RippleLogic Canon

RippleLogic: The Ethical Decision Operating System of the MathGov Framework
A General-Purpose, Multi-Scale Decision Architecture for Rights-Floor Norms, Tail-Risk Control, and Auditable Decision-Making

Tier 1-3: Research and Teaching Specification | Tier 4: Design Target (Tier-4 claims prohibited until a ProofPack is independently replayable)

Author: James McGaughran (ORCID: 0009-0005-3324-7290)
Affiliation: British University Vietnam (BUV); MathGov Institute for Ethical Systems Design
Canonical Sites: ripplelogic.org, mathgov.org
Repository: github.com/MathGov/ripple-logic

Release identity and current source hierarchy are recorded in Appendix RELEASE; Appendix AR retains version history.

Governing interpretation. Normative interpretation follows the Specification Contract in Appendix AC. Main-text rules and controlling appendices govern over examples, historical notes, and generated reading mirrors.

ABSTRACT

Governance systems, institutions, and increasingly capable artificial agents face a shared structural problem: consequential choices are often made from incomplete reality models, plural values are collapsed into a single objective, severe rights harms are treated as compensable, low-probability catastrophic losses are averaged into ordinary benefit, and optimized proxies can drift away from the conditions they were meant to protect. RippleLogic is the decision architecture of the MathGov framework for addressing that problem through explicit qualification before optimization. It is a proposed, auditable Tier 1-3 decision specification, not an empirically validated moral oracle, legal authority, physical-safety certificate, or proof of universal ethical truth. Its normative commitments are declared rather than inferred from physics, metaphysics, or mathematical form alone.

The governing sequence is Reality Grounding (RG) -> Rights Floor (RF/NCRC) -> Tail-Risk Constraint (TRC) -> Containment and Structural Viability (CSV) -> RippleLogic Score (RLS). The method is therefore two-phase: qualify options, then rank only the survivors. RG constrains claims to the evidence, configuration, causal model, affected parties, unknowns, and validity domain actually available. RF/NCRC applies non-compensatory protection so a rights-floor breach cannot be rescued by aggregate gain. TRC separately tests catastrophic, irreversible, systemic, or ruin-relevant downside rather than allowing ordinary expected benefit to dilute it. CSV asks whether the option can actually stand under its dependencies, controls, reversibility, monitoring, authority, resource closure, externalities, consequence tempo, and post-transition conditions. Only options that remain grounded, rights-safe, tail-bounded, and structurally viable enter RLS. A high score can never repair failure at an earlier stage.

Residual welfare is represented across seven Union Scopes and seven Welfare Dimensions, yielding a 49-cell accountability field rather than a claim that all welfare naturally reduces to one scalar. Effect identity, subgroup visibility, reference and baseline choices, probability semantics, dependence, temporal partitioning, active-cell masks, and uncertainty are governed so that the same underlying consequence cannot be amplified, diluted, or hidden merely by changing its representation. RLS is a conditional ranking summary over the selectable set, with normalization, uncertainty, sensitivity analysis, and refusal states. Unique framework selection requires the same leader to satisfy the signed discrimination rule against every other selectable contender under every required robustness variant; point-score leadership alone is not a decision warrant, and a sole survivor is recorded as such without fabricating a pairwise comparison.

RippleLogic also separates questions that are frequently conflated. Evidence is not authority; capability is not sentience; protection is not command power; selection is not authorization; authorization is not physical admissibility; execution is not successful outcome. The Sentience Gradient Protocol (SGP) supplies a theory-plural evidence and protection interface for possible welfare-bearing beings without turning intelligence, fluency, species, self-report, or substrate into automatic moral or political rank. Companion standards govern reproducibility, causal admissibility, source coupling, welfare-dimension boundaries, agent runtime controls, and portable assurance while remaining subordinate to the Canon and without adding a sixth gate. Decision records, version pins, hashes, controls, requalification triggers, outcome observation, appeal, and audit trails make claims reconstructable and revisable when evidence or configuration changes.

The central design hypothesis is therefore bounded and testable: decisions may become harder to game, easier to challenge, and more accountable to affected beings when reality contact, rights, catastrophic risk, structural viability, welfare trade-offs, uncertainty, and authority are represented as distinct but connected objects with explicit failure states. RippleLogic does not claim that every impact is measurable, that every conflict has a win-win solution, or that formal coherence establishes empirical validity. Where evidence is insufficient, the framework narrows, delays, redesigns, escalates, preserves multiple options, or refuses stronger claims. The intended result is not perfect calculation, but disciplined decision-making that protects non-compensable interests, resists ruin and specification gaming, exposes uncertainty and distributional burden, preserves correction pathways, and ranks only what has first earned the right to be ranked.

Reader route: Start with the Public Introduction for the short explanation and the Foundations Primer for concepts and examples. For controlling implementation requirements, use the Specification Contract (Section 0 in Appendix AC), the Current Rules-Only Navigation in Appendix AP, and the Quick Reference Card in Appendix Q. This route is an informative guide; it does not replace the Canon or change source precedence.

CONTENTS

CORE SECTIONS

SECTION 1: INTRODUCTION: THE NEED FOR A GENERAL-PURPOSE ETHICAL OPERATING SYSTEM   5

SECTION 2: ONTOLOGICAL FOUNDATIONS: UNION-BASED REALITY (UBR)   9

SECTION 3: NORMATIVE FOUNDATIONS: UNION-BASED ETHICS (UBE)   25

3.0A Ethical Reality   25

SECTION 4: SYSTEM OVERVIEW: THE RIPPLELOGIC ARCHITECTURE   29

SECTION 5: WELFARE IMPACT CONSTRUCTION (CALCULABLE)   40

SECTION 6: RIPPLE PROPAGATION: KERNEL AND EPISTEMIC HUMILITY   53

SECTION 7: RIGHTS LAYER: NON-COMPENSATORY RIGHTS CONSTRAINT (NCRC)   57

SECTION 8: CATASTROPHIC RISK LAYER: TAIL-RISK CONSTRAINT (TRC)   66

SECTION 9: CSV GATE: CONTAINMENT AND STRUCTURAL VIABILITY   73

SECTION 10: OPTIMIZATION LAYER: RIPPLELOGIC SCORE (RLS)   81

SECTION 11: TIE-BREAKS, HOLLOWING DIAGNOSTICS, AND STRUCTURAL MONITORING   97

SECTION 12: MORAL STATUS, PROTECTION, PARTICIPATION, REALITY-MANAGEMENT CAPACITY, AND POWER: SGP v8.8 INTEGRATION (BINDING INTERFACE)   102

SECTION 13: WEIGHT GOVERNANCE: HYBRID DEMOCRATIC WEIGHTING (HDW)   106

SECTION 14: AUDITABILITY AND DETERMINISM: PCC AND AIL (TIER 1-3; TIER 4 TARGET)   110

SECTION 15: IMPLEMENTATION GUIDANCE AND TIERS (NORMATIVE)   124

SECTION 16: RELATIONSHIP TO EXISTING FRAMEWORKS (INFORMATIVE)   129

SECTION 17: VALIDATION, FALSIFICATION, AND RESEARCH PROGRAM (NORMATIVE FOR CLAIMS)   131

SECTION 18: APPLICATIONS AND USE CASES (INFORMATIVE)   137

SECTION 19: LIMITATIONS AND NON-TARGETS (NORMATIVE BOUNDARIES)   138

SECTION 20: CONCLUSION: PROSPEROUS FUTURES FOR INTELLIGENCES   139

CANONICAL APPENDICES A-AC

APPENDIX A: SYMBOLS AND NOTATION (v12.0)   142

APPENDIX B: CANONICAL EQUATIONS (TIER 1-3 EXECUTABLE)   148

APPENDIX C: RIGHTS / NCRC CANON PACK (TIER 1-3)   154

APPENDIX D: TRC AND SCENARIO GOVERNANCE CANON PACK (TIER 1-3)   157

APPENDIX E: UCI OPERATIONALIZATION PACK (TIER 1-3)   160

APPENDIX F: FAILURE MODES AND ANTI-GAMING CONTROLS (v12.0)   164

APPENDIX G: SGP v8.8 INTEGRATION BINDING (NORMATIVE INTERFACE)   166

APPENDIX H: PCC TEMPLATE AND AUDIT FLAGS CANON PACK (TIER 2-3)   169

APPENDIX I: TIER-4 DESIGN TARGET (NOT CLAIMABLE IN THE CURRENT RELEASE)   184

APPENDIX J: VALIDATION PROTOCOL PACK   185

APPENDIX K: STARTER KERNEL COMPANION PACK (INFORMATIVE)   187

APPENDIX L: GLOSSARY (v12.0)   188

APPENDIX M: LINEAGE AND VERSION HISTORY (v13.0 CURRENT LINE; PRIOR LINES RETAINED) - INFORMATIVE   192

APPENDIX N: STEWARDSHIP PACK CANON (v12.0) - NORMATIVE   197

APPENDIX O: CONFORMANCE REFERENCE MAP (v12.0; Informative)   201

APPENDIX P: FULL TIER 2 WORKED RUN (Informative) - “Digital Rights & Platform Governance”   202

APPENDIX Q: QUICK REFERENCE CARD (INFORMATIVE)   213

APPENDIX R: TIER 1–3 REFERENCE TEST VECTORS (NORMATIVE)   218

APPENDIX S: INTEROPERABILITY: RIPPLE.MD WRAPPED DEPLOYMENT ASSURANCE (INFORMATIVE)   229

Appendix T: Qualification Continuity for Consequence-Bearing Action (Normative for Tier 2-3 execution)   230

Appendix U: Outcome Observation and Requalification (Normative for consequence-bearing action)   231

APPENDIX V: Measurement Maturity and Deployment Context Hardening   232

APPENDIX W: SCHEMA OWNERSHIP, REGISTRIES, AND MACHINE-VERIFIABLE SURFACES   236

APPENDIX X: REFERENCE CALCULATOR, MACHINE VECTORS, AND PROOFPACK-PREP ROADMAP   237

Appendix Y: Precision Patch - Legitimacy, Evidence Status, Validation, and Adoption Profiles   238

Appendix Z: Integration-Hardening Addendum   239

APPENDIX AA: PACKAGE-CONTENT BOUNDARY AND TOOLING LINE SEPARATION (CARRIED-FORWARD ORIGIN; ACTIVE REQUIREMENTS)   240

APPENDIX AB: REFERENCE STRUCTURE PROTOCOL   240

APPENDIX AC: SPECIFICATION CONTRACT, RELEASE METADATA, AND CLAIM BOUNDARY   242

PRESERVED CONTRACTS AND HARDENING APPENDICES

CARRIED-FORWARD v10.8 HUMAN PLATEAU / CMIU CALIBRATION AND SGP v5.6 SYNCHRONIZATION NOTICE   243

SECTION 0: SPECIFICATION CONTRACT (NORMATIVE)   246

APPENDIX AD: 49-CELL WELFARE DICTIONARY (CANONICAL INTERPRETIVE REFERENCE)   253

APPENDIX AE: Carried-Forward v10.8 Layer-Discipline, Falsification, and Adaptive Reserve Addendum (Origin retained; active requirements governed by Appendix RELEASE)   265

APPENDIX AF: Decision Verdict Semantics, Projection Freeze, Closure Status, and Authority-Selection Separation   267

APPENDIX AG: CARRIED-FORWARD v10.8 REALITY GROUNDING AND LEAN CASCADE PATCH (CURRENTLY PRESERVED THROUGH v13.0)   270

APPENDIX AH: CATEGORY GROUNDING AND PRIMITIVE AUDIT PROTOCOL   270

APPENDIX AI: TERM DISCRIMINATION AND SEMANTIC STABILITY PROTOCOL   273

Appendix AJ: Public Release Hardening Addendum (v12.0)   276

Appendix AK: Computability vs Realizability Bridge   278

Appendix AL: Source-Coupling Integrity and Generative-Source Traceability (Normative Hardening Patch)   279

Appendix AM: Physical/Causal Admissibility Evidence Profile (Normative Hardening Patch)   280

Appendix AN: Methodological Falsifiability and Dependency Integrity Standard (Normative Hardening Patch)   281

Appendix AO: Physical Execution Boundary (Normative Hardening Patch)   282

APPENDIX AP: CURRENT RULES-ONLY NAVIGATION (v13.0) - INFORMATIVE   283

APPENDIX AQ: CURRENT CANONICAL MACHINE-STATE AND MATURITY CONTRACT (v13.0) - NORMATIVE INTERFACE   284

APPENDIX AQ-1: CONFIGURATION-BOUND ASSURANCE AND READER NAVIGATION (CURRENT)   285

APPENDIX AR: VERSION HISTORY AND MIGRATION NOTES (v13.0) - INFORMATIVE   288

APPENDIX AX: NORMATIVE AND CLAIM-AUTHORITY CLARIFICATION PATCH   291

COMPLETION

FINAL DOCUMENT COMPLETION STATEMENT   292

SECTION 1: INTRODUCTION: THE NEED FOR A GENERAL-PURPOSE ETHICAL OPERATING SYSTEM

1.1 Alignment Failures Across Scales

Contemporary societies operate within a tightly coupled, high-dimensional environment where climate dynamics, global supply chains, digital communication networks, financial systems, and emerging artificial intelligence systems interact in ways that increasingly resist prediction or governance. Decisions taken at one organizational scale propagate rapidly through multiple layers of human and ecological organization, generating consequences that conventional decision frameworks fail to anticipate or manage (Meadows, 2008; Newman, 2010; Steffen et al., 2015). In this context, alignment is not exclusively an artificial intelligence problem. It spans multiple domains: aligning machine systems with human purposes and control (Russell, 2019), preventing catastrophic failure modes that could foreclose long-run human potential (Ord, 2020), and maintaining human activity within the safe and just Earth-system boundaries required for durable flourishing (Rockström et al., 2009, 2023). RippleLogic addresses this as a unified governance problem rather than as three isolated challenges.

Civilizational target and method standard (Informative)

Target. Protect applicable rights and protection floors across all affected stakeholders, protected beings, and protected systems; bound catastrophic tail-risk; and expand long-run flourishing across the operational Union Scope stack.

Method standard. A decision protocol is governance-grade only if it is auditable, reproducible, rights-respecting, tail-risk aware, methodologically falsifiable or revision-triggered at material claim points, dependency-explicit, and robust to Goodhart and adversarial pressure.

1.2 The Alignment Trilemma (Coupled Failure Modes)

Existing decision frameworks exhibit three recurring failure modes that together constitute the alignment trilemma:

Failure Mode A: Scalarization of Value

Many decision methods collapse plural values into a single metric (expected utility, GDP, cost-benefit net present value). This can enable “moral laundering”: severe harms to some unions are permitted when offset by gains elsewhere. Arrow’s (1963) impossibility theorem establishes an impossibility result for social-welfare functions under a specific set of aggregation conditions; it does not show that every multidimensional aggregation method is unfair. RippleLogic therefore treats aggregation as a bounded ranking instrument after rights, ruin, and structural-viability qualification, not as a complete theory of justice.

Failure Mode B: Tail-Risk Blindness

Expected-value reasoning can underweight low-probability, high-severity outcomes when probabilities, severity, irreversibility, dependence, or model uncertainty are poorly represented. Catastrophic outcomes can eliminate future choice; ordinary gains therefore should not be treated as symmetric compensation for poorly bounded ruin exposure (Taleb, 2012). Coherent risk measures such as CVaR improve tail-risk handling within a declared scenario model, but they do not prove that every catastrophic pathway has been identified (Artzner et al., 1999; Rockafellar & Uryasev, 2000). Climate tipping points (Lenton et al., 2008), pandemic risks, and AI misalignment illustrate why a separate tail-risk layer is required (IPCC, 2023; Bostrom, 2014).

Failure Mode C: Specification Gaming (Goodhart Vulnerability)

When metrics become targets under pressure, they are gamed. Optimization exploits proxies while degrading the intended outcome (Goodhart, 1984; Manheim & Garrabrant, 2018). This appears in institutional governance, where institutions optimize visible indicators while displacing underlying welfare, and in AI reward optimization, where systems exploit proxy objectives under strong optimization pressure (Amodei et al., 2016).

RippleLogic treats this not as a peripheral measurement problem but as a structural governance hazard. The framework is designed to resist specification gaming by separating admissibility from ranking. Rights protection is enforced through the Non-Compensatory Rights Constraint over the canonical rights-coverage set, catastrophic downside is separately gated through the Tail-Risk Constraint, and pathological cross-scale degradation is checked through containment before welfare ranking begins. An option therefore cannot compensate for a rights-floor breach, catastrophic tail exposure, or containment failure by achieving a higher downstream welfare score.

This architecture matters because Goodhart-type failure thrives where optimization is scalar, fungible, and weakly constrained. RippleLogic instead combines a 49-cell welfare matrix for welfare evaluation with an 8-right sparse rights-coverage system comprising 70 protected right-to-cell mappings, with overlapping welfare cells where more than one right applies. Harms therefore cannot simply be averaged away across unions or dimensions. A localized protected loss remains visible at the mapped protection point where it occurs.

Practical Local Scope Scoring does not weaken this defense. PLSS operates only within residual welfare ranking after admissibility has already been secured. It allows practical local attention without relaxing rights floors, tail-risk constraints, or containment requirements. In this sense, RippleLogic treats Goodhart’s Law as a boundary-crossing failure of optimization and responds with layered structural safeguards rather than with a single corrective metric.

Coupled Failure

These three failure modes interact and amplify each other. Scalarization enables tail-risk blindness (catastrophe can be traded for ordinary benefit), tail-risk blindness creates exploitable blind spots, and specification gaming undermines attempts to “patch” either problem by shifting optimization pressure. Solving one in isolation is insufficient.

Boundary-gaming note. Because lexicographic gates reduce scalar Goodharting, adversarial pressure can shift upstream toward boundary definitions, stakeholder inclusion, subgroup mapping, scenario probabilities, threshold governance, evidence sufficiency, and scope declarations; Appendix F.5 specifies the required anti-gaming disclosure and review discipline.

Category-gaming note. Because RippleLogic blocks several downstream scalarization failures, adversarial and institutional pressure can shift further upstream toward category choice, definition boundaries, reference structures, and metric formation. A run therefore MUST NOT treat inherited labels, dashboard categories, legal labels, benchmark names, model-generated descriptions, or institutional terms as valid merely because they are available. When a category materially affects rights, tail risk, containment, SGP interpretation, authority, conformance, or public claims, the category must be grounded inside Reality Grounding before the run relies on it.

