ELNOR REPO READER TEXT MIRROR
Original path: Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/E1_E2_R3_Delta_Adjudication_Card.md
Source repo: /Users/OpenClaw1/Elnor/Elnor Specs
Git branch: main
Git commit: dbaa25962edc11ab30e8d4ca1715f9ae5bf77331
Generated: 2026-06-09T01:23:58.539Z

---

# E1/E2 (DOC81) R3 Delta-Review Adjudication → R3.1 Fix Set (pre-ratification)

**Date:** 2026-06-08 · **Adjudicator:** Cowork orchestrator (architect-supervised) · **Target:** `DOC81_Scope_Policy_Charter_Draft.md` (R3; 2,682 lines).
**Reviews (both `MINOR_FIXES_THEN_RATIFY`, both scoped to the R3 delta, neither re-litigated settled material):**
- **CL** = `Reviews/E1_E2_R3_Delta_Review_Claude_Opus_4.8.md` — S1, S2, M1–M7; 4 cases PASS; meta-test PASS; C1 coherent.
- **GPT** = `Reviews/E1_E2_R3_Delta_Review_GPT_5_5_Pro_RERUN.md` — F-1, F-2, F-3; 4 cases PASS; meta-test PASS; C1 coherent.

**Outcome: R3 is ratifiable after a small R3.1 fix set (4 substantive + 3 minor), all paste-ready and localized to §3.0/§3.2/§4.6.4/§6.6. No architecture/adjudication reopened.** Both models independently confirmed all four walked cases pass, the A-B1 disclosure-leak class is **structurally impossible** (not patched), and the QF pack is genuinely formula-backed. Multi-model earned its keep: each caught a real defect the other missed (CL→S1 render floor-skip; GPT→full cache-key gap). All findings below verified against the draft text.

## Substantive — must fix before ratification (4)

**D1 — render-may-leave egress-floor skip + `isEgressAction` undefined (CL S1; GPT missed; VERIFIED).** 0c (L899) consults the crosswalk for `render* with destination` and computes `destination_floor`; step-3 (L938) applies the floor only `if isEgressAction OR r1_qualifying` — both false for a render ⇒ full content renders externally, attested but **not** floored (the A-S3 leak family R3 was built to close). `isEgressAction` has **no definition** (sole occurrence is its use, L938). **Fix:** (a) widen the step-3 gate to also fire on `(action startsWith 'render' AND destination present)`; (b) define the action partition once (also discharges D4's `isEgressAction`/`isInternalAction`):
```text
isEgressAction(a)   := a in { export, delegate, carryover }
isInternalAction(a) := a in { retrieve, classify, inspect, ui_disclose, collect, extract,
                              render_inline, render_reference_only, render_safe_label }   # render WITHOUT a destination
# exhaustive + mutually exclusive over MemoryPolicyAction; a render WITH a destination is egress-for-floor (the step-3 clause).
```
+ lint `egress.render_with_destination_floor_not_applied` + fixture `fixture.egress.render_may_leave_applies_crosswalk_floor`.

**D2 — `local_file_export` seed contradiction (CL S2 = GPT F-2; UNANIMOUS; VERIFIED).** §4.6.4 inline seed (L1820) still says `same_machine_local → local_file_export` floor `reference_only_candidate`; §13.6 (L2604) correctly says `normal_policy_check` + `E0EgressAttestation` retained (per the architect ruling: your own disk = attested, not content-floored). A Stage-7 coder following §4.6.4 would content-floor a litigator saving their own full work product. **Fix:** align the §4.6.4 seed comment to `normal_policy_check, E0EgressAttestation REQUIRED` (no schema change; the crosswalk row already carries `policy_floor`).

**D3 — `PrincipalScope` did not land on the cache keys (GPT F-1, elevated over CL's M7; VERIFIED).** V20's whole point was to remove the optional/buried principal shape (R-5 Phase-2 bleed guard) — but `ScopeResolutionCacheKey` still has `principal_ref?: PrincipalRef` (optional, L2167) and `EffectivePolicyCacheKey` has no principal sentinel (relies on the nested `policy_evaluation_context_ref`, L2175). Two distinct principals can collide on the principal-absent key; the effective-policy key isn't self-contained. **Fix:** GPT's paste-ready patch — `principal_scope: PrincipalScope` **required** on BOTH cache keys (replace the optional `principal_ref` on the first; add to the second) + lint `cache.policy_key_missing_principal_scope`. *(CL's C2 "present in both" was wrong on the merits — it counted the transitive context-ref as sufficient; GPT is correct.)*

