed-registry/budget/trace/default-deny (GPT); export downward-only facts-only (GPT); F2 MIN-spanning + firewall guard (CL re-affirmed); §13.2 order; depth-16 (CL reasoned; see seeds); coherence content-only is correct (CL A2-IDEA-3). **CL retractions recorded:** property-suite order-independence concern; cache re-plan storm (per-scope generations make invalidation scoped — good news for the build).

---

## §2. Seed-table adjudications (§13.6)

| Seed | Decision |
|---|---|
| `THRESHOLD_DEFAULTS` 1.0/0.0 | **SPLIT (both reviews converge):** keep as **no-profile fail-closed fallback** ONLY; shipped default-profile operational values (CL suggests ≈0.85 confidence / ≈0.7 contamination; GPT: from domain profile, never 0.0 operational) — **architect confirm**. |
| Crosswalk `same_machine_local → local_file_export` floor `reference_only_candidate` | **CHANGE → `normal_policy_check`** (both reviews independently; a content floor on saving your own full work product to your own disk damages workflow; the egress attestation + DOC5 send-time gate is the control — matches the architect's over-protection ruling). Attestation stays `true`. |
| `MAX_SCOPE_TRAVERSAL_DEPTH` 16 vs GPT's 8 | **KEEP 16** (CL's reasoning: a ceiling that rarely binds; fail-closed on exceed; §6.7 quota caps cost; 8 risks false truncation). GPT alternative recorded. |
| Floor cells (all five) | CONFIRM values; their **action scope** changes per V4 (egress vs R-1-four internal). |
| `show_generic_existence_only` count=`none`; exclusion closure `source_and_derived_artifacts`; predicate minima; protection rank (egress-only per V12) | CONFIRM (both reviews). |
| Zero-bucket rendering | NEW RULE (V17/QF7): "none" renders only with `may_emit_not_found=true`; else no count / "not available". |

---

## §3. Declined / deferred (value-vs-cost shown)

| D | Item | Disposition |
|---|---|---|
| D-R1 | GPT `RestampIssuance` second object | DECLINE — lighter optional post-issuance field + invariant (V19); two objects in lockstep invite divergence (mudpit guard). |
| D-R2 | GPT `E0DerivedProjection` E0-named base interface | DECLINE the E0-named base (would imply an E0 edit/ownership); local `persistence_kind` marker delivers the same split (V13). |
| D-R3 | GPT traversal depth 8 | DECLINE — keep 16 (§2). |
| D-R4 | CL runtime step-5b capability-obligation reconciliation | DEFER — emission lint suffices while EC is the sole producer (V14); revisit at Phase-2 DOC5 grants. |
| D-R5 | Wall items as gating | DECLINE gating — encoded as one-line Phase-2 contracts (V21), per CL's own self-critique + the architect's anti-over-protection rule. |
| D-R6 | CL B.3 as "later A+ pass" | SUPERSEDED — adopted NOW as V1 (headline); the deferred-option is the declined alternative. |

---

## §4. R3 application plan (Claude Code commission; 4 edit clusters per GPT §6 ∪ CL's composition map)

1. **Pipeline cluster (V1+V2+V5+V6+V8+V23 + V4a):** rebuild §3.0/§3.2 around `PolicyEffectiveState`; domain crosswalk + maps; crosswalk step 0c; egress 0b/1b split; `restamp_reeval` mode; action-predicate step 7; empty-applicable internal baseline. **Dependencies (CL):** V1↔V2 together; V4 needs V12's flags; V22 rides the V4/V6 egress-definition edit.
2. **Disclosure cluster (V3+V9+V11 + V21 one-liners):** merged `deriveDisclosureClass`; typed obligation map; vector-ref preservation; per-action export disclosure; notice_disposition; wall one-liners.
3. **Quant/lifecycle cluster (V7+V10+V13–V20):** cache keys; lattice-error wrap; derived markers; emission lint; cluster lifecycle/spanning; cascade freeze gate + formula; the QF helper pack; schema-integrity batch.
4. **Bookkeeping:** §13.6 re-seeded per §2; minors; §10/§11 roll-ups; counts/header; **new global acceptance criterion (both reviews' meta-rule): "every table has a consumer, every metric a formula, every hash a canonicalization, every state transition rules, every optional field a condition" — run as a checklist over the final text.**

**Gate after application:** NI-1 property suite (extended to the disclosure axis) + the new fixtures; CODEX application-fidelity audit (automated via the agent rig, high reasoning effort); narrow delta re-review of §3.2/§4.6 only; architect seed-confirm (§2 items); ratification + discharge.

**Architect confirms carried into R3 (plain-language):** (1) internal use of *unclassified* material is permitted — classification gates sharing (V4; per R-1, relaxes Round D §3.6's internal reading); (2) shipped operational thresholds (§2 row 1); (3) the `local_file_export` floor change (§2 row 2 — your own disk, attested but not content-floored).

*End of R2 adjudication card. Every CL and GPT finding across six passes is dispositioned (V-cluster, minor batch, confirmed, or declined with reasoning). Git history is the version record.*