Term-discrimination note. A material term must not borrow authority from a neighboring term. Permission is not admissibility; monitoring is not control; compliance is not correctness; certification is not validity; automation alone does not establish autonomy; protection is not authority; selected is not executable; and score is not truth. When term collapse would affect a gate, claim, authority state, or execution state, Term Discrimination is required inside Category Grounding.

PLSS clarification (Informative). A further practical failure appears when multi-scope frameworks oscillate between false universality, informal narrowing, and flattened aggregation. False universality treats every decision as though all seven scopes are equally active optimization targets. Informal narrowing quietly drops distant scopes when full evaluation becomes burdensome. Flattened aggregation hides where benefits and harms actually land by blending impacts into a single welfare bucket. RippleLogic v12.0 carries forward the v10.8 PLSS clarification to address this tension through Section 10.2A: admissibility remains full-scope, while residual welfare attention may become scope-proportionate.

Reality Grounding clarification (Normative preview). RippleLogic now presents Reality Grounding as the first level of the public method because every later claim depends on the surface actually contacted. The method is not “score first.” It is ground first, protect the floor, bound ruin, contain/verify viability, and only then score residual welfare.

RG status rule. Reality Grounding is Level 1 of the public method and a claim-authority precondition. It can force narrowing, escalation, exploratory-marking, or refusal, but it is not an ethical option-rejecting gate: an RG_REFUSED option is outside the claim-bounded qualified set because the requested claim lacks support at the requested strength, not because RG has found the option ethically impermissible. The option may re-enter only after grounding is repaired or the claim or action boundary is narrowed. RF/NCRC, TRC, and CSV are the ethical or structural option-rejecting gates, and RLS ranks only what survives them.

Computability-vs-realizability clarification (Normative preview). RippleLogic MUST NOT treat computed possibility, model fluency, simulation output, or generated abstraction as decision authority. Computable is not selectable; generated is not grounded; executable is not ethical; realizable is necessary but not sufficient. Reality Grounding decides the claim boundary; RF/NCRC decides rights admissibility; TRC decides ruin exposure; CSV decides whether the pathway can structurally stand; RLS ranks only the remaining selectable set.

Source-coupling clarification (Normative preview). RippleLogic also MUST NOT treat downstream operation, inherited procedure, benchmark success, model fluency, compliance status, institutional permission, or interface performance as proof that the claimed capability is coupled to the enabling conditions and boundary conditions that make it possible. Source-Coupling Integrity is a subdiscipline of Reality Grounding and a CSV diagnostic where source weakness creates structural fragility. It does not add a public gate.

Physical/causal admissibility clarification (Normative preview). RippleLogic also MUST NOT treat a physically consequence-bearing action as selectable merely because it was computed, simulated, model-generated, policy-approved, certified, monitored, or passed through a governance process. When a candidate action materially depends on physical, biological, ecological, medical, engineering, cyber-physical, infrastructural, or causal constraints, the run MUST include a Physical/Causal Admissibility Evidence Profile at the required tier. The profile belongs inside Reality Grounding and CSV. It does not add a sixth public gate, does not replace domain engineering, and does not make MathGov a proof-generating physics substrate.

Physical execution boundary. For consequence-bearing physical systems, governance permission is not physical admissibility. A MathGov run may record approval, documentation, certification, monitoring, or authority, but those records alone do not demonstrate that a robot movement, vehicle maneuver, industrial operation, medical intervention, infrastructure action, or other physical execution is safe inside the relevant physical regime. If PC-AEP is triggered, the run MUST identify a domain-appropriate external warrant such as formal verification, validated simulation, empirical testing, standards-based safety case, certified controller envelope, qualified engineering or clinical warrant, regulator-recognized method, or another explicitly named objective method. Without that warrant inside its validity domain, MathGov may record governance permission only; it MUST NOT claim physical admissibility, safe execution, deployment readiness, or ordinary physical-execution selectability. Material-unknown action rule. When the safe operating envelope, failure boundary, or specification-to-reality mapping remains materially unknown, governance may authorize only bounded evidence collection, sandboxing, containment, monitoring, staged testing, or another explicitly limited learning action whose own risks pass RF/NCRC, TRC, and CSV. Governance MUST NOT convert an unknown envelope into a safe, qualified, or ordinarily execution-authorized state by policy language, user acceptance, institutional approval, or risk transfer. Acceptance by one operator cannot waive rights, third-party exposure, catastrophic-risk obligations, or the need for domain evidence.

Computational-source boundary. A generated candidate is not the same as a verified admissible transition. For consequence-bearing physical or causal action, the run SHOULD identify the computational or procedural source that generated the candidate state, such as a model, optimizer, planner, simulator, controller, human procedure, or orchestration layer, and separately identify the domain method or warrant that evaluates admissibility. Candidate generation, output filtering, orchestration, guardrails, monitoring, and authorization MUST NOT be treated as the source of physical-safety evidence. They can route, constrain, document, or refuse a candidate only after the relevant domain evidence surface has been declared.

Structural diagnostic placement clarification (Normative preview). UCI and HOI are not public headline cascade stages. They are structural diagnostic instruments. When their evidence is material to cross-scale structural integrity, including coherence loss, hollowing, brittleness, burnout, lock-in, trust erosion, institutional erosion, ecological degradation, or governance-capacity loss, that evidence is consumed inside the CSV Gate. Only residual, non-gate-critical UCI/HOI signal remains available after RLS, and only when the leading options are tied, close, uncertainty-overlapped, or non-decisive.

1.3 Governance-Grade Requirements

RippleLogic is designed to satisfy the following non-optional requirements:

1.4 Paper Contributions

This paper provides:

• A fork-resistant normative specification for Tier 1-3 implementation.

• Canonical equations and constraints sufficient for independent implementation.

• Anti-gaming architecture (non-maskable cells, subgroup semantics, scenario governance, audit flags).

• A validation and falsification program (Section 17).

• A Tier-4 design target appendix (non-claimable until ProofPack).

SECTION 2: ONTOLOGICAL FOUNDATIONS: UNION-BASED REALITY (UBR)

2.1 Relational Ontology (Descriptive Thesis)

UBR thesis: No entity exists in complete isolation for governance-relevant domains; entities are embedded in interacting networks whose structure transmits the consequences of actions.

This is a descriptive stance supported by systems science (feedbacks and leverage points), network science (recurrent, domain-dependent structural features of real networks), and Earth-system science (planetary boundary coupling) (Meadows, 2008; Newman, 2010; Steffen et al., 2015; Rockström et al., 2009, 2023). UBR is also consistent with empirical findings in social and cognitive interdependence research showing strong links between human capacities and group structure, including the social brain hypothesis and attachment-based development (Bowlby, 1988; Dunbar, 1992, 1993), and with social contagion dynamics in networks (Christakis & Fowler, 2009).

Scope conditions: UBR is most applicable in high-coupling systems with significant externalities, multi-scale feedbacks, and long time horizons. Low-coupling, short-horizon decisions may not require full UBR modeling; RippleLogic tiers allow proportional rigor.

2.1A Decision-Relevant Reality (Operational)

For RippleLogic, reality, for decision-making, is the evaluator-independent field of constrained structures that, under transition, produce consequences. Decision-relevant reality is the portion of that field that materially bears on rights, catastrophic risk, containment, welfare, legitimacy, agency, auditability, or available choices. The reality surface is the portion actually captured, represented, and modeled in the run. RippleLogic does not claim complete metaphysical access to reality; it requires decision claims to make declared, auditable, and challengeable contact with the relevant reality surface. Here, evaluator-independent means independent of the evaluating agent’s perception, admission, authority, model, or preference; it does not deny the reality of experience or social facts. Mental states, institutions, norms, laws, markets, reputations, and model outputs may be real vehicles with real effects when they shape welfare, rights, risk, agency, or available choices.

Root-science boundary. RippleLogic treats constrained structure under transition producing consequence as the operational substrate of decision-relevant reality. This is not a final metaphysical claim about ultimate being; it is a governance-grade discipline. Physical, biological, ecological, experiential, social, institutional, informational, artificial-system, and formal/logical structures and constraints become relevant when they shape rights, risk, welfare, agency, available choices, legitimacy, or auditability.

Structure rule. Structure is the stable relational arrangement of distinguishable differences that persists across a decision-relevant transition window and can carry causal, informational, biological, ecological, social, institutional, artificial-system, or experiential significance. Structure may include physical configuration, network topology, causal architecture, biological organization, ecological interdependence, institutional role structure, information-bearing arrangement, cognitive model, social pattern, or rights-relevant exposure pattern. Structure is not the object alone, not the process alone, and not the model of the arrangement; the model is only a reality surface.

Transition rule. Consequences arise when an action, decision, event, policy, intervention, or state-shift enters constrained structure. Transition is the decision-relevant change through which constrained structure produces consequence. A RippleLogic run SHOULD declare the transition or action boundary when it makes material claims about consequence.

Constraint-species rule. A factor may bear on the decision through causal influence, such as physical, biological, ecological, social, institutional, informational, or experiential conditions, or through formal/logical constraint, such as coherence, conservation, computability, consistency, or mathematical possibility. Constraint is the genus; causal and formal/logical constraints are species. RippleLogic uses both and MUST NOT conflate them.

Constraint-status rule. Constraint is anything that limits, enables, shapes, or channels what can happen. Physical, biological, ecological, informational, experiential, institutional, computational, and formal/logical constraints may be discovered, measured, modeled, or inferred. Rights floors, dignity protections, and non-domination constraints are explicit normative commitments. RippleLogic treats all of these as governance-relevant constraints when they shape admissibility or consequence, but it MUST NOT present chosen normative commitments as if they were discovered physical facts.

Consequence rule. Consequence is the observable or inferable change that follows from an action, transition, decision, event, or policy within constrained structure. Consequences may be direct, probabilistic, systemic, delayed, distributed, reversible, irreversible, moral, institutional, epistemic, ecological, or catastrophic. Consequence claims require evidence traces, scenario boundaries, uncertainty disclosure, and monitoring paths proportionate to stakes.

Vehicle/content/effect rule. A belief, norm, institution, model, market signal, law, border, reputation system, or algorithmic score may be a real vehicle with real effects even when its content is false. Consensus can therefore be socially real while still failing to track the territory. Agreement does not make a harmful system harmless, and authority does not make an inadmissible decision admissible.

Surface/territory rule. Any model captures only a reality surface; the territory exceeds every surface. Absence of evidence is not evidence of absence where the missing condition is rights-relevant, catastrophe-relevant, containment-relevant, or material to the claimed decision state. Omitted material factors must be recorded as unknown, not zero.

Contact chain. Territory is the full evaluator-independent field. A reality surface is the portion captured by evidence, measurement, testimony, stakeholder mapping, model, scenario, or audit. Evidence is traceable contact with that surface. A claim boundary is the maximum legitimate strength of a claim given that contact. Refusal, escalation, or claim-narrowing is required when the claim exceeds the surface or when a gate-critical unknown prevents legitimate determination.

Consequence under finitude. Because the territory exceeds every modeled surface and audit operates only on the surface, no run can certify that all unmodeled catastrophic or containment-breaking effects are absent. Under RippleLogic’s adopted rights and ruin commitments, potentially irreversible or civilization-threatening losses are not treated as ordinary compensable terms inside a welfare average. Non-averagability is therefore a constitutional design requirement of this framework, motivated by finite knowledge and asymmetric ruin, rather than a theorem that every possible ethical system must adopt. TRC and CSV are the operational expression of that commitment.

2.1B Reality Grounding / Reality-Surface Grounding (RSG) (Normative)

Purpose. Reality Grounding is the required first level of a RippleLogic run. It prevents decisions from treating authority, fluency, compliance, dashboards, or model outputs as reality. A run may only make claims supported by its declared reality surface and evidence trace.

Definition. Reality Grounding is the process of declaring the decision-relevant reality surface, evidence trace, material unknowns, transition boundary, consequence pathways, and claim boundary before rights, risk, CSV, or scoring claims are made.

Reality-reference boundary. Reality is the final constraint on claim-bearing representations, but operational access to reality is mediated through observations, instruments, records, categories, testimony, and models that may be incomplete, biased, stale, or wrong. Reality Grounding therefore establishes bounded warrant for a declared claim, configuration, validity domain, and evidence surface; it does not establish complete possession of reality. A material conflict between the representation and newly available evidence reopens the affected claim and every dependent stage.

Six canonical outputs. A valid RealityGroundingRecord MUST include: (1) reality_surface; (2) evidence_trace; (3) material_unknowns; (4) transition_or_action_boundary; (5) consequence_pathways; and (6) claim_boundary. This resolves the prior mismatch between the heading and the normative keyword while preserving proportionality: Tier 1 records MAY be concise, but they MUST NOT silently omit the transition being evaluated. Tier 3 and high-stakes Tier 2 runs SHOULD also include monitoring_path, falsification_or_revision_trigger, reviewer_status, and evidence_status by material claim. When source coupling or physical/causal admissibility is material, the RealityGroundingRecord MUST link to the SourceCouplingRecord and/or PhysicalCausalAdmissibilityEvidenceProfile rather than treating governance approval, model fluency, simulation output, or monitoring as reality contact.

Status values. RealityGroundingStatus values are GROUNDED, ESTIMATED, ASSUMPTION_BOUND, DECLARED_UNKNOWN, OUT_OF_SCOPE_WITH_RATIONALE, and INSUFFICIENT_GROUNDING. Legacy RealityContactStatus terms remain compatible aliases: EVIDENCE_BACKED maps to GROUNDED and INSUFFICIENT_CONTACT maps to INSUFFICIENT_GROUNDING.

Reviewer-to-machine status crosswalk (Normative). GROUNDED and ESTIMATED map to RG_SUPPORTED only when the claim stays inside the declared evidence, configuration, and validity boundary. ASSUMPTION_BOUND and OUT_OF_SCOPE_WITH_RATIONALE map to RG_NARROWED only when the narrowed claim, omitted material, downstream restrictions, and reopen trigger are explicit; otherwise they map to RG_REFUSED. DECLARED_UNKNOWN and INSUFFICIENT_GROUNDING map to RG_REFUSED whenever the unresolved fact is material to RF/NCRC, TRC, CSV, deterministic selection, authorization, execution, or public conformance. Implementations MUST NOT choose the mapping that produces the preferred outcome.

RealityGroundingStatus assignment guide. The following table is a required reviewer guide for Tier 3 runs and a recommended guide for Tier 2 runs. It does not replace evidence review, but it constrains status drift.

Claim-boundary rule. No claim may exceed its reality surface. If the surface is insufficient for a material rights, tail-risk, containment, authority, conformance, or selection claim, the run MUST narrow the claim, collect more evidence, escalate, mark the result exploratory/sensitivity-only, or refuse the stronger claim.

Verifiable-admissibility rule. For life-critical systems, weapons, nuclear command and control, planetary-scale cognition, critical infrastructure, medical systems, ecological interventions, or other high-consequence domains, Reality Grounding MUST treat admissibility as verifiable and refusible. No claim may govern, authorize, or rank a consequence-bearing action beyond its declared evidence surface unless the claim can be tested or otherwise warranted, bounded to a validity domain, audited with traceable evidence, corrected through monitoring and revision, and refused when the evidence surface is insufficient. If these conditions cannot be met, the run MUST narrow the claim, collect more evidence, escalate, mark the result exploratory or non-decisive, or refuse the stronger claim.

Operational admissibility sequence (Informative). Ground the claim. Protect the right. Bound the ruin. Verify the system. Make exit and correction real. Rank only what survives qualification.

Public teaching line. Reality is the territory. A decision sees only a surface. Evidence grounds the surface. Unknowns mark the edge. Claims must stay inside the ground they stand on.

2.1C Category Grounding and Primitive Audit inside Reality Grounding (Normative)

Purpose. Category Grounding prevents a RippleLogic run from optimizing, governing, scoring, or authorizing action through categories whose definition, boundary, or reference structure is unexamined, stale, inherited without review, or too weak for the claim being made.

Single-group rule. Category Grounding, Primitive Audit, Reference Category Review, and Category-Reality Correspondence Check belong to the Reality Grounding group. They are not new public cascade levels and MUST NOT be represented as separate gates parallel to Rights Floor, Tail-Risk Bound, Containment, or RippleLogic Score. The five-level method remains Reality Grounding -> Rights Floor -> TRC -> CSV -> RLS.

Trigger. Category Grounding is REQUIRED when a material category affects rights status, protected-stakeholder inclusion, SGP interpretation, catastrophic-risk modeling, Containment, authority selection, conformance claims, public deployment claims, or any metric that will be optimized under pressure. It is RECOMMENDED for contested, novel, high-uncertainty, cross-domain, or high-prestige terms whose ordinary use may conceal structural ambiguity.

Materiality test. A category is material when changing its definition, inclusion boundary, exclusion boundary, or reference structure could change the RealityGroundingStatus, NCRC/Rights Floor result, TRC scenario set, CSV result, SGP interpretation, AuthoritySelectionRecord, conformance claim, public deployment claim, deterministic-selection claim, or optimized metric.

Metric-category rule. No metric may exceed the category that defines what it measures. If the category is weak, stale, contested, or insufficiently grounded, the metric may be used only within the resulting claim boundary and must not be laundered into stronger selection, conformance, or public claims.

Minimum record. When the Section 2.1C trigger holds for a claim-bearing Tier 3 run, high-stakes Tier 2 run, or public conformance claim, the CategoryGroundingRecord MUST identify; for lower-stakes or exploratory runs it SHOULD identify: material_category; category_role; primitive_basis; definition; category_discriminator; dependency_position; inclusion_boundary; exclusion_boundary; common_confusions; noncollapse_pairs; reference_structure; evidence_surface; source_authority_status; category_maturity_status; falsification_or_revision_trigger; term_refusal_condition; downstream_dependencies; semantic_debt_flag; reviewer_status; and required_claim_action.

Term Discrimination extension. For material terms, the record MUST identify the discriminator that separates the term from likely neighboring terms, the dependency position the term occupies in the decision stack, and the condition under which the term must be narrowed, escalated, monitored, treated as sensitivity-only, or refused. A downstream term MUST NOT claim upstream authority: certification is evidence, not validity; permission is authorization, not admissibility; monitoring is observation, not control; automation is execution and does not by itself establish autonomy; protection is moral standing, not governance authority; and a score is a bounded computation, not truth.