**D4 — define the pseudocode-only pipeline helpers (CL M2 ∪ GPT F-3 ∪ CL M1; UNANIMOUS).** Referenced-but-undefined load-bearing ops a Stage-7 author would otherwise guess. Land one-line definitions:
- `domainBaselineDecision` → **remove it** (GPT's cleaner form): replace the step-1c line with `use_domain_profile_only_internal_baseline = true` (applicable stays `[]`; step 2's always-present `domainContribution` IS the baseline) — eliminates the fake-decision-object type mismatch.
- `toPolicyPoint(d)`, `priorState(e)`, `clampPointDown(p,c)` → the paste-ready bodies (CL M2 / GPT C3 — they agree; `priorState` must carry obligations/attestations/floor-refs per GPT).
- `rootCeilingItems(request)` → exact match by `(object, action, destination?)` against the root `PolicyCeilingSnapshot`; missing item ⇒ `blockedBottomState('restamp.missing_root_ceiling_item')` (GPT).
- `FLOOR_EFFECT(floor)` return shape → project the §4.6.1 `ConservatismFloorEffect` row to `{ point:{4 axes}, max_disclosure_vector, effect_id }` (CL M1 — step 3 reads `.point`/`.max_disclosure_vector` which don't exist as-is).

## Minor — fold into the same commit (3)

**D5 — algebra hygiene (CL M3 + M4).** `meetAllStates` empty-safe (return ⊥-state or throw `PolicyLatticeError` → caught by the step-`catch`, not a raw `TypeError`); and either Set-union `obligations`/`applied_floor_refs` in `meetPolicyState` (dedupe by ref, mirrors `required_attestations`) OR state that the NI-1 `fixture.property.*` compare **finalized + set-normalized** results — pick one where the property fixtures are defined (§11). Makes NI-1 literally true over `PolicyEffectiveState`.

**D6 — `forceBottomDisclosure` posture (CL M5; one architect sub-call — RECOMMEND F1-alignment).** A decision whose `disclosure_class ≠ deriveDisclosureClass(vector)` currently bottoms the **whole** `eff.disclosure_vector` (⇒ object effectively blocked). F1 (the sibling rule for malformed capability axes) instead floors only the one axis, explicitly so one corrupt record can't DoS a request. **Recommend:** align with F1 — **exclude** the self-contradictory decision (`continue`, like a stale/incompatible decision) and let the meet proceed on the valid inputs (domain always present), rather than bottoming the object's disclosure. More consistent + avoids a single bad record blocking an object; still fail-closed (the bad decision contributes nothing). Architect-confirmable; either is safe.

**D7 — stale prose (CL M6).** §3.2 L881 "step order 0→6 is normative" → **0→7** (the step-7 action-predicate gate, V23, postdates the prose). Cosmetic.

## Confirms + non-findings
- **C1 (V13 derived/durable):** COHERENT — both models; no fix (optional belt-and-suspenders lint `classification.derived_projection_persisted_as_durable_truth` noted, not required).
- **C4 seeds:** sound for a securities-litigation-first user (both confirm): shipped `{0.85, 0.70}` + no-profile fallback `{1.0, 0.0}`; depth 16; contamination `min_confidence 0.60`; topic band `0.20` / admit `0.70`. Only the §4.6.4 stale seed is wrong → D2.
- **Meta-test:** PASS (both) — every table has a consumer, every metric a formula, every hash a canonicalization, every stateful object transition rules, every optional field a presence condition (D3 is the one optional-field exception → fixed).
- **Nothing to subtract** (CL standing pass): R3 already removed the redundant scalar-disclosure representation; wall items already non-gating (D-R5).

## Application + next
Small, localized, all paste-ready → apply directly as **R3.1** (no full Claude Code round needed): §3.0 (D4 helpers, D5), §3.2 (D1 gate+partition, D4 baseline-sentinel, D6, D7), §4.6.4 (D2), §6.6 (D3). Then: re-run the NI-1 property gate (disclosure-axis extension) + a targeted re-grep of the four touched regions; **architect seed-confirms** (the three from the R2 card — already approved) + **D6 posture**; then **ratification** (`Ratification.md`) + discharge sweep. Both delta reviews on file; this card dispositions every CL (S1/S2/M1–M7) and GPT (F-1/F-2/F-3, C1–C4) finding.