Capability Claim Integrity rule. When a decision, gate, authority state, deployment decision, conformance statement, or public communication materially depends on a claimed capability, the run MUST operationalize the claim before it receives decision authority. The CapabilityAuthorityDecompositionRecord MUST state: operational_definition; observable_criteria; mechanism_or_system_composition; evidence_surface; validity_conditions; alternative_explanations; falsification_or_revision_trigger; evidence_maturity_stage; permitted_claim; and explicit_nonclaims, in addition to the capability-authority fields below. The permitted claim MUST be no stronger than the observed criteria, declared validity conditions, and evidence maturity.

Composition and language boundary. A capability MAY be instantiated at the system level by the coordinated operation of probabilistic inference, memory, planning, tools, feedback, deterministic checks, human inputs, and execution interfaces. Decomposing a system into ordinary components does not by itself disprove a system-level capability. Conversely, fluent, anthropomorphic, commercial, or dramatic language does not prove consciousness, personhood, intrinsic goals, moral agency, general intelligence, unrestricted autonomy, or legitimate authority. The controlling question is what the pinned system demonstrably does, under which conditions, by which mechanism, with which failure boundary.

Instrumental tool-role (Normative category definition). An instrumental tool-role is a deployment relationship in which one or more actors use a system to extend their capacities toward assigned ends within an identifiable arrangement of objectives, permissions, responsibility, and control. The arrangement may itself be adequate, weak, contested, or illegitimate. Tool-role is not a capability class, agency class, consciousness claim, moral-status class, or authority grant.

Tool-role non-collapse rule. Being used as a tool neither establishes nor negates functional intelligence, understanding, agency, autonomy, sentience, moral patienthood, protection, participation, or legitimate authority. ToolRole(S) does not imply absence of FunctionalIntelligence(S), and FunctionalIntelligence(S) does not imply absence of ToolRole(S). The neutral base category remains AI system unless a stronger, operationally defined claim is supported.

Operational-label rule. Terms such as agentic, autonomous, reasoning, understanding, self-improving, and intelligent MAY be used in a bounded functional sense only when their operational definition and observable criteria are explicit. A claim that cannot be distinguished from a simpler alternative explanation MUST be narrowed, marked ASSUMPTION_BOUND or CONTESTED, restricted to exploratory or sensitivity-only use, or refused at the stronger level.

Functional-understanding claim boundary. A claim that system S functionally understands target T MUST identify the exact configuration C, target T, relation R claimed, domain D, evaluation time t, evaluation conditions, permitted scaffolding, transfer conditions, alternative explanations, and failure boundary. Relevant relations MAY include explanation, prediction, counterfactual manipulation, intervention, correction, and transfer. Success on one benchmark, fluent explanation, retrieval, or task completion does not establish domain-general or phenomenal understanding. A compact record MAY denote the bounded claim as FU(S,C,T,R,D,t).

Capability-authority decomposition rule. When automation, autonomy, agentic, reasoning, intent, or related capability language is material, the run MUST NOT rely on a single scalar level or marketing label. It MUST separately record: candidate_generation_method; reference_source; constraint_sources; objective_source; objective_change_authority; admissibility_warrant_sources; execution_interface; execution_scope; execution_authority_source; revocation_authority; safe_state_or_shutdown_path; and requalification_trigger. Probabilistic inference, deterministic checking, optimization, formal derivation, learned control, and human judgment MAY coexist in one system; their coexistence does not collapse generation into warrant, physical feasibility into safety, self-generated subgoals into legitimate normative authority, or technical capability into permission to execute.

Claim action. If category grounding or term discrimination is insufficient for a material claim, the run MUST narrow the claim, mark the category ASSUMPTION_BOUND or CONTESTED, collect stronger evidence, escalate for review, restrict use to exploratory/sensitivity-only analysis, or refuse the stronger claim. It MUST NOT launder category uncertainty or term collapse through RLS, PLSS, HDW, PCC completion, authority selection, certification, compliance, monitoring, model fluency, or stakeholder preference.

Plain-language rule. Before MathGov scores a thing, it must check whether the thing has been named and bounded correctly enough for the claim being made.

2.1D Source-Coupling Integrity and Generative-Source Traceability inside Reality Grounding (Normative)

Purpose. Source-Coupling Integrity prevents a RippleLogic run from treating downstream output, institutional permission, compliance status, model fluency, benchmark performance, inherited procedure, or interface success as proof that a claimed capability is grounded in the enabling conditions and boundary conditions that make it possible.

Single-group rule. Source-Coupling Integrity belongs to the Reality Grounding group and is consumed by CSV when source weakness creates structural fragility. It is not a new public cascade level and MUST NOT be represented as a sixth gate. The public method remains RG -> RF -> TRC -> CSV -> RLS.

Trigger. Source-Coupling Review is REQUIRED when a material claimed capability, output, model, metric, procedure, institutional standard, inherited category, generated result, or agentic action affects claim authority, RF/NCRC, TRC, CSV, RLS, SGP interpretation, execution authority, or public conformance and any of the following conditions holds: (i) the output is generated, simulated, benchmark-derived, model-inferred, or dashboard-derived; (ii) the run relies on an inherited procedure, standard, dataset, legal category, or compliance label as if it settled the underlying claim; (iii) a capability is extrapolated beyond the conditions in which it was demonstrated; (iv) downstream controls or monitoring compensate for a limitation whose enabling conditions remain unclear; or (v) a challenger plausibly alleges that performance, permission, compliance, or fluency is being substituted for grounded capability.

Minimum record. When triggered for a claim-bearing Tier 3 run, high-stakes Tier 2 run, or public conformance claim, the SourceCouplingRecord MUST identify; for lower-stakes or exploratory runs it SHOULD identify: claimed_capability; enabling_conditions; boundary_conditions; source_evidence; generator_output_distinction; inherited_assumptions; downstream_compensations; source_coupling_status; source_debt_flag; falsification_or_recheck_trigger; and required_claim_action.

Status values. SourceCouplingStatus values are SOURCE_COUPLED, SOURCE_PARTIAL, SOURCE_INFERRED, SOURCE_UNKNOWN, SOURCE_CONTESTED, SOURCE_DEBT_RISK, and SOURCE_COUPLING_FAILURE. SOURCE_COUPLED may support the declared claim boundary. SOURCE_PARTIAL, SOURCE_INFERRED, SOURCE_UNKNOWN, or SOURCE_CONTESTED requires claim narrowing, assumption-bound use, additional evidence, escalation, or refusal of the stronger claim as appropriate. SOURCE_DEBT_RISK routes the issue to CSV when structural viability depends on the weakly coupled capability. SOURCE_COUPLING_FAILURE means the run is substituting output, fluency, compliance, permission, or inherited procedure for source-coupled evidence and MUST refuse or redesign the stronger claim.

Source-debt diagnostic. Source debt is the structural risk created when a run proceeds through compensatory controls while the enabling conditions, boundary conditions, or limits of a claimed capability remain weak, stale, unknown, overextended, or contested. Source debt is different from semantic debt: semantic debt concerns weak terms or categories; source debt concerns weak understanding of the capability-generating conditions themselves.

CSV routing. CSV SHOULD consume source-coupling evidence when source weakness creates containment risk, dependency risk, hollowing risk, execution non-viability, reversibility failure, monitoring inadequacy, or hidden structural fragility. A weak SourceCouplingRecord does not automatically fail every option, but it constrains the claim and may require controls, redesign, escalation, or refusal.

Agent-output rule. Model fluency, benchmark performance, chain-of-action success, tool-use success, or policy-filter compliance does not establish source-coupled admissibility. Agent outputs remain downstream claims until Reality Grounding and, where material, Source-Coupling Review establish the supported claim boundary.

MathGov-native source-coupling note. Source-Coupling Integrity is an internal Reality Grounding and CSV diagnostic for checking whether decision claims remain connected to their declared sources, evidence surfaces, validity domains, and correction pathways. It does not import any external ontology, protected framework, or third-party text.

Plain-language rule. Before MathGov trusts a capability, it asks what makes the capability possible, what limits came with it, and whether downstream performance is being mistaken for grounded understanding.

2.1E Physical/Causal Admissibility Evidence Profile inside Reality Grounding and CSV (Normative)

Purpose. The Physical/Causal Admissibility Evidence Profile prevents a RippleLogic run from treating generated action candidates, simulations, model outputs, policy approvals, certifications, monitoring plans, compliance labels, or governance permission as proof that a consequence-bearing action is physically or causally admissible before execution.

Single-group rule. Physical/Causal Admissibility Evidence belongs to the Reality Grounding group and is consumed by CSV when action execution depends on physical, biological, ecological, medical, engineering, cyber-physical, infrastructural, operational, or causal constraints. It is not a new public cascade level and MUST NOT be represented as a sixth gate. The public method remains RG -> RF -> TRC -> CSV -> RLS.

Boundary rule. MathGov does not claim to generate complete physical truth, formal verification, engineering certification, medical clearance, legal approval, or deployment certification. It requires the decision record to declare what domain evidence, model basis, uncertainty, controls, and residual unknowns support the claim boundary. Domain experts, formal methods, empirical tests, simulations, engineering analysis, clinical evidence, safety cases, or other qualified warrants remain necessary when the domain requires them.

Formal-conformance boundary. Formal verification establishes conformance between an implementation and a declared specification under stated assumptions. For a physical or causal admissibility claim, the run MUST separately justify how that specification maps to the relevant reality surface, validity domain, boundary conditions, uncertainty, and domain evidence. Internal consistency or verified implementation alone does not establish physical correspondence, safe execution, or deployment readiness.

Trigger. A Physical/Causal Admissibility Evidence Profile is REQUIRED for Tier 3 runs and high-stakes Tier 2 runs when a candidate action materially affects bodily safety, medical treatment, robotics, vehicles, infrastructure, industrial systems, energy systems, environmental intervention, weapons or security systems, autonomous execution, cyber-physical operations, irreversible resource commitment, or any causal pathway where execution can create non-trivial physical, biological, ecological, or operational harm. It is RECOMMENDED for ordinary Tier 2 runs when physical or causal uncertainty could change RF/NCRC, TRC, CSV, authority, or public claim strength.

Minimum record. When triggered, the PhysicalCausalAdmissibilityEvidenceProfile MUST identify: candidate_generation_source; physical_or_causal_model_used; validity_domain; boundary_conditions; uncertainty_range; failure_modes; reversibility_or_irreversibility_boundary; verification_simulation_empirical_test_or_expert_warrant; admissibility_warrant_source; monitoring_and_shutoff_path; residual_unknowns; and required_claim_action.

Status values. PhysicalCausalAdmissibilityStatus values are PCAE_SUPPORTED, PCAE_ASSUMPTION_BOUND, PCAE_PARTIAL, PCAE_CONTESTED, PCAE_UNKNOWN, PCAE_VERIFICATION_REQUIRED, PCAE_CONTROL_REQUIRED, PCAE_REDESIGN_REQUIRED, and PCAE_REFUSE_OR_BLOCK. PCAE_SUPPORTED may support the declared claim boundary. All weaker statuses constrain the claim and route to evidence collection, controls, redesign, escalation, or refusal according to severity, reversibility, and gate materiality.

Claim action. Required claim action MUST be one of: proceed, narrow, control, redesign, escalate, or refuse. Proceed is permitted only within the declared validity domain and only when RF/NCRC, TRC, CSV, authority, and audit requirements are also satisfied. Narrow means the claim or action boundary must be reduced. Control means binding constraints, monitoring, shutoff, rollback, or human oversight are part of the option. Redesign means the candidate is not selectable as specified. Escalate means domain review or stronger evidence is required. Refuse means the requested claim or execution is not admissible under the declared evidence.

CSV consumption rule. CSV MUST consume the profile when structural viability depends on physical or causal adequacy, dependency closure, resource closure, operational capacity, reversibility, monitoring adequacy, containment, authority, or host-system integrity. A weak profile does not automatically fail every option, but it prevents strong selectability, conformance, deployment, safety, or alignment claims until the weakness is resolved, controlled, narrowed, escalated, or refused. For consequence-bearing physical execution, CSV_PASS_WITH_CONTROLS is unavailable while physical or causal admissibility remains unresolved. Controls may support only bounded evidence collection, sandboxing, containment, monitoring, staged testing, or another non-execution or learning action whose own risks pass RF/NCRC, TRC, and CSV; they do not substitute for the domain warrant required for the physical execution as specified.

TRC feedback rule. If the profile identifies a catastrophic, irreversible, lock-in, ruin-path, or severe harm scenario that was not represented in TRC, the run MUST reopen TRC before RLS. CSV may discover TRC-relevant material, but it does not absorb or replace TRC.

Plain-language rule. Before MathGov allows action in the physical or causal world, it asks what model of reality is being used, where that model stops, what could fail, whether harm is reversible, what evidence or expert warrant supports the action, how the action will be monitored or stopped, what remains unknown, and whether the right answer is proceed, narrow, control, redesign, escalate, or refuse.

2.1F Methodological Falsifiability and Dependency Integrity inside Reality Grounding (Normative)

Purpose. Methodological Falsifiability and Dependency Integrity prevents RippleLogic runs from treating plausibility, coherence, institutional approval, statistical usefulness, fluent explanation, or after-the-fact model repair as adequate support for a material claim. It strengthens Reality Grounding by requiring material claims to declare how they could be tested, challenged, revised, narrowed, escalated, or refused.

Single-group rule. Methodological integrity belongs inside Reality Grounding and is consumed by RF/NCRC, TRC, CSV, RLS, SGP, validation protocols, and public claim review where relevant. It is not a new public cascade level and MUST NOT be represented as a sixth gate. The public method remains RG -> RF -> TRC -> CSV -> RLS.

Boundary rule. MathGov does not require every ethical or legal term to be physically falsifiable, and it does not deny probabilistic evidence. Empirical, causal, formal, operational, legal-regulatory, normative, and metaphysical-horizon claims have different evidence disciplines. Normative commitments must be explicit, coherent, rights-compatible, challengeable, and auditable in application; they MUST NOT be presented as discovered physical facts. Legal-regulatory claims require a declared jurisdiction, authority source, applicability boundary, and review or contest path; legal classification does not establish empirical capability, causal validity, physical safety, or ethical legitimacy by itself. Metaphysical horizon language may orient humility and meaning, but it cannot create Tier 1-3 evidence, gate override, legal authority, deployment permission, or empirical validation.

Claim-domain and warrant-domain non-substitution rule. A run MUST separately identify the claim_type, the primary claim_domain in which the conclusion is asserted, and one or more warrant_domains from which support is drawn. Scientific or empirical evidence may establish bounded descriptive or causal support but does not by itself create legal authority or normative legitimacy. Engineering performance may establish bounded operational capability but does not by itself establish rights compatibility, lawful permission, or safety outside the tested envelope. Legal, regulatory, institutional, certification, compliance, or policy authority may govern permission, procedure, responsibility, testing, or review, but it does not by itself establish empirical truth, causal validity, technical capability, physical safety, or reduced epistemic uncertainty. Commercial or anthropomorphic terminology may describe or market a system but creates no stronger evidence or authority by itself. If a material warrant domain differs from the claim domain, cross_domain_bridges MUST contain one explicit bridge record for each material cross-domain relationship. Each bridge states the bridge proposition, evidence or rationale, uncertainty, validity or jurisdiction boundary, and refusal or revision condition. An unsupported bridge constrains or refuses the stronger claim; it MUST NOT be laundered through authority, popularity, compliance, certification, scoring, or model fluency. A materially mixed conclusion SHOULD be split into separately typed claims rather than assigned an ambiguous mixed domain.

Trigger. A MethodologicalIntegrityRecord is REQUIRED for Tier 3 public or institutional claim-bearing runs and high-stakes Tier 2 runs when a material claim could affect RF/NCRC, TRC, CSV, SGP status, authority, deployment, public conformance, deterministic-selection wording, validation status, or the claimed safety/reliability of a physical, causal, social, institutional, or AI-mediated action. It is RECOMMENDED for ordinary Tier 2 runs when assumptions, definitions, or model revisions could change decision standing.

Minimum record. When triggered, the MethodologicalIntegrityRecord MUST identify: claim_or_component; claim_type; claim_domain; warrant_domains; cross_domain_bridges; dependency_position; starting_assumptions; definition_or_operator_used; necessity_or_alternative_check; evidence_or_test_surface; falsification_or_revision_trigger; uncertainty_or_confidence_method; downstream_dependencies; re_derivation_scope_if_changed; reviewer_status; and required_claim_action. Each cross_domain_bridges entry MUST identify from_warrant_domain; to_claim_domain; bridge_status; bridge_proposition; bridge_evidence_or_rationale; uncertainty; validity_or_jurisdiction_boundary; and revision_or_refusal_condition. Allowed bridge_status values are SAME_DOMAIN, BRIDGE_SUPPORTED, BRIDGE_PARTIAL, BRIDGE_UNSUPPORTED, and NOT_APPLICABLE. BRIDGE_PARTIAL constrains the claim to the supported portion. BRIDGE_UNSUPPORTED requires narrowing, escalation, redesign, or refusal of the cross-domain conclusion.

Status values. MethodologicalIntegrityStatus values are METHOD_SUPPORTED, ASSUMPTION_BOUND, ALT_EXPLANATION_OPEN, TEST_REQUIRED, CONTESTED, REVISION_REQUIRED, and REFUSE_STRONGER_CLAIM. METHOD_SUPPORTED may support the declared claim boundary. All weaker statuses constrain the claim and route to evidence collection, narrowing, controls, redesign, escalation, or refusal according to stakes and gate materiality.

Necessity discipline. Where a run claims that a principle, definition, operator, threshold, or configuration is necessary, it MUST record why plausible alternatives fail or why the claim must be weakened to assumption-bound or model-bound status. If a plausible alternative could explain the same result, the stronger necessity claim is not permitted.

Failure and re-derivation rule. If a starting assumption, definition, operator, threshold, model basis, or predicted effect fails a declared test or audit surface, the run MUST NOT silently tune the model and preserve the same claim. It must reopen the affected dependency chain, state the re-derivation scope, version the change, and rerun every downstream gate or calculation materially dependent on the changed element.

Plain-language rule. Before MathGov trusts a claim, it asks: what kind of claim is this, what does it depend on, what would prove it wrong or force revision, what alternatives could explain the result, what changes downstream if it fails, and should the claim proceed, narrow, control, redesign, escalate, or refuse?

2.1G State, Evidence, Effect, Impact, Score and Action (Normative)

A run SHALL distinguish observed system state z, evidence about that state, an identified consequence e_effect, a normalized impact I, the residual ranking index RLS, and a proposed or executed action a. Telemetry is not welfare; a score is not a control command. A state-to-impact bridge identifies the affected bearer or system, state construct, baseline, causal or descriptive warrant, units, horizon, measurement rule, uncertainty, and applicable SGP interpretation. A structural indicator may directly support an existing structural or enabling-condition cell only under that cell's declared construct; it does not thereby establish experienced welfare.

Signed-impact contract. In I, positive means improvement and negative means harm relative to the declared baseline; zero means assessed no material change, not unknown. A nonnegative loss magnitude L, raw physical state z, susceptibility parameter chi, and signed impact I are different typed quantities. Converting among them requires an explicit, versioned mapping. Record units and sign conventions at the interface; do not silently interpret positive shock magnitudes as positive welfare or clamp unsupported state values into apparent safety.

Observation and intervention records SHALL remain distinct and linked. Desired recovery, issued commands, resource allocations and successful message delivery do not establish an observed beneficial outcome. Corrections append to the evidence trail rather than overwrite a harmful observation. Existing qualification and authority rules apply to recovery actions as to any other consequence-bearing option.

2.2 Unions as the Unit of Analysis (Operational Definition)

Definition: A union is a bounded pattern of interdependence: a set of entities whose internal interactions are sufficiently strong, frequent, or consequential that their welfare should be evaluated together for the decision context.

In this specification, the operational objects scored and indexed by u are Union Scopes (Scopes), meaning unions used as stable scopes of aggregation and accountability.

Unions are analytical constructs for causal and welfare accounting; they are not metaphysical substances. The union concept operationalizes the systems-theoretic observation that complex systems exhibit hierarchical modularity (Simon, 1962).

2.2A Union Scopes and Instance Modeling (Normative)

Terminology clarification. Introduced in RippleLogic v12.0 and carried forward in v12.2, the canonical term Union Scope refers to the objects indexed by u∈{1,…,7} in the welfare matrix. For readability and reduced ambiguity, Scope is the default shorthand in technical and implementation contexts. The term Union remains an allowed legacy shorthand in narrative contexts and lineage documents. This clarification SHALL NOT change the mathematical meaning of u or any cascade semantics. Machine-readable surfaces SHOULD prefer UnionScope / UnionScopes as the canonical identifier family; Union remains a permitted human-readable alias in prose and UI text.

Purpose. Union Scopes are designed to be minimal but covering, a small stable set of aggregation scopes that prevents systematic stakeholder erasure while supporting auditability and comparability across decisions.

2.2A.1 Definitions (Normative)

Union Scope (Scope). A Union Scope is a stable scope of impact aggregation used to evaluate decision consequences across layered and intersecting analytical scopes. Union Scopes are the rows of the canonical 7×7 welfare matrix.

Stakeholder. A stakeholder is any entity that is plausibly materially affected by a candidate option a, including entities affected through externalities, indirect pathways, or future propagation within the declared decision horizon.

Instance. An instance is a stakeholder bound to the decision context as stakeholder-in-role-in-context, meaning a stakeholder with a declared role and exposure pathway relevant to the decision. Examples include: employee, patient, local resident, watershed ecology unit, cross-border supply-chain worker, digital agent affected by policy. Instances are the primary unit of stakeholder logging for auditability, Union Scopes are the primary unit of aggregation for comparison.

Structural anchor. Scopes × Dimensions form the welfare matrix. Instances feed the cells.

Local Stakeholder Set (LSS). The LSS is the context-specific set of stakeholder instances materially affected by a decision. It is the upstream representation object produced by stakeholder discovery and instance-to-scope mapping, and it is the justified input used to support any PLSS prominence declaration.

2.2A.2 Stakeholder Discovery Protocol (SDP) (Tier-linked; Normative)

Tier 3: REQUIRED. Tier 2: RECOMMENDED by default and REQUIRED when any SDP trigger holds. When no SDP trigger holds, a Tier 2 run MAY satisfy this requirement with a lightweight stakeholder note stating that no trigger held and why, or MAY voluntarily include a full SDP record. SDP is a short, explicit process for discovering omission-likely stakeholders so discovery is not optional by taste.

Minimum SDP steps (recorded in PCC): (i) define decision boundary and horizon, (ii) map the causal footprint and externality pathways, (iii) scan for rights exposure and catastrophe relevance, (iv) draft the Local Stakeholder Set (LSS) as the stakeholder instance set, (v) map instances to one or more Union Scopes with rationale, (vi) record unknowns and declared blind spots, including escalation triggers, (vii) provide a challenger opportunity for missing instances at Tier 3.

SDP triggers (Tier 2 REQUIRED): rights-covered cells plausibly affected, or TRC triggered/catastrophe relevance plausible, or externalities beyond decision owner plausible (cross-community/organization/polity, biosphere pathway), or irreversibility/lock-in plausible, or credible challenger claims omitted stakeholder class or scope, or information/procedure/enforcement/ecology pathways plausible.

2.2A.3 Instance-to-Scope Mapping Requirement (Tier-linked; Normative)

Tier 3 requirement. A Tier 3 run MUST explicitly log a set of stakeholder instances and map each instance to one or more Union Scopes, with a rationale sufficient for an independent reviewer to understand why the instance belongs in the mapped scope(s). This mapping SHALL be recorded in the PCC (Appendix H).

Tier 2 requirement under triggers. When any SDP trigger holds, Tier 2 runs MUST log and map stakeholder instances for the affected pathways and rights-relevant domains. Otherwise, Tier 2 runs SHOULD still log and map instances whenever the decision plausibly affects stakeholders beyond the decision owner.

Minimum mapping rule. Every logged instance MUST map to at least one Union Scope. If an affected stakeholder cannot be mapped, the PCC MUST record this as an explicit coverage limitation, not as neutrality, including: (i) why mapping was infeasible, (ii) what scope(s) might plausibly apply, and (iii) what risk this creates.

2.2A.4 Multi-scope Mapping and Redundancy Handling (Normative)

Multi-scope mapping is permitted. An instance MAY map to multiple Union Scopes where the decision plausibly affects that instance across multiple nested scales.

No silent duplication. An underlying effect MUST NOT acquire additional RLS mass merely because several scopes describe it. Declare one redundancy method: (i) EMERGENT_SCALE_JUSTIFICATION only for separately evidenced scale-specific DISTINCT_EMERGENT_OUTCOME tokens under Section 2.2A.4A, with token identities and challenger-visible evidence; the same effect is not repeated as a new emergent benefit; (ii) DEDUPLICATION, one PRIMARY_COMPUTATIONAL_HOME with VIEW_ONLY_NO_ADDITIONAL_VALUE tags, while separately evidenced downstream effects may be represented through the declared pathway model; or (iii) ALLOCATION, the ALLOCATED_CONSERVED_EFFECT treatment for one conserved cost, resource, exposure, transfer or burden, with non-duplicating coefficients under the following rule. The allocation exception distributes conserved accounting mass; it does not authorize copies of the same welfare outcome.

ConservedAllocationTokenID (allocation only). A ConservedAllocationTokenID is a redundant conserved causal unit used only to prevent redundant counting across scopes, for example the same dollars, the same one-time transfer, the same compliance cost. If ALLOCATION is used for a ConservedAllocationTokenID, the PCC MUST declare the token, the allocation method, the coefficients used, and the scope list. Allocation coefficients for a single ConservedAllocationTokenID MUST satisfy Σ_u α_u ≤ 1 for that token, summed over the scopes listed for that token.

No allocation laundering. ALLOCATION is permitted only for declared redundant conserved-unit effect-tokens. Distinct welfare harms, for example health harm versus ecosystem degradation, MUST be logged as distinct impact instances and SHALL NOT be allocated away.

Allocation guard. Allocation SHALL NOT be used to suppress or mask adverse impacts in any rights-covered or catastrophe-relevant evaluation. Redundancy handling cannot weaken NCRC, TRC, or CSV computations.

2.2A.5 Reduced-scope Mode (Normative)

Reduced-scope mode allows an evaluator to run with fewer than 7 scopes for mapping or reporting depth, provided omissions are explicitly disclosed. Reduced-scope mode SHALL NOT remove any non-maskable cells or required scope rows from NCRC, TRC, or CSV computation.

Reduced-scope mode is a reporting or mapping-depth choice only. Admissibility computation MUST still evaluate all rights coverage sets C_r and catastrophe cell set C_cat as declared.

If reduced-scope mode is used, the PCC MUST include a Scope Coverage Declaration (Appendix H) listing active scopes, omitted scopes, omission rationales, a blind-spot statement, and escalation triggers that would force scope expansion in the next comparable run.

Common misread (informative). Misread: “Unions limit who matters.” Correction: “Union Scopes prevent impacts from disappearing. Any stakeholder can be represented as an instance mapped into relevant scope(s), and omissions must be disclosed as coverage risk.”

2.2A.4A Effect Identity, Granularity, and Computational Home (Normative)

EffectTokenID. Every decision-material consequence SHALL have one stable EffectTokenID binding the affected bearer or bearer class, welfare or state construct, option, baseline, causal pathway, maximal contiguous decision-relevant time window, scenario treatment, and governing evidence object. Scope tags, labels, report views, or stakeholder interests do not by themselves create new welfare mass.

Token-individuation test. Two descriptions SHALL be treated as the same effect token when they refer to the same bearer/class, state change, baseline, causal pathway, contiguous time window, and evidence object. A distinct token is permitted only when at least one of those fields differs materially and the difference corresponds to a separately evidenced downstream or emergent consequence. Thorough description is not sufficient reason for finer tokenization.

Evidence-revision clarification. The governing evidence object is a stable provenance reference with a revision history, not a requirement to mint a new EffectTokenID whenever evidence is updated. Preserve the token when the represented consequence is unchanged; version its evidence and recompute affected conclusions. A materially different bearer, state, pathway or time window requires the individuation test, not automatic duplication.

Primary computational home. Each effect token SHALL have one primary Welfare Dimension and one primary aggregating cell for RLS. Secondary dimensions or Union Scopes MAY be recorded as VIEW_ONLY_NO_ADDITIONAL_VALUE. A separately evidenced downstream state MAY receive its own token and primary home.

ConservedAllocationTokenID. Where one conserved cost, resource, exposure, transfer, or burden is allocated across scopes, allocation coefficients SHALL sum to no more than 1.0. Any residual SHALL be explained. Allocation MAY improve visibility but MUST NOT suppress rights, catastrophe, severe-burden, or structural review.

RightsEffectTokenID. A decision-material rights harm SHALL also carry a RightsEffectTokenID and is governed by Section 7.4.5. Rights evaluation uses the unallocated token and cannot be attenuated by analytical scope allocation.

Granularity challenge. Tier 3 and high-stakes Tier 2 runs SHALL record whether a competent challenger proposed a materially different tokenization. Where two evidence-supported tokenizations remain and can change ranking or decisiveness, the PartitionInvarianceTest in Section 5.5A is mandatory.

2.3 The Union Stack (Seven Operational Unions)

Canonical analytical scope sequence: U₁ ≺ U₂ ≺ U₃ ≺ U₄ ≺ U₅ ≺ U₆ ≺ U₇

The symbol ≺ denotes increasing analytical scope, not universal strict set inclusion. The seven rows are a coverage discipline for systematic review. Real applications MUST model material many-to-many stakeholder memberships, cross-border institutions, overlapping communities, and cross-scope causal dependencies through explicit stakeholder and dependency graphs.

U6 dual-view clarification. U6 remains one row coordinate so the 7 × 7 matrix stays stable. The Humanity view covers all affected human beings and future human populations. The Collective Managing Intelligence Union (CMIU) view is the governance-coordination view of intelligences, representatives, and institutions that have a declared participation channel or lawful role in shared governance, coordination, and systemic-risk management. These views overlap but are not identical. CMIU is not a sentience tier, rights plateau, prestige class, or automatic membership granted by moral protection. FPP secures protection; GPR governs participation mode; SPR governs eligibility for a named consequential role; institutional membership and authority additionally require lawful mandate, domain competence, accountability, non-domination, auditability, and revocability.

U6 view-tag requirement (Normative). Every claim-bearing U6 input, impact, indicator, weight, scenario, or conclusion MUST declare U6_View_Tag as one of U6_HUMANITY, U6_COORDINATION, or U6_MIXED_WITH_DECOMPOSITION. A mixed U6 value is admissible only when the Humanity and coordination components are separately recorded and the aggregation rule is disclosed. U6 view tags prevent human welfare claims from being silently blended with institutional or managing-intelligence capacity claims.

Clarifying distinction (informative). Organization refers to bounded institutions and role systems such as firms, schools, NGOs, or agencies. Polity refers to public governance and enforcement domains such as lawmaking, courts, regulators, and due process systems.

Ecological trophic cascades illustrate how interventions can propagate unpredictably across levels and why “local wins” can generate system losses, reinforcing the need for explicit containment and ripple modeling (Estes et al., 2011).

2.3A Scope Interpretation and Coverage Continuity (Normative clarification)

The operational row identifiers remain U1-U7. Family/Household is a public expansion of the U2 Household label and covers primary care, dependency, cohabitation or sustained resource-and-support units; cohabitation or biological kinship is not mandatory. The run declares the actual unit and prevents duplicate accounting of the same care or transfer effect. U3 Community may be geographically distributed when recurrent interaction, trust, identity or belonging is evidenced. U4 Organization concerns purpose-directed role/rule systems; U5 Polity concerns public or jurisdictional governance, adjudication and enforcement. Formal rules, exit costs, network dominance or a protocol fork alone do not establish polity status or legitimate authority. Multi-role entities use typed, many-to-many membership and dependency records, not forced reassignment. U5 includes de jure and de facto public-governance domains where jurisdictional adjudication or enforcement is exercised; analytical classification is not a grant of legitimacy.

U6 remains Humanity / Global Coordination, with Collective Managing Intelligence Union (CMIU) as its explicit coordination view. CMI is permitted as a public abbreviation of that view, not a replacement for all affected or future human populations and not a separate eighth row. Preserve U6_HUMANITY, U6_COORDINATION and U6_MIXED_WITH_DECOMPOSITION, including mixed-view decomposition. Intelligence, sentience, protection, participation and authority remain separate. Nonhuman or digital entities can be represented at any materially applicable scope under the existing stakeholder and SGP rules; they are not confined to U6.

U7 Biosphere denotes Earth's integrated life-support systems, not the universe or a light cone. Solar, orbital and other external conditions may enter a bounded run through explicit causal dependencies and domain evidence without being relabelled as biospheric welfare. Material consequences outside the operational scope cannot be silently absorbed or omitted: disclose the coverage limit and narrow, escalate or invoke a governed extension. Cosmic and Universal/AIU remain the existing non-computational meta-union horizons by default. Row order is analytical, not proof of strict set containment.

2.4 Union Types vs Instances (Aggregation Rule)

The seven unions are types; real runs involve instances (many households, many organizations, many polities). Impacts MUST be aggregated within a union row using a declared aggregation method.

Default aggregation (normative default for non-rights scoring): Population-weighted mean across affected instances.

Rights exception: For rights-covered cells, apply worst-off subgroup checks within instances before aggregating (Section 7).

Distributional companion record (Normative supplement). When a non-rights welfare impact is materially concentrated, Tier 3 and high-stakes Tier 2 runs MUST report the worst materially affected subgroup or decile, the observed or estimated range, an inequality-direction indicator, and a burden-concentration ratio or declared equivalent alongside the population mean. These diagnostics do not automatically create a new gate, but they inform CSV, RLS sensitivity, stakeholder review, and whether the impact should be reclassified as rights-relevant.

2.4A Distributional Burden, Subgroup Closure, and Mandatory CSV Routing (Normative)

When the Distributional Companion Record is required, the record SHALL include the stakeholder/subgroup search method, worst materially affected subgroup, incidence, severity, duration, recurrence, reversibility, remedy, voice/appeal pathway, burden-concentration ratio, inequality direction, omitted-group uncertainty, challenger findings, and a SubgroupClosureStatus.

Allowed SubgroupClosureStatus values are SEARCH_DOCUMENTED, CHALLENGED_AND_REVIEWED, MATERIAL_OMISSION_OPEN, and INSUFFICIENT_SUBGROUP_GROUNDING. MATERIAL_OMISSION_OPEN or INSUFFICIENT_SUBGROUP_GROUNDING blocks a unique framework-selection claim when the omitted group could change RF/NCRC, TRC, CSV, RLS ranking, or decisiveness.

The Distributional Companion Record MUST be evaluated inside CSV against forced externalization, invisible or unmonitored harm, inability to consent/contest/recover, reversibility and remedy, burden accumulation, constitutive mitigation, and the existence of a materially cleaner or safer feasible alternative. A favorable population mean MUST NOT be the sole basis for clearing a severe concentrated burden.

Rights-adjacent D6 Meaning and local D7 Environment harms. In Tier 3 and high-stakes Tier 2 runs, a reviewed non-materiality determination or a governed rights-extension/routing record is required when a severe D6 or local D7 harm could implicate dignity, liberty, information, procedure, ecological integrity, bodily integrity, or basic needs. This rule does not automatically convert every D6/D7 burden into a rights violation.

Examples: Stakeholder Instances Mapped into Union Scopes (Non-Normative)

This table illustrates how diverse stakeholders are represented as instances mapped into Union Scopes. The scope set is minimal but covering, it is a coordinate system for accountability, not a closed list of who matters.

2.5 Constructive vs Pathological Unions

Some unions grow by degrading their containing unions (for example, extractive industries or corruption networks). RippleLogic therefore does not assume “union benefit” is automatically good. The CSV Gate prevents local optimization that damages containing union coherence or viability beyond governed tolerance.

2.6 Meta-Unions (Non-Computational by Default)

U₈ Cosmic and U₉ Universal / All-Encompassing Infinite Union (AIU) may be used as philosophical boundary conditions or future extensions, but do not participate in standard Tier 1-3 scoring unless formally activated through a future governed extension protocol recorded in the canon, release manifest, and PCC requirements for that release line.

2.6A Operational UBR vs Metaphysical AIU (Normative Boundaries and Scope Discipline)

This section clarifies the strongest science-disciplined interpretation of Union-Based Reality (UBR), Union-Based Ethics (UBE), and the Universal/AIU horizon within the RippleLogic Canon v13.0 line. Its purpose is to preserve conceptual clarity, prevent overclaiming, and maintain a clean boundary between what is currently operational, what is normatively stipulated, and what remains philosophical, phenomenological, or future-facing.

Operational UBR. For the purposes of Tier 1 through Tier 3, UBR SHALL be interpreted operationally as a systems ontology of layered and intersecting causal interdependence. In governance-relevant domains, entities and decisions are embedded in coupled structures of consequence such that actions propagate across multiple scopes of impact and accountability. This is a descriptive claim about consequence topology, not a proof that all beings are identical in substance or ultimate ontology.

Scope discipline. Implementations and public claims MUST distinguish among: (i) the operational-descriptive layer, where consequence pathways are modeled across the layered and intersecting analytical scopes; (ii) the normative layer, where UBE enters through explicit commitment; and (iii) the meta-union horizon layer, where Cosmic and Universal/AIU function as philosophical, humility, precautionary, or future-extension concepts. These layers MUST NOT be collapsed into one another.

Operational boundary. The standard scored union stack for Tier 1 through Tier 3 remains U1 Self, U2 Household, U3 Community, U4 Organization, U5 Polity, U6 Humanity / Global Coordination, and U7 Biosphere. U8 Cosmic and U9 Universal / All-Encompassing Infinite Union (AIU) are meta-unions and are non-computational by default in the current release line.

Permitted role of meta-unions. U8 and U9 MAY be used as philosophical boundary conditions, humility reminders, precautionary amplifiers, or future-extension placeholders. They MUST NOT, absent a governed extension protocol, be presented as standard Tier 1 through Tier 3 scoring objects, admissibility overrides, or evidence-bypass mechanisms.

Interpretation of “we are one.” Within RippleLogic Canon v13.0, statements of oneness SHALL be interpreted in three distinct registers: (i) an operational register of strong interdependence and multi-scope accountability; (ii) a structural-unity research register, concerning whether convergent mathematical or physical principles underlie the nested interdependence observed across scales, and whether such principles constrain viable governance architectures; and (iii) an absolute-metaphysical register that remains outside current computational proof status. Only the first register is part of standard Tier 1 through Tier 3 governance computation.

Phenomenology and horizon claims. Reports of unity, non-separation, or all-encompassing union arising from contemplative, mystical, near-death, psychedelic, or out-of-body experiences MAY be treated as phenomenological data, horizon signals, or motivation for future inquiry. They MUST NOT, by themselves, be treated as sufficient evidence for standard parameterization of U9 or for compliance claims under the canon.

Non-overclaiming rule for AIU language. The framework MAY be described as general-purpose and multi-scale, and as aiming toward broadly universalizable governance architecture for embedded intelligences in shared causal reality. It MUST NOT be described as having scientifically proven All-Encompassing Infinite Union, fully resolved all metaphysical disagreements, or already solved universal alignment in the strongest ontological sense.

Canonical summary. RippleLogic adopts UBR as an operational ontology of layered and intersecting interdependence within measurable shared reality, adopts UBE through an explicit normative entry, and retains Cosmic and Universal/AIU language as non-computational horizon layers unless and until a governed extension protocol makes broader parameterization legitimate.

SECTION 3: NORMATIVE FOUNDATIONS: UNION-BASED ETHICS (UBE)

3.0A Ethical Reality

Ethical reality is the subset of reality where structures, constraints, and consequences affect welfare-bearing beings and the conditions of flourishing. Ethical reality includes welfare, rights, sentience, agency, dignity, non-domination, catastrophic-risk exposure, ecological dependence, future generations, and flourishing. Access to ethical reality spans measured fact, uncertainty-bound inference, and explicit normative commitment. These layers MUST NOT be collapsed: measured indicators may support claims, SGP may govern uncertain moral-patient evidence, and rights floors operate as declared non-compensatory commitments rather than as empirical measurements alone. Ethical reality is therefore not separate from reality; it is reality where consequence matters to beings and systems capable of being harmed, protected, dominated, liberated, degraded, or enabled to flourish.

3.1 Minimal Normative Axiom (MNA)

RippleLogic adopts one minimal normative entry axiom, then operationalizes it through governed commitments, including rights floors, tail-risk constraints, containment and structural-viability requirements, constitutional weight floors, and auditability rules. These operational commitments are explicit governance priors, not hidden mathematical derivations. The minimal entry axiom is:

MNA: Sentient welfare and flourishing matter. Unnecessary suffering and domination should be reduced. The enabling conditions for viable, non-dominated, and continuing flourishing should be preserved.

This axiom is:

Content-minimal: No single “good life” doctrine is prescribed.

Scope-bounded: Applies where sentience or welfare-relevant moral patienthood is in scope.

Architecturally generative: The framework defines a compositional architecture, rights floor, tail-risk constraint, containment, welfare optimization, and structural safeguards, such that diverse domain-specific instantiations can be generated by declared inputs and then executed through the same cascade.

Normatively explicit: RippleLogic does not claim to derive this axiom from mathematics alone or from descriptive facts alone.

3.1A Core Definitions for the Normative Layer (Normative)

Interpretation rule: RippleLogic protects welfare-bearing subjects directly and protects enabling conditions structurally where their degradation predictably undermines welfare, rights protection, non-domination, or long-run system viability.

3.1B Bridge Premises (Normative support; non-deductive)

The MNA is accompanied by two bridge premises that reduce arbitrariness while preserving honesty about the entry of normativity.

Bridge Premise 1: Embedded Modelling. Any agent seeking reliable action in shared causal reality must model other stakeholders, including their interests, constraints, vulnerabilities, dependence relations, rights exposure, and, where behavior, harm, cooperation, or rights protection depend on them, welfare-relevant states and enabling conditions, to a non-trivial degree.

Bridge Premise 2: Prudential Stability. In plural, uncertain, co-embedded systems, architectures that systematically degrade stakeholders’ welfare conditions, rights floors, or shared enabling conditions increase instability, conflict, tail risk, and long-run governance failure.

These premises do not generate obligation by deduction. They explain why welfare-tracking, rights-tracking, and enabling-condition tracking are structurally relevant to intelligence acting in shared reality.

3.1C Normative Commitment (Explicit final step)

RippleLogic adopts the commitment that credibly evidenced welfare-relevant states, rights-relevant states, and the enabling conditions on which they depend constitute reasons for action, not merely inputs for prediction.

This final step, treating such states and conditions as reasons rather than mere data, remains a normative commitment, not a deductive conclusion. RippleLogic holds that this is among the narrowest defensible gaps between description and obligation currently achievable in a governance-grade framework without either claiming false deduction or retreating to brute preference, and treats closing it further as an active research question.

3.1D Evidence Discipline for Normative Claims (Normative)

Within RippleLogic, a putative welfare-relevant state, rights-relevant state, or enabling condition SHALL enter governance computation only through declared evidence, governed interpretation, or an explicit precautionary treatment under uncertainty appropriate to the implementation tier.

If such a state or condition materially affects admissibility, precautionary handling, selection, or tie-break outcome, it MUST be recorded in PCC.NormativeInputRegister with sufficient provenance for independent review.

Unsupported narrative assertion, rhetorical force, linguistic fluency, or undeclared evaluator intuition SHALL NOT by itself constitute a sufficient reason-for-action input within RippleLogic.

3.2 Conditional Is-Ought Bridge

RippleLogic avoids deriving values from facts by using a conditional bridge:

IF

(UBR) actions propagate through layered and intersecting analytical scopes,

AND

(MNA) sentient welfare and flourishing matter, unnecessary suffering and domination should be reduced, and the enabling conditions for viable, non-dominated, and continuing flourishing should be preserved,

AND

(BP1) agents operating in shared causal reality must model other stakeholders’ interests, constraints, vulnerabilities, dependence relations, rights exposure, and, where behavior, harm, cooperation, or rights protection depend on them, welfare-relevant states and enabling conditions to act reliably,

AND

(BP2) in plural, uncertain, co-embedded systems, systematic degradation of stakeholders’ welfare conditions, rights floors, or enabling conditions increases instability, conflict, tail risk, and long-run governance failure,

THEN

agents and institutions ought to evaluate choices by cross-union impacts and preservation of enabling conditions, using non-compensable rights floors, explicit tail-risk bounding, containment safeguards, and auditable welfare ranking within the feasible set.

Normativity enters explicitly through the MNA and the final normative commitment. UBR specifies where consequences flow. BP1 and BP2 explain why welfare-tracking, rights-tracking, and enabling-condition tracking are structurally relevant to intelligence acting in shared reality. RippleLogic does not claim that the final normative step is fully deduced from description alone.

3.2A Derived Governance Rule (Normative)

In governance contexts, RippleLogic operationalizes the above commitment through the canonical lexicographic cascade:

Define the qualification predicates without collapsing claim authority into ethical rejection:

RG_qualified(a) := 1 iff RG_status(a) in {RG_SUPPORTED, RG_NARROWED}. RG_NARROWED means the option may be evaluated only inside the narrowed claim boundary. RG_REFUSED means the present claim is not supportable at the requested strength and downstream ordinary evaluation short-circuits; it is not a claim that the option is intrinsically unethical in every possible reformulation.

TRC_qualified(a) := 1 iff TRC_status(a) in {TRC_PASS, TRC_NOT_TRIGGERED}. TRC_NOT_TRIGGERED is available only after a recorded catastrophe-relevance assessment finds no trigger under Section 8.1.1. It is not a silent skip, does not mean CVaR was computed, and must reopen if new catastrophe relevance appears.

A_sel := {a in O : RG_qualified(a) AND NCRC(a) AND TRC_qualified(a) AND CSV_status(a) in {CSV_PASS, CSV_PASS_WITH_CONTROLS, CSV_NOT_MATERIAL}}. This is the Phase 1 qualification set. If A_sel is empty, escalate, redesign, or invoke governed fallback per the canon. Otherwise Phase 2 ranks over A_sel using RLS and the declared tie-break chain.

1. Protect rights floors first through NCRC.

2. Bound catastrophic downside second through TRC.

3. Block pathological containing-scope degradation through CSV as the third option-filtering gate after the RG claim-authority precondition.

4. Rank remaining feasible options fourth through welfare scoring under declared weights, uncertainty rules, and auditability requirements.

5. Resolve non-decisive cases structurally through UCI/HOI tie-breaks and escalation rules.

Interpretation rule: RippleLogic does not define “ought” as unconstrained welfare maximization. It defines “ought,” in governance-grade decision settings, as selection from a rights-safe, tail-bounded, containment-safe feasible set under auditable evidence and uncertainty discipline.

3.2B Open Research Frontier (Informative)

An active research question remains whether sufficiently accurate multi-agent world-modelling creates deeper constitutive pressure toward non-domination and welfare protection beyond prudential stability alone. RippleLogic does not assume this as a proven result. It treats it as a frontier question concerning whether accurate modelling of shared reality may eventually narrow the remaining descriptive-to-normative gap further. Specifically, this question is tractable through empirical study of whether systems that model co-embedded agents more accurately also exhibit more stable cooperative and non-destructive behaviour, and whether omission of welfare-relevant, rights-relevant, or enabling-condition variables from world models degrades predictive performance in domains where cooperation, conflict, or harm depend on them.

3.3 Seven Welfare Dimensions (Canonical)

This seven-dimensional choice is a convergence architecture rather than a claim of metaphysical completeness. It aligns with the capability approach (Sen, 1999; Nussbaum, 2011), self-determination theory (Ryan & Deci, 2000), and fundamental human needs theory (Max-Neef, 1991), while also capturing ecological integrity as a life-support substrate consistent with Earth-system boundary research (Rockström et al., 2009, 2023).

7×7 field interpretation rule (Normative for claim language). The canonical 7 Union Scopes × 7 Welfare Dimensions matrix is a multidimensional accountability-and-flourishing field. Depending on the bearer and cell, a recorded condition may represent direct welfare, collective functioning, an enabling condition, structural integrity, ecological condition, epistemic observation or correction capacity, or a symbolic/meaning condition. The stable interface name Welfare Dimension is retained for compatibility, but a cell MUST NOT be described as phenomenally experienced welfare of a non-sentient system unless admissible evidence supports that claim. WDBIP records the applicable effect-token and cell-type interpretation and prevents determinants, observation capacities, or system conditions from being mislabeled as directly experienced welfare.

3.4 Non-Fungibility at Rights Level

Dimensions are treated as non-fungible at the rights layer: gains in one dimension MUST NOT compensate rights-floor violations in another. This is enforced structurally by NCRC (Section 7), not by weight tuning.

3.5 Unioning (Enacted Practice)

Unioning = redesigning decisions until they are rights-safe (NCRC), tail-safe (TRC), containment-safe, and net-positive across unions under declared uncertainty policy, treating apparent “tradeoffs” as design failures before acceptance.

Unioning worked example (Non-Normative)

Scenario. An organization considers cutting safety training to reduce costs. Initial estimate shows a small material benefit in U4 Organization D1, but a credible safety degradation in U4 D2 and a dignity/procedure risk in U4 D6/D5. Under NCRC, any rights-covered violation depth v_r(a)>0 fails admissibility regardless of aggregate gains.

Step 1, fail. Option A fails NCRC due to increased probability of serious injury and due-process erosion. It is rejected even if it would raise RLS.

Step 2, redesign. The team introduces Option B, maintain safety training, add targeted efficiency changes elsewhere, and add a transparent incident-reporting and remediation pathway. This shifts the harmful impacts above the rights floor while preserving most of the intended cost reduction through non-harmful channels.

Step 3, pass and select. Option B passes NCRC, passes TRC and CSV, then competes on RLS among admissible options. The PCC records the redesign rationale and the rights-floor reasoning, so the improvement is legible and replayable.

3.6 NCAR Learning Loop (Corrigibility Requirement)

RippleLogic is embedded in Notice, Choose, Act, Reflect. The system is corrigible: it records assumptions and outcomes, updates kernels and parameters via governed procedures, and preserves accountability through versioned PCCs.

SECTION 4: SYSTEM OVERVIEW: THE RIPPLELOGIC ARCHITECTURE

Public method. RippleLogic SHOULD be taught and implemented at the public level as:

Reality Grounding -> Rights Floor -> TRC -> CSV -> RLS

Human mnemonic:

Ground -> Protect -> Bound -> Contain/Verify -> Score

Formal method. In formal notation and audit surfaces, this corresponds to: RG/RSG -> RF/NCRC -> TRC -> CSV -> RLS, where RG is Reality Grounding and RSG is the reality-surface grounding implementation record.

Clarification. Reality Grounding is a claim-authority precondition, not an ethical option-rejecting gate. RG_REFUSED still excludes an option from the claim-bounded qualified set until grounding is repaired or the claim or action boundary is narrowed. RF/NCRC, TRC, and CSV gate ethical or structural admissibility and selectability. RLS ranks the selectable set. The five-level method therefore consists of one claim-authority precondition (RG), three hard feasibility/selectability gates (RF/NCRC, TRC, CSV), and one residual ranking layer (RLS).

Two-phase decision model. The five-level method may be taught and implemented as two phases without changing the cascade. Phase 1 qualifies options: RG establishes claim authority; RF/NCRC protects rights; TRC bounds ruin; CSV verifies containment and structural viability. Phase 2 ranks survivors: RLS orders only the options that remain selectable after Phase 1.

Qualification-before-ranking rule. Do not score fantasy, rights violations, ruin paths, or structurally non-viable options as ordinary alternatives. RLS is applied only to the selectable set produced by RG/RSG, RF/NCRC, TRC, and CSV.

TRC/CSV non-collapse rule. TRC is the ruin veto: it asks whether catastrophic, irreversible, lock-in, systemic, or ruin-path downside is acceptably bounded. CSV is the viability and control test: it asks whether an option can structurally stand, execute, remain contained, preserve dependencies, maintain monitoring, and remain governable under real constraints. CSV may discover a TRC-relevant scenario, but it does not absorb TRC. If CSV identifies a new ruin path, TRC MUST be reopened before RLS.

Level 1, Reality Grounding (RG/RSG). Declare the reality surface, evidence trace, material unknowns, transition boundary, consequence pathways, category boundaries, and claim boundary. If grounding is insufficient for a material claim, narrow, escalate, mark exploratory, or refuse the stronger claim.

Level 2, Rights Floor (RF/NCRC). Apply the Non-Compensatory Rights Constraint. Rights-floor harms are non-compensatory and cannot be rescued by welfare score.

Level 3, TRC / Tail-Risk Bound. Apply the Tail-Risk Constraint. Catastrophic or unbounded downside cannot be averaged into ordinary welfare gains.

Level 4, CSV / Containment and Structural Viability. Apply the CSV gate. CSV asks whether the option’s local gain can stand without unacceptably damaging, hollowing, overloading, exploiting, or depending on the larger systems that make the gain possible. UCI/HOI and related structural diagnostics are evaluated inside CSV when material. Structural Viability is explicit inside CSV: resource closure, dependency closure, endpoint/reversibility coherence, operational capacity non-exceedance, and internal non-contradiction.

Level 5, RLS / RippleLogic Score. Rank only the options that remain selectable. If RLS is tied, close, or non-decisive, record any governed residual UCI/HOI preference under Section 11.5 while retaining REFUSE_DETERMINISTIC_SELECTION unless the Section 10.4/10.4B unique-selection conditions are met.

Mantra. Ground -> Protect -> Bound -> Contain/Verify -> Score.

4.1 Formal Definition

RippleLogic is a rights-first, tail-risk-bounded, union-based decision optimization system with explicit ripple propagation, auditable scoring, and corrigible learning. It is designed to prevent three common governance failures: rights being traded away by aggregate welfare gains, catastrophic downside being averaged away by expected-value logic, and local optimization degrading larger containing systems.

4.2 Core Objects and Implementable Data Structures

Every RippleLogic run works from declared objects. These are not decorative labels; they are the minimum data surfaces that make the decision auditable, reproducible, and challengeable.

4.3 Reference Structure Discipline

RippleLogic decisions SHALL NOT be interpreted as governance claims merely because a scoring procedure, audit record, or policy wrapper exists. A governance claim is supportable only to the extent that the decision record declares the reference structure against which the claim is evaluated.

For RippleLogic purposes, a reference structure is the declared set of constraints, evidence sources, causal pathways, thresholds, maturity labels, and refusal conditions used to evaluate a decision claim. Reference structures may include physical constraints, biological needs, rights floors, catastrophic-risk corridors, containment conditions, stakeholder impact maps, institutional authority boundaries, evidence-status labels, and auditable records.

RSP and RefStructRecord. The Reference Structure Protocol (RSP) is the discipline. The ReferenceStructureRecord (RefStructRecord) is the run-level artifact that records the discipline in a specific case. RSP tells the system what must be declared; RefStructRecord records what was actually declared.

Reference structure discipline does not create a sixth gate and does not alter the canonical method. Reality Grounding, NCRC, TRC, CSV, RLS, and UCI/HOI diagnostic handling retain their existing roles. The Reference Structure Protocol strengthens the evidence basis used to evaluate those roles.

A RippleLogic run MUST NOT treat circular, self-validating, missing, unfalsifiable, materially stale, or unsupported reference claims as sufficient for high-stakes admissibility, selection, deployment-readiness, or conformance claims. Where the reference structure is insufficient for the requested claim, the correct outcome is Refusal, escalation, narrower claim scope, additional evidence gathering, or bounded provisional action under an applicable triage rule.

Plain-language rule. Governance without a declared reference structure becomes assumption management. RippleLogic requires declared references, visible evidence, falsifiable claims, and refusal when the reference structure cannot support the claim.

4.4 Formal Gate Sequence and Residual Tie-Break (Normative)

RippleLogic evaluates candidate options through a formal gate sequence with a claim-authority precondition. Reality Grounding first establishes whether the requested claim can be made at the declared strength. RF/NCRC, TRC, and CSV then determine admissibility and selectability. RLS ranks only the selectable set. Residual UCI/HOI is a special-case tie-break or monitoring rule, not a regular public cascade level. A later function MUST NOT rescue, compensate for, or reinterpret failure at an earlier function.

Gate-numbering clarification (Normative). Formal gate numbering counts only the three hard admissibility/selectability gates: RF/NCRC, TRC, and CSV. RG is the upstream claim-authority precondition and is not numbered as a hard gate; RLS is the downstream ranking stage.

Formal gate 1, NCRC: rights feasibility. NCRC determines whether an option is rights-admissible. For rights-covered cells, RippleLogic applies the required subgroup semantics and checks the worst-off protected subgroup against the rights floor. Any option with positive violation depth on any covered right fails NCRC and is inadmissible, regardless of expected welfare gains, downstream rankings, or structural advantages.

Formal gate 2, TRC: catastrophe feasibility. TRC determines whether a rights-admissible option is admissible in the tail-risk sense. It evaluates catastrophic-loss exposure over the governed scenario set using the catastrophe cell set and declared CVaR corridor. Any option whose catastrophic tail exceeds the corridor fails TRC and is inadmissible, even if expected welfare performance is strong.

Formal gate 3, CSV: containment and structural viability feasibility. CSV determines whether an admissible option is selectable with respect to containing-system integrity and execution viability. It asks whether local or sub-scope welfare gains degrade containing unions, hollow out capacities, create lock-in, externalize burdens, exceed operational capacity, or fail structural viability. An option that fails CSV is not selectable, even if it passes NCRC and TRC and would otherwise rank highly on residual welfare.

Ranking stage, RLS: residual welfare ranking. RLS is applied only to options that have already passed RF/NCRC, TRC, and CSV. It ranks surviving options by weighted welfare aggregation over the active cell set, subject to non-maskable-cell rules and weight-governance requirements. RLS MUST NOT override or soften any earlier gate.

Special-case UCI/HOI tie-break rule: structural resolution after RLS non-decisiveness. UCI and HOI are first evaluated inside CSV when material to structural integrity, hollowing risk, or containment. Only after options are already selectable may residual UCI/HOI help document a tied, close, uncertainty-overlapped, or non-decisive RLS result. UCI and HOI do not act as public cascade stages and do not reopen prior gate decisions.

Non-overlap rule. For interpretation and auditability, the formal gate/ranking functions SHALL be read as follows: RG/RSG = claim authority; NCRC = rights feasibility; TRC = catastrophe feasibility; CSV = containment and structural viability feasibility; RLS = residual welfare ranking within the selectable set; UCI/HOI tie-break = special-case non-decisive structural resolution or monitoring within the selectable set, not a regular public cascade level. No implementation, commentary, or downstream artifact may collapse these functions into a single blended score.

4.4A Structural Viability within CSV (Normative clarification)

Structural Viability is explicit inside CSV, not a sixth public method level. It asks whether an option that otherwise passes Reality Grounding, NCRC, TRC, and containment integrity can structurally execute within the declared reality surface without undefined resource, dependency, reversibility, operational-capacity, or internal-contradiction failure.

Formal shorthand: RG/RSG -> RF/NCRC -> TRC -> CSV -> RLS. Where material, the CSV result includes Structural Viability status before any option enters RLS. An option may be ethically preferable as a redesign target while still failing current structural viability for execution. In that case, the option may be documented as SVC_DESIGN_TARGET or CSV_REDESIGN_REQUIRED, but it MUST NOT be claimed as currently selectable, executable, deployment-ready, or deterministically selected.

Non-import boundary. Structural Viability uses only MathGov-native records: resource declarations, dependency declarations, reversibility and endpoint status, operational limits, and contradiction checks. It MUST NOT import capacity/binding ontology, regime coordinates, hidden kernels, or undisclosed reference generators.

4.5 Cascade Gate Inputs and Outputs (Informative)

This table summarizes what each gate consumes, what it produces, and what it may eliminate or flag. It is a fast correctness check for implementers.

Binary predicates used elsewhere are derived acceptance tests over the full status record, not substitutes for that record. Unknown, escalation, not-triggered and not-evaluated states retain their explicit meanings.

4.6 End-to-End Algorithm (Tier 1-3 Executable) (Normative)

Algorithm: RippleLogic_Run

Inputs, minimum: decision scope; baseline; option set O; union and dimension sets; weights; rights canon; TRC canon and scenario set wherever the applicable tier and trigger require them; containment parameters; propagation mode; kernel if used.

Inaction-asymmetry rule (Normative). When no action, delay, or continuation of the current course is a live feasible choice, it MUST appear as an explicit candidate option and receive its own Reality Grounding, rights, tail-risk, CSV, and effect-matrix treatment. It MUST NOT be represented only as a null baseline exempt from evaluation. The PCC SHALL disclose material continuation harms and the reason any apparently available no-action or delay path was excluded.

Outputs: selected option a* or escalation, plus PCC.

Step 1: Reality Grounding and Notice. Record the decision question, scope boundary, time horizon, affected unions, and option set. Declare tier, configuration, reality surface, evidence trace, material unknowns, transition boundary, consequence pathways, claim boundary, and reference-structure requirements. If grounding is insufficient for a material claim, narrow, collect evidence, escalate, mark exploratory, or refuse the stronger claim before proceeding.

Step 2: Impact construction. For each option, construct the declared Base and Welfare impact instances and uncertainty treatment. Under NONE, I_prop := I_dir without a second saturation. Under QUICK, apply the declared propagation and post-propagation saturation per scenario before probability averaging where scenario conditioning applies. Gate-specific non-attenuation and missing-data rules remain controlling.

Step 3: NCRC gate. Evaluate the floor, categorical and severe-hazard channels, worst-off subgroup treatment and unallocated rights-effect rules in Section 7.4.4. A pass requires every applicable violation to be zero and no unresolved material field. If no option passes, apply the Section 7.4 rights-conflict precondition and seek redesign or governed escalation. Rights Emergency Mode may be considered only after all Section 7.5 prerequisites, including independent challenge, are satisfied.

Step 4: TRC gate. For each rights-admissible option, perform the required trigger screen or scenario assessment. A computed pass requires the full Section 8.6 predicate, including CVaR and every active severity-class condition. If no option remains, return TRC_ALL_FAIL and use redesign, delay/no-action comparison, escalation or refusal. Tail Emergency Mode may be considered only when every Section 8.8 prerequisite is demonstrated; it never emits an ordinary TRC_PASS.

Step 5: CSV gate. For each NCRC/TRC-admissible option, apply the containment predicate using required containing-scope, structural posture, reversibility, repair, and evidence-availability inputs. Where UCI, HOI, Adaptive Reserve, lock-in, hollowing, trust erosion, ecological degradation, governance-capacity loss, or related structural diagnostics are material to cross-scale structural integrity, evaluate those diagnostics inside CSV before RLS. If required structural diagnostic evidence is unavailable, downgrade, collect evidence, rerun, escalate, refuse the stronger claim, or record a permitted waiver where the applicable tier permits waiver.

Step 6: RLS ranking. Compute RLS(a) only for selectable options. Compute uncertainty and apply the discrimination rule where required. If decisive, select the top option.

Step 7: Special-case tie-break / non-decisive handling. If RLS is tied, close, uncertainty-overlapped, or otherwise non-decisive, compare only options already in the selectable set. Apply residual UCI/HOI only as tie-break, monitoring, or hollowing-risk documentation. Do not reopen NCRC, TRC, or CSV. Do not use residual UCI/HOI to rescue failed Containment or compensate for missing containment evidence. A tie-break preference does not establish RLS decisiveness: retain REFUSE_DETERMINISTIC_SELECTION while Section 10.4/10.4B remains unmet, and apply Section 11.5 serialization before any separate AuthoritySelectionRecord.

Step 8: Emit PCC. Record inputs, intermediate computations, gate results, sensitivity outputs where required, ReferenceStructureRecord where required, refusal record if applicable, and public rationale.

4.7 Canonical 49-Cell Reference Table (v10.6+; Informative)

Each cell in the 7×7 welfare matrix represents a distinct accountability domain. The table below provides a compact one-line meaning for each cell to support comprehension and consistent interpretation across implementations. The table is informative; the governing equations and rules remain in the relevant normative sections and appendices.

Interpretive note. This table gives the compact canonical grid. Appendix AD provides the expanded 49-cell Welfare Dictionary, including plain meanings, positive and negative movement, indicator examples, possible gate relevance, examples, and reviewer checks. Appendix AD does not change the cascade, equations, rights thresholds, TRC mechanics, Containment semantics, RLS formula, HDW, SGP, PCC, RSP/RefStructRecord, or claim boundaries. It governs scoring interpretation and reviewer literacy.

U7 scope-specific operationalization rule (Normative clarification). U7/D3 Biotic Relations, U7/D4 Ecological Knowledge, U7/D5 Resilience Capacity and U7/D6 Life Continuity use declared ecological or enabling-condition analogues, not personal social experience, conscious knowledge, autonomy or experienced meaning. Use the Appendix AD definitions and a typed construct/bearer record. Human ecological knowledge and institutional monitoring have a primary human or institutional D4 home, with U7 view-only tagging; they cannot receive a second U7/D4 contribution merely because their subject is ecology. A separate U7 information-bearing condition needs separate evidence and a distinct token. U7/D5 records shock absorption and recovery; U7/D6 records continuity of life and lineages. U7/D7 may represent an integrated life-support condition, but must not add the same underlying state again after its component D2/D3/D5/D6 tokens have been scored. An integrated TRC view may reuse linked evidence without adding a second RLS contribution or masking catastrophe coverage. Retain the 7 x 7 interface, declare each construct exception, and test material alternative cell treatments or weights. Ecological analogue scores are not personal-welfare construct-validation data.

Release packaging rule (v10.6+). Every public release PDF MUST include this 49-cell table and the stakeholder-to-scope examples table below, either in Section 4 or in a dedicated reference-table appendix that is directly linked from Section 4.

4.8 Implementation Tiers (Normative Summary)

Tier 4 boundary. Tier 4 is a design target only in the current v13.0 release and MUST NOT be claimed until ProofPack is public and independently replayable.

4.9 Refusal Under Underdetermination (Normative)

Purpose. RippleLogic distinguishes gate failure from underdetermination. Gate failure occurs when a declared option uniquely violates NCRC, TRC, or CSV requirements. Refusal occurs when the framework cannot uniquely determine whether an option passes, fails, or can be selected from the declared inputs and projection rules.

Refusal is not weakness, discretion, or rhetorical caution. It is a formal anti-overclaiming state. A run that enters Refusal MUST NOT claim that the relevant option is admissible, selectable, selected, aligned, safe, or RippleLogic-conformant for the unresolved claim.

4.9.1 Refusal triggers (Normative)

R-1 Gate-critical unknown. A rights-covered cell, catastrophe cell, Containment indicator, or other gate-critical input remains UNKNOWN_IMPACT after the applicable evidence, phantom-instance, or conservative-default rule has been applied.

R-2 Non-unique projection. The projection from stakeholder instances, subgroup evidence, scenario data, or scope mapping to a gate verdict admits two or more materially different admissibility interpretations under the same declared evidence.

R-3 Material indistinguishability. Two or more options are observationally indistinguishable on available welfare evidence but materially different in possible rights exposure, tail-risk exposure, domination risk, or containment risk.

R-4 Layer ambiguity. The run relies on a category collapse, including treating compliance as correctness, traceability as admissibility, psychological plausibility as evidence, mathematical elegance as validation, moral status as governance authority, or SGP welfare scalars as admissibility modifiers.

R-5 Projection modification after observation. A ProjectionPreRegistration object, threshold, rights coverage set, catastrophe cell set, scenario set, weight rule, SGP MPS/FPP binding, or Containment trigger is materially modified after relevant decision evidence has been consulted, unless the run is voided and restarted.

R-6 Claim-boundary mismatch. The evidence available may support a lower-tier, local, provisional, or exploratory claim but is insufficient for the stronger claim being attempted.

4.9.2 Refusal effects (Normative)

1. stop any claim of admissibility, selectability, selection, conformance, or alignment for the unresolved option or run;

2. emit a PCC.RefusalRecord;

3. identify the unresolved gate, scope, dimension, scenario, stakeholder class, or projection rule;

4. state the minimum evidence or procedural condition required for re-run;

5. route the decision to escalation, redesign, bounded provisional action, or no-action baseline review according to tier and stakes.

4.9.3 Emergency and provisional action (Normative)

Refusal blocks strong conformance claims. It does not automatically imply inaction in emergency contexts. Where delay itself creates material harm, a provisional action MAY proceed only if all of the following hold:

1. the action is rights-preserving under the best available conservative screen;

2. catastrophic tail-risk is not plausibly increased beyond the declared emergency corridor;

3. the action is reversible, staged, or bounded where feasible;

4. escalation and independent review are triggered;

5. the PCC clearly marks the action as PROVISIONAL_UNDER_REFUSAL rather than admissible, selectable, or selected under normal conformance.

4.9.4 Distinction from gate failure (Normative)

Gate failure is committed: NCRC violation, TRC corridor breach, or CSV failure produces inadmissibility or non-selectability under unique projection. Refusal is uncommitted: the framework cannot uniquely determine admissibility from the declared inputs. Implementations MUST NOT silently convert Refusal into gate failure, gate success, or RLS tie-break, and MUST NOT use Refusal to bypass any earlier gate.

4.9.5 PCC fields for Refusal (Normative)

The PCC.RefusalRecord SHALL include at minimum: trigger code R-1 through R-6; evidence basis with provenance; options affected; scopes and dimensions affected; rights, catastrophe, or containment cells affected; no-action baseline status where relevant; escalation route invoked; provisional-action status, if any; and conditions under which a re-run could resolve the Refusal.

4.9.6 Relation to ripple.md IND and NA (Informative)

In ripple.md wrapped deployments, IND maps to Refusal where the test applies but evidence, scope lock, target specification, constraint set, verification regime, or projection conditions are insufficient. NA means the test is genuinely not applicable under the declared scope. Implementations MUST NOT use NA where IND is the correct state.

4.10 Consequence-tempo and responsibility-continuity interface (Normative routing)

Execution assurance must distinguish decision admissibility from the speed and ownership of implementation. For actions involving rapid propagation, material irreversibility, consequential automation, or material lock-in, the worst credible control critical path must be shorter than the time to an unacceptable adverse escalation threshold or irreversible stop-loss boundary. Where no runtime interruption window is technically possible, stronger ex ante assurance, bounded scope and rate, fail-safe design, and explicit residual-risk authorization are required. Delay must also be tested as a possible source of rights, ruin, or structural harm.

Complexity may distribute work but must not dissolve answerability. Claim-bearing high-consequence runs SHALL preserve typed responsibility for evidence, analysis, decision authority, operation, execution, intervention, appeal, communication, remedy, and residual responsibility. Legal liability is not inferred unless separately established by law.

4.10A Material obligation integrity (Normative)

Where selectability, execution, review, appeal, intervention, monitoring, rollback, communication, repair, or requalification depends on a material obligation, the PCC SHALL include or reference a MaterialObligationRecord. The record SHALL identify: the obligation; accountable authority; operational carrier or authenticated execution path; authority and capacity basis; activation trigger; scope; required action; response deadline or window; evidence of discharge; review or expiry; challenge route; delegation acceptance; backup or successor; nonperformance trigger; missed-duty escalation; amendment, waiver, suspension, and retirement authority; change-control rule; residual responsibility; and control-effectiveness status.

A declaration, committee, register, policy, review date, or named owner is not by itself a binding control. The carrier must have the authority, competence, information access, time, resources, and protection necessary to act. A handoff is incomplete until the receiving role accepts it. Failure, absence, conflict, incapacity, or silence by the carrier SHALL activate the declared escalation, substitution, pause, or requalification path. A material change to the control's trigger, threshold, scope, carrier, authority, evidence surface, expiry, escalation path, waiver rule, or retirement rule is a configuration change and SHALL reopen affected qualification.

Control performance and control effectiveness are distinct. Evidence that a procedure was followed does not establish that the intended right, risk, containment, or repair objective was achieved. Where effectiveness is decision-material, the run SHALL record the outcome evidence or remain assumption-bound, controlled, escalated, or redesigned.

4.10B Hidden human compensation load (Normative inside CSV when material)

Before automation, scaling, role removal, or claims of structural resilience, CSV SHALL test whether functioning materially depends on undocumented human compensation, including repeated manual override, exception reconciliation, shadow records, individual memory, relationship-based coordination, after-hours recovery, weak-signal interpretation, informal escalation, or recurrent prevention of visible failure. Such compensation is evidence of a structural dependency; it is not by itself evidence that the system is resilient.

When material, the PCC SHALL include or reference a HumanCompensationLoadRecord identifying the carrier role classes, hidden work performed, formal-workflow gap, frequency or burden indicators, single-person dependency, recovery and capacity effects, consequence if the compensation stops, evidence sources, privacy and non-retaliation protections, preservation or redesign action, and review trigger. Evidence SHOULD be triangulated from workflow traces, overrides, exceptions, rework, handoffs, near misses, workload and recovery indicators, and protected testimony rather than depending solely on self-report or waiting for carrier collapse.

These are cross-cutting assurance requirements routed through TRC and CSV and recorded through ripple.md v5.8 and Agent System v13.0. They are not a sixth gate and do not make a completed record proof of safety.

SECTION 5: WELFARE IMPACT CONSTRUCTION (CALCULABLE)

5.0 Purpose and Design Requirements (Normative)

This section specifies how RippleLogic converts real-world predictions and evidence into a computable welfare impact matrix for each option. A competent analyst MUST be able to compute all required impacts from (i) a declared baseline, (ii) a declared option, and (iii) a finite list of impact instances per cell, using only the equations and rules in this paper and appendices.

Cell-meaning rule (Normative clarification). A cell score is a reviewable baseline-relative claim, not a preference expression. It SHALL be interpretable as an assertion about one Union Scope and one welfare dimension, with evidence and uncertainty disclosed according to tier requirements. Appendix AD provides the canonical interpretive dictionary for cell meanings, positive/negative movement, possible indicators, gate-relevance cues, examples, and reviewer checks.

5.0.1 Stakeholder Coverage Index (SCI) (Normative)

SCI is a tier-governed disclosure ladder describing the stakeholder coverage posture of a run. SCI does not change scoring formulas. It is an auditability and integrity signal that supports comparability and anti-theater enforcement.

SCI levels (minimum definitions): SCI-0: no explicit stakeholder instance logging. SCI-1: instances logged at least for direct stakeholders and primary externality pathways. SCI-2: instances logged with explicit mapping to Union Scopes, including at least one challenger pass for omissions. SCI-3: evidence-backed instance mapping with explicit blind-spot declaration, escalation triggers, and redundancy handling disclosures where multi-scope mapping is used. SCI-4: high-coverage posture with structured discovery, third-party review or validated stakeholder registry linkage, and replay-ready traceability.

Tier minima. Tier 2 runs MUST achieve at least SCI-1. Tier 3 runs MUST achieve at least SCI-2.

Anti-theater ratchet. If SCI equals the tier minimum, the PCC MUST include a concrete Next-Run Upgrade action that would raise SCI by at least one level for the next comparable run. If SCI is below the tier minimum, the run MUST either (a) downgrade the declared tier to one whose SCI minimum is satisfied, or (b) rerun with enhanced stakeholder discovery to meet the SCI minimum for the claimed tier. In either case, the PCC MUST include a remediation plan specifying how SCI will be raised to the target level before the next comparable run. A remediation plan alone does not make the current run compliant at the originally claimed tier.

5.0A End-to-End Cell Computation Recipe (Informative)

This recipe is the minimal end-to-end spine for computing any welfare-cell impact in a Tier 1-3 run. It is informative, but the equations and constraints it references are normative in their home sections. For traceability, this recipe is listed in reverse order (8→1), reflecting the final artifact emission back to upstream inputs.

8) Emit PCC: record parameters, ReachBasis, gate results, RLS summary, and the public 5SPR. If reduced-scope mode is used, include the required attestations and blind-spot statement.

• Run the formal method: RSG / Reality Grounding → RF / Rights Floor (formal NCRC) → TRC / Tail-Risk Bound → CSV / Containment and Structural Viability → RLS / RippleLogic Score. Treat UCI/HOI or equivalent structural diagnostics as CSV evidence when material, and as residual tie-break/monitoring evidence only when RLS is tied, close, uncertainty-overlapped, or non-decisive.

6) Apply kernel propagation only if declared: if KernelPropagation = QUICK, compute I_prop_welfare(u,d,a) per Section 6; else set I_prop_welfare = I_dir. (Redundancy handling such as EMERGENT/DEDUP/ALLOCATION is a separate instance/aggregation mechanism and MUST NOT be treated as a propagation mode.)

5) Compute the direct contribution and accumulate to the cell: Ĩ_dir(u,d,a;h) = Σ_k ( μ_k · r_k · τ(t_k) · ℓ_k · c_k · e_k · h_k ) over k in that cell. Apply the canonical saturation (for example tanh) to obtain I_dir(u,d,a;h) ∈ [-1,+1]. Here h_k is a declared welfare-inclusion hypothesis coefficient, not an MPS score or moral-worth scalar.

Stream note (Normative). For admissibility layers (NCRC, TRC, CSV), compute the Base stream with h_k:=1 for all impact instances. In the Welfare stream used for RLS, MPS evidence determines the required protection posture and hypothesis set, but the MPS band or interval MUST NOT be inserted directly as a cardinal multiplier. Human persons and FPP entities use h_k=1. For a non-FPP stakeholder whose welfare-bearing status is decision-material, the run MUST evaluate the governed inclusion hypotheses required by Section 12 and Appendix G, including h_k=1 and, where exclusion remains evidentially admissible, h_k=0. If the decision changes across the hypothesis set, the run returns MPS_HYPOTHESIS_SENSITIVE and may not conceal the sensitivity with a convenient intermediate value.

4) For each impact instance k, declare its parameters inside canonical bounds: magnitude μ_k ∈ [-1,+1], reach r_k ∈ [0,1] with ReachBasis, time horizon t_k ∈ (0, ∞) years (used via τ(t_k)), likelihood ℓ_k ∈ [0,1], confidence c_k ∈ [0.1, 1], bounded adjustment multiplier e_k ≥ 0 (default 1.00; non-default use governed by Section 5.2 notes and PCC disclosure), and welfare-inclusion hypothesis h_k ∈ {0,1} unless a separately governed and validated welfare-attention profile authorizes additional bounded values. h_k is never inferred mechanically from an MPS interval. Every human person and FPP entity uses h_k=1 (Appendix G).

Dual-baseline implementation note (Normative clarification). In Appendix P, every gate-relevant cell retained in RLS uses the FLOOR_REFERENCE value in both the gate and welfare streams. A different STATUS_QUO welfare baseline for any such cell is permitted only through a governed BaselineDualExceptionBlock that states the rationale, both values, non-compensation effect, sensitivity result, authority, and review trigger. In the absence of that block, floor-reference remains controlling. For ordinary non-gate welfare cells, STATUS_QUO may remain the declared welfare baseline.

Note on evidence (Normative clarification): Evidence quality is recorded in PCC provenance fields and informs the choice of c_k. Evidence quality is not a separate multiplicative scalar in Ĩ_dir unless explicitly introduced by a future canonical revision.

3) Construct Impact Instances k for each active welfare cell (u,d): each k must reference (a) a stakeholder instance, (b) a cell (u,d), and (c) a direct or indirect pathway description.

2) Build the representation layer: SDP → Stakeholders → Stakeholder Instances (InstanceMap with union-scope coverage).

1) Declare the run: option set A, unions U_run, welfare dimensions D, horizon window, and kernel propagation policy (NONE / QUICK). If effect-token redundancy handling is used, declare the redundancy mode (EMERGENT / DEDUP / ALLOCATION) and α budgets separately.

5.0B WDBIP welfare-evidence interface (Normative when WDBIP conformance is claimed)

The Welfare Dimension Boundary and Interaction Protocol v1.9 is the Canon-subordinate companion for primary dimension assignment, token-level welfare pathways, dependence and cross-scope duplication disclosure, time-window and subgroup integrity, measurement uncertainty, and welfare-dimension validation planning.

WDBIP does not alter the seven dimensions, Union Scopes, gate sequence, RLS equation, constitutional weights, or lawful authority. It cannot rescue failed RF/NCRC, TRC, or CSV. When WDBIP conformance is claimed, the exact WDBIP record, schema version, and content hash SHALL be attached to or immutably referenced from the PCC.

The Canon owns effect-token definitions, Union Scope mapping, redundancy methods, allocation constraints, RLS weights, and gate routing. WDBIP consumes those objects by version and pointer and MUST NOT redefine them.

5.0C Distinct Effects, Accounting Homes and Representation Limits (Normative)

One effect, one computational home is an accounting discipline, not a theorem that real systems are independent. An effect keeps a stable identity across repeated observations, replicated messages, document views and evidence updates. A new source document, identifier, sensor reading or scope tag alone does not create a new consequence. Preserve both event/observation identity and effect identity; record revisions and causal parent links. Distinct downstream or emergent outcomes require distinct state/bearer/horizon meaning and their own warranted contribution.

The seven dimensions are designed for conceptual distinguishability and low representational redundancy while preserving real causal coupling. Do not claim strict orthogonality, statistical independence, causal independence, proven maximality, or an irreducible/exhaustive seven-part ontology without an applicable definition and evidence. Seven is a governed, revisable coverage architecture. Measurement correlation alone neither proves duplication nor justifies merging two causally related constructs.

Computational-home and conserved-allocation rules do not guarantee invariance under arbitrary repartitioning, changed weights or nonlinear saturation. Preserve the unallocated rights effect; secondary views add no RLS mass. Alternative admissible tokenizations or allocations that could change the score or decisiveness require the existing partition and robustness review. A one-time cost and the outcomes it enables must not both proxy the same final benefit without an explicit endpoint-accounting justification.

5.1 Baseline-Zero Rule (Normative)

Semantic anchor (MUST): For all unions u, dimensions d, and options a:

For all unions u, dimensions d, and options a, I(u,d,a) = 0 denotes zero net represented change from the declared baseline at the cell level.

Interpretation: “0 means no net represented change from baseline in the cell” is globally enforced. Any method that produces absolute levels MUST immediately convert them into baseline-relative deltas before entering RippleLogic impact scoring.

Interpretive boundary (MUST): A zero cell value does not establish that every underlying indicator, stakeholder subgroup, time window, or causal pathway is unchanged. Material opposing contributions MUST remain separately disclosed in the impact-instance, subgroup, distributional, and interaction records and MUST NOT be netted away for RF/NCRC, TRC, CSV, subgroup, or peak-harm analysis.

Stream binding (Normative): Compute a Base stream and a Welfare stream. The Base stream fixes h_k := 1.0 and is used by TRC and CSV. RF/NCRC begins from the Base stream but MUST apply the rights-specific non-attenuation, categorical-prohibition, and severe-hazard rules in Section 7.4; adverse rights severity MUST NOT be reduced merely because duration is short or analyst confidence is low. The Welfare stream uses the governed welfare-inclusion hypothesis set defined by the SGP binding interface and is used only for RLS. MPS bands and intervals are evidence objects and protection triggers, not cardinal welfare weights. If ranking or selection changes across the hypothesis set, the PCC MUST report MPS_HYPOTHESIS_SENSITIVE and the run must seek evidence, apply a precautionary policy, narrow the claim, preserve multiple options, or refuse a definitive ranking.

5.1A Baseline Contract for Admissibility Layers (Normative)

Baseline scope (Normative). RippleLogic welfare impacts are baseline-relative by design (Baseline-Zero Rule). For admissibility layers (NCRC and TRC) and any containment checks that depend on gate-relevant cells, the baseline for any cell that is in a rights coverage set C_r or in the catastrophe set C_cat MUST represent a rights-safe / safe-corridor reference condition (the rights-reference baseline; legacy machine alias FLOOR_REFERENCE), not merely the status quo.

Floor-baseline requirement (Normative). For each active rights or catastrophe cell, the PCC MUST declare the floor baseline reference (indicator definition, target level, jurisdictional or governed source when available, and any conversion assumptions). An option that maintains a rights-violating status quo MUST therefore score below 0 on the gate-relevant baseline-delta scale, because the baseline for gating is the floor reference.

PCC disclosure (Normative). The PCC MUST record BaselineType_Gates = FLOOR_REFERENCE for all cells in C_r ∪ C_cat, and MUST record BaselineType_Welfare for other cells. Allowed values: STATUS_QUO, FLOOR_REFERENCE, OTHER_DECLARED. If OTHER_DECLARED is used, the basis and rationale MUST be specified and MUST NOT weaken NCRC/TRC protection.

For catastrophe cells, the safe-corridor baseline remains the controlling TRC reference. Section 8.4 fixes the scenario-conditioned residual-loss interpretation and separates it from the diagnostic same-scenario incremental comparison.

5.2 Impact Instances (Normative)

RippleLogic represents impacts in each active welfare cell (u,d) for option a as a finite set of impact instances K(u,d,a). Each instance captures one distinct causal pathway or measurable effect.

InstanceMap vs Impact Instances Bridge (v9.0; Normative): InstanceMap (Section 2.2A) specifies who is represented (stakeholders-in-context). Impact instances k ∈ K(u,d,a) specify how impacts occur (pathways) within a Scope×Dimension cell. These are distinct objects and MUST NOT be conflated. Impact instances inherit scope mapping from the stakeholder instances they affect. Both are required for full auditability at Tier 3.

Informative: Scopes × Dimensions form the welfare matrix. Instances feed the cells.

5.2.1 ReachBasis canon (Tier 2+ required) (Normative)

Definition (Normative). Reach r_k ∈ [0,1] is a scale term representing the fraction of the relevant reference class affected by impact instance k for the specified union scope u and welfare dimension d. r_k is not a moral weight and MUST NOT substitute for rights floors, TRC, or other gates.

ReachBasisType (Normative). For each r_k, the PCC MUST record one ReachBasisType ∈ {POPULATION_FRACTION, ASSET_OR_FLOW_FRACTION, AREA_OR_VOLUME_FRACTION, OTHER_DECLARED}. If OTHER_DECLARED is used, the PCC MUST define the basis and the denominator unambiguously.

Denominator rule (Normative). The denominator MUST match the union scope u and the decision boundary (Section 2.2A), and MUST be disclosed with units (for example: adult residents in district X; monthly platform active users; hectares of watershed; annual procurement spend).

Estimator and bounds (Normative). The PCC MUST record the estimator method and source/provenance for the denominator and numerator, plus conservative bounds when uncertainty is material. If bounds are used, the PCC MUST record r_k_low and r_k_high and use the conservative bound in any gate-relevant analysis when reach uncertainty could affect admissibility or containment.

Sign-aware reach-bound rule (Normative). When reach uncertainty is material, the PCC MUST use the conservative endpoint relative to the claim being supported: a beneficial effect used to justify selection, safety, control adequacy, or mitigation uses the lowest supported reach; an adverse effect uses the highest supported reach; and a gate-critical adverse effect uses GateAdverseBound. If sign is mixed or unresolved, evaluate both supported endpoints. If admissibility, containment, ranking, or selection changes across the interval, record sensitivity and narrow, escalate, redesign, delay, or refuse the stronger claim. A denominator choice MUST NOT systematically reduce adverse reach or inflate beneficial reach.

Rights-specific reach semantics (Normative). For rights-covered impact instances used in NCRC evaluation, reach SHALL be defined relative to the materially exposed protected subgroup or another subgroup-exposed reference class that prevents attenuation by unaffected population fraction. Reach in rights-covered cells MUST NOT dilute severity by reference to the full union population when only a protected subgroup is exposed. The PCC MUST record the rights-specific denominator when it differs from the general welfare denominator.

Table 5.1: Impact Instance Parameters (Canonical)

Normative notes:

• c_k has a floor of 0.1 to prevent omission-by-zeroing. In the residual Welfare stream, c_k is a governed evidence-support shrinkage coefficient toward the declared no-material-change prior; it is not the complete uncertainty model and it is not a claim that the unshrunk effect is absent. The PCC MUST separately report uncertainty under Section 10.3 and MUST test whether ranking changes under a governed unshrunk or adverse-bound sensitivity when low-confidence adverse impacts are material. In RF/NCRC, TRC, and material CSV use, the Gate-critical confidence guard below controls: low confidence cannot operate as a protective discount.

Gate-critical confidence guard (Normative). For an adverse gate-critical instance k in a rights coverage set C_r, catastrophe cell set C_cat, or material CSV indicator, define GateAdverseBound(k) deterministically before the run. If an admissible interval or scenario bound is available, GateAdverseBound(k) is the most adverse supported endpoint for harm claims and the least favourable supported endpoint for beneficial control, capacity, or mitigation claims. If only a point estimate and c_k are available, the adverse gate calculation removes confidence shrinkage by setting c_gate,k:=1, while a beneficial claim used to establish gate safety retains c_gate,k:=c_k. Likelihood and scenario probability remain separately represented and MUST NOT be double-counted. If no reproducible conservative bound can be justified and the gate outcome could change, the result is UNKNOWN, ESCALATE, NARROW, or REFUSE rather than PASS. The PCC MUST record the bound method, evidence source, endpoint, and disposition. Confidence MUST NOT launder severe but uncertain gate-critical harm into pass status.

• e_k is tightly governed. Tier 2 MUST set e_k = 1.00 for all impact instances unless a named governed instrument from PCC.EKRegistry is invoked explicitly. Tier 3 MAY use non-default e_k only from a pre-declared registry of allowed instruments, with each instrument carrying a declared purpose, source, allowed range, and replayable reason code. Unless a stricter charter rule exists, allowed non-default values are bounded to 0.75 ≤ e_k ≤ 1.25. e_k MUST NOT reverse sign, erase or dilute a rights-floor breach, function as a hidden weight, or be used asymmetrically across compared options without explicit justification and sensitivity disclosure. Any non-default e_k requires PCC justification, declared reason code, source or instrument note, stated bounds, default-counterfactual disclosure (what happens at e_k = 1.00), and tier-appropriate sensitivity if the non-default value could materially affect admissibility or selection.

Audit trigger (Normative). If a non-default e_k is used without declared rationale, source or instrument note, stated bounds, or the required sensitivity record for the claimed tier, implementations MUST set audit flag EK_PARAMETER_UNJUSTIFIED. EK_PARAMETER_UNJUSTIFIED is INVALID for Tier 2-3 claimability until corrected or downgraded.

Registry omission rule (Normative clarification). PCC.EKRegistry MAY be omitted when all impact instances in the run use e_k = 1.00 and no Tier-2 named-instrument exception is invoked.

Registry note (Normative clarification). Implementations SHOULD restrict non-default e_k uses to a small declared registry (for example EQ_CORR, RESILIENCE_CORR, CONTEXT_CORR, or OTHER_DECLARED) and MUST apply the declared rule symmetrically across compared options unless the asymmetry itself is the subject of evaluation.

Confidence-versus-uncertainty distinction (Normative clarification). The instance factor c_k is a declared governance shrinkage operator used to construct a conservative point estimate; it is not itself the uncertainty interval or probability that the effect is true. Cell-level σ(u,d,a) represents a separate uncertainty surface. When the combined use of shrinkage and uncertainty could change admissibility, ranking, or decisiveness, the PCC MUST report an unshrunk effect sensitivity or an equivalent interval/distributional treatment and explain why the two operators are not double-counting the same evidence weakness.

• SGP v8.8 MPS records may affect protection posture, evidence requirements, and the welfare-inclusion hypothesis set used for robust RLS sensitivity. They MUST NOT be inserted directly as cardinal welfare multipliers. Every human person and FPP entity uses h_k=1. For other SGP-aware cases, include h_k=1 whenever direct welfare is a realistic or credible possibility; include h_k=0 as an exclusion hypothesis only where supported by admissible evidence. MPS-NE requires both inclusion and exclusion hypotheses when decision-material. SGP outputs MUST NOT weaken protection or alter NCRC, TRC, or CSV (Section 12; Appendix G).

5.2B Likelihood Semantics and Probability Ownership (Normative)

Every non-unit likelihood SHALL declare one LikelihoodSemantics value: CONDITIONAL_EVENT_PROBABILITY, EXPECTED_FREQUENCY_OR_EXPOSURE, ALREADY_EXPECTED_EFFECT, SCENARIO_CONDITIONAL, or OTHER_DECLARED.

CONDITIONAL_EVENT_PROBABILITY means the full consequence occurs with the declared probability and otherwise does not occur or is replaced by another scenario-defined state. It SHALL be evaluated scenario-first under Section 5.8 and Appendix B.

EXPECTED_FREQUENCY_OR_EXPOSURE means the multiplier is an expected incidence, duty cycle, exposure fraction, or repeated-rate term rather than an all-or-nothing event. Expected-input construction MAY be used when justified.

ALREADY_EXPECTED_EFFECT means the upstream magnitude already contains the relevant probability or frequency. The RLS likelihood multiplier SHALL then be 1.0 for that probability surface.

SCENARIO_CONDITIONAL means scenario probability p_s owns the occurrence weighting. The same probability MUST NOT also enter ℓ_k. Probability may be reused in TRC because TRC evaluates a separate catastrophe-loss object, but the provenance link and non-double-counting disposition SHALL be explicit.

OTHER_DECLARED requires a mathematical definition, unit/interpretation, aggregation order, source, reviewer, and double-counting check. It is not a license to choose the operator producing the preferred result.

If two likelihood interpretations are evidence-supported and selection-material, both SHALL be computed. A leader or decisive/non-decisive reversal sets PROBABILITY_ORDER_SENSITIVE and prevents an unconditional unique-selection claim.

5.2C Adverse-Confidence Selection Integrity (Normative)

The declared Welfare-stream point estimate MAY retain the pinned confidence-shrinkage construction for continuity and auditability. It is conditional on the declared evidence-support model and MUST NOT by itself authorize unique selection when adverse-confidence sensitivity is unresolved.

An AdverseConfidenceCounterfactual is mandatory for every Tier 3 run, and every high-stakes or decision-material Tier 2 run, when an adverse ordinary-welfare effect has c_k<1 and could contribute to the leading option, Gap, mitigation claim, control-adequacy claim, or option comparison.

Where supported intervals or distributions exist, the counterfactual SHALL use the most adverse supported harm bound and the least favorable supported benefit bound used to justify selection. Where only μ_k and c_k exist, adverse effects use c_k=1 in the counterfactual while benefits retain the declared confidence treatment.

This counterfactual is a selection-integrity test, not a claim that every uncertain harm will occur at full magnitude. If the preferred option, Gap classification, or decisive/non-decisive status changes, set CONFIDENCE_RANK_SENSITIVE and prohibit unique framework selection. Public reporting SHALL show both the declared point result and the counterfactual.

A weak adverse estimate MUST NOT receive a less protective residual treatment than an honest decision-material unknown solely because c_k is low. Where that would occur, classify the effect as UNKNOWN_IMPACT or use the supported adverse bound and disclose the disposition.

5.3 Temporal Weighting (Normative)

τ(t) = min(1, ln(1 + max(t, t_min)) / ln(1 + T_ref))

Intuition anchor (informative): τ(t) is the fraction of full governance-horizon weight an effect receives.

Defaults:

t_min = 0.083 years (approximately 1 month; prevents τ(0) = 0)

T_ref = 25 years (governance reference horizon)

Illustrative values (with defaults):

τ(100) = 1.00 (capped)

τ(50) = 1.00 (capped: no bonus beyond T_ref)

τ(25) = 1.00 (reference horizon: full weight)

τ(10) ≈ 0.74 (10 years)

τ(5) ≈ 0.55 (5 years)

τ(1) ≈ 0.21 (1 year)

τ(0.083) ≈ 0.025 (1 month: minimal but nonzero)

Design rationale: Logarithmic weighting preserves intergenerational salience relative to exponential discounting, which aggressively devalues future generations. The cap at T_ref prevents the anomaly where distant-future effects receive more weight than the governance horizon itself. T_ref is a governed parameter: governance bodies may adjust it (with PCC documentation and sensitivity analysis) but MUST NOT set T_ref < 10 years without charter-level justification, as this would effectively suppress long-horizon considerations.

Sensitivity note (Tier 3): T_ref SHOULD be perturbed (for example, T_ref = 15 and T_ref = 50) as part of the sensitivity bundle. If selection changes under T_ref perturbation, the PCC MUST document this sensitivity.

Historical change note (v7.5.0; carried forward unchanged in v9.0): This replaces the uncapped τ(t) = ln(1+t)/ln(1+T_ref) used in v7.4.5, which produced τ(50) ≈ 1.21. The capped version is normatively preferred because temporal weight beyond the governance horizon should not exceed the horizon weight. All prior PCCs computed under v7.4.5 remain valid as lineage material; recomputation is recommended for active decisions with t > T_ref impacts.

The min(1, ·) cap ensures that no effect receives more temporal weight than the reference horizon. Effects at or beyond T_ref receive full weight (τ = 1.0); effects below T_ref receive proportionally less weight on a logarithmic curve. The t_min floor ensures that very short-term effects are not zeroed out.

5.3A Short-Duration Peak-Harm Diagnostic (Normative supplement)

Temporal weighting estimates bounded temporal salience and persistence; it is not a cumulative welfare integral. It MUST NOT be interpreted as evidence that an intense short-duration harm is trivial. For every adverse non-rights instance with |μ_k| >= 0.50 and τ(t_k) < 0.10, the PCC MUST record a PeakHarmReview containing unattenuated peak severity, affected subgroup, reversibility, recurrence risk, mitigation, and whether the harm should enter RF/NCRC, TRC, or CSV instead of remaining ordinary welfare. Tier 3 and high-stakes Tier 2 runs MUST include a sensitivity result that combines the ordinary duration-weighted contribution with a separately disclosed peak-severity diagnostic. This supplement does not convert every brief harm into a rights violation; it prevents duration weighting from hiding intense episodic burdens.

5.3B Temporal Trajectory, Burden, and Token Integrity (Normative Supplement)

The temporal factor τ(t) is a bounded governance-horizon salience and persistence factor. It is not a measure of cumulative welfare, person-time, recurrence, terminal state, irreversibility, or pure time preference.

A TemporalBurdenReview is required for Tier 3 and high-stakes Tier 2 runs when an effect is recurring, cumulative, persistent beyond T_ref, intergenerational, difficult to reverse, terminal-state changing, or materially changes the affected population over time.

The review SHALL record onset, maximal contiguous duration, recurrence, stock-versus-flow status, affected-population trajectory, cumulative exposure where measurable, peak state, terminal state, recovery path, reversibility/irreversibility, intergenerational transmission, uncertainty growth, and any pure-time-preference constitution used.

Temporal token integrity. One continuing state SHALL use its maximal contiguous decision-relevant window. Sequential re-tokenization of one continuous effect into shorter tokens is PROHIBITED unless the episodes are causally or evidentially distinct. A representation-only temporal reversal sets TEMPORAL_PARTITION_SENSITIVE and prevents unique selection.

Science may estimate persistence, exposure, recovery, and uncertainty. Any pure preference for present over future welfare is a declared normative constitution and MUST NOT be hidden inside an empirical parameter.

5.4 Pre-Saturation Direct Impact Aggregation (Normative)

For option a, union u, dimension d, define the pre-saturation direct impact per stream x ∈ {base, welfare}:

Ĩ_dir,x(u,d,a) = Σ_{k ∈ K(u,d,a)} [r_k × τ(t_k) × ℓ_k × c_k × e_k × h_{k,x} × μ_k]

where h_{k,base} := 1.0 for all impact instances. For the Welfare stream, each sensitivity evaluation j uses h_{k,welfare}^{(j)} from the governed welfare-inclusion hypothesis set permitted by Section 12 and Appendix G. MPS bands and intervals inform evidence posture and which hypotheses must be tested; they do not numerically set h_k. Every decision-material hypothesis endpoint MUST be evaluated. When the stream is clear from context, the shorthand Ĩ_dir(u,d,a) may be used. Appendix B controls the stream-separated equations.

5.5 Saturation (Normative)

To ensure all direct impacts lie in [-1,+1] and avoid runaway totals, RippleLogic uses smooth saturation:

I_dir(u,d,a) = tanh(β × Ĩ_dir(u,d,a))

Default: β = 2.

Saturation-parameter governance (Normative). β is a governed shaping parameter, not a natural constant. Every Tier 2-3 PCC MUST record beta_direct; every Tier 3 and high-stakes Tier 2 run MUST report sensitivity over a preregistered range that includes the identity-near case and the canonical default (normally at least β ∈ {1.0, 1.5, 2.0, 2.5} unless the domain profile justifies another range). A non-default value MUST be set before outcome inspection, justified by a named domain or governance source, applied symmetrically across compared options, and accompanied by the default counterfactual. If admissibility, ranking, or decisiveness changes materially across the required range, the result is saturation-sensitive and MUST be narrowed, escalated, routed to accountable authority, or treated as non-decisive for the stronger claim.

5.5A Representation and Partition Integrity (Normative)

A representation-preserving change is a split, merge, relabeling, scope allocation, subgroup partition, time slicing, or scenario subdivision that leaves the underlying bearer, state, baseline, causal pathway, evidence object, and total conserved consequence unchanged.

A representation-preserving change MUST NOT be used to increase beneficial RLS contribution or reduce adverse RLS contribution. Within-cell splitting is invariant only when it preserves the same total pre-saturation contribution, probability ownership, evidence and uncertainty semantics, and token identity. Splitting a linear contribution factor can satisfy this condition with all other factors held fixed; splitting a continuing time window generally does not. For example, tau(10)=0.736 but 2 tau(5)=1.100 and 10 tau(1)=2.127 under the default temporal rule. Section 5.3B prohibits representation-only temporal re-tokenization. Cross-cell, cross-time, cross-scope, and alternative-tokenization changes require governed review because cell-level nonlinear saturation can otherwise change results.

PartitionInvarianceTest is required for Tier 3 and high-stakes or decision-material Tier 2 runs when: more than one defensible tokenization exists; BOUNDARY_CONTESTED is active; a conserved token appears in multiple aggregating cells; a challenger identifies a plausible split/merge; or time/subgroup/scenario granularity can change the number of independently saturated contributions.

These trigger conditions apply to the initial submitted representation as well as to subsequent revisions; the absence of an earlier recorded representation does not establish that the partition test is untriggered.

The test SHALL compare the declared construction with at least one evidence-supported representation-preserving challenger while holding facts, option set, evidence, weights, baseline, and governing parameters constant. If the leading option or decisive/non-decisive status changes, set PARTITION_RANK_SENSITIVE, retain all point results for disclosure, and return REFUSE_DETERMINISTIC_SELECTION unless the representation is resolved independently of the desired result.

Cell-level tanh remains part of RLS. This section does not authorize moving saturation outside the whole 49-cell field or treating the cells as a natural common welfare unit.

5.6 Magnitude Construction μ_k: Canonical Anchoring Methods (Normative)

Magnitude μ_k MUST represent a baseline-relative change on the normalized [-1,+1] scale. RippleLogic permits two canonical anchoring families:

5.6.1 Percentile Anchoring (Default for non-rights cells)

Let x be the raw indicator (higher-is-better unless specified). Let P₅, P₅₀, P₉₅ be the 5th, 50th, and 95th percentiles of x in a declared reference class.

Define a bounded level score:

If x ≥ P₅₀:

S(x) = clip((x − P₅₀) / (P₉₅ − P₅₀), 0, +1)

If x < P₅₀:

S(x) = clip((x − P₅₀) / (P₅₀ − P₅), −1, 0)

Edge-case guard (Normative). If (P₉₅ − P₅₀) = 0 OR (P₅₀ − P₅) = 0 (or numerically indistinguishable), percentile anchoring is undefined. The analyst MUST either (a) change the declared reference class, (b) use an alternate canonical anchoring method with explicit PCC justification, or (c) mark the affected impact instances as UNKNOWN_IMPACT and treat the cell as phantom-active under the Phantom Instance Rule until repaired. A run MUST NOT silently divide by zero or substitute arbitrary epsilons without PCC disclosure.

Then define magnitude as a baseline-relative delta:

μ_k = clip(S(x_a) − S(x₀), -1, +1)

Where x₀ is baseline indicator value, and x_a is the predicted value under option a.

If higher values are worse (for example, mortality rate), use:

S_worse(x) = −S(x)

Normative requirement: The PCC MUST record the reference class and percentile values used.

5.6.2 Threshold Anchoring (Required for rights-covered cells unless invariant reference is declared)

For rights-covered cells (cells in any rights coverage set C_r), analysts MUST NOT use context-local percentile anchoring unless the reference class is declared invariant under governance.

Default rule (Tier 1-3): Rights-covered magnitudes MUST be derived using threshold anchoring with explicit “good/bad” anchors so that rights semantics do not drift.

Let x_good be the indicator level consistent with rights-safe conditions and x_bad be the indicator level representing a severe rights violation onset. Map to a bounded level score:

For higher-is-better indicators: S(x) = clip((x − x_bad) / (x_good − x_bad), -1, +1)

Edge-case guard (Normative). If (x_good − x_bad) = 0 (or anchors are otherwise degenerate), threshold anchoring is undefined. The analyst MUST either (a) repair anchors via governed reference conditions, or (b) mark the affected impacts as UNKNOWN_IMPACT and treat the cell as phantom-active under the Phantom Instance Rule until repaired. A run MUST NOT compute a finite score from degenerate anchors.

For higher-is-worse indicators: S(x) = clip((x_bad − x) / (x_bad − x_good), -1, +1)

Then compute baseline-delta magnitude:

μ_k = clip(S(x_a) − S(x₀), -1, +1)

Normative requirement: The PCC MUST record x_good, x_bad, indicator definition, and direction.

Magnitude construction for rights-covered cells (C_r cells). For rights-covered cells, magnitudes MUST be derived using threshold anchoring with explicit reference conditions aligned to rights semantics (Section 7.1.1), preventing the context-local drift that percentile anchoring would permit. The PCC MUST record x_good, x_bad, indicator definition, direction, and the source/justification for the anchor values. This requirement applies to all tiers when rights-covered cells are quantitatively assessed.

5.7 Missing Data Rule (Ignorance Penalty) (Normative)

To prevent score inflation by omission:

If a welfare cell (u,d) is active (required by tier context and not masked for RLS), but no defensible instances can be specified, the PCC MUST:

• Mark the cell as “UNKNOWN_IMPACT”, and

• Include a phantom instance with canonical parameters:

This yields a mild negative default rather than unjustified neutrality.

Calibration rationale (Informative). The phantom magnitude mu_phantom = -0.10 is a governance prior set to satisfy two constraints simultaneously: it must be negative enough that omitting evidence is worse than reporting neutral impact (preventing score inflation by ignorance), and it must be small enough in absolute value that phantom instances do not dominate well-evidenced cells when multiple unknowns coexist in a run. At mu = -0.10 with default parameters (r=1, t=T_ref, l=1, c=1), the phantom produces a saturated direct impact of approximately -0.20 per cell. In a run with uniform weights across 49 cells, a single phantom cell contributes roughly 0.004 to the total RLS magnitude, which is detectable in audit but not decisive unless many cells are unknown simultaneously. If roughly five to seven cells carry phantom instances under uniform 49-cell weights, the cumulative penalty is approximately -0.02 to -0.03 in RLS; additional phantom-active cells increase the magnitude further. This creates a meaningful incentive to gather evidence without treating the convention as empirical harm evidence. The value -0.10 is a governance prior, not an empirically validated optimum. It is explicitly challengeable under standard governance rules; any revision requires justification, version increment, and sensitivity analysis over a reference decision suite.

Phantom-dependence rule (Normative). A phantom value is an ignorance-management convention, not evidence that harm occurred. For Tier 3 and decision-material or high-stakes Tier 2 runs, the PCC MUST report the number and locations of phantom-active cells, the RLS ranking with and without phantom instances, and a governed unknown or adverse-bound sensitivity where feasible. If the preferred option, decisiveness classification, or public conclusion changes materially because of the phantom convention, the result MUST be treated as phantom-sensitive and therefore non-decisive, narrowed, escalated, or refused for the stronger claim. Analysts MUST NOT add weak estimates merely to avoid the phantom rule or manipulate the active-cell set to advantage an option.

Clarification: This rule does not apply to cells that are legitimately out of scope and properly masked with justification; it DOES apply to non-maskable cells and to any cell required by the tier’s minimum coverage rules.

Gate-Critical Unknown Rule (Normative). If a cell within C_r or C_cat is declared UNKNOWN_IMPACT, admissibility for that cell SHALL NOT be resolved using only the standard phantom-instance fallback. Default handling path: for rights-covered cells, the run MUST either (i) apply a governed conservative bound sufficient to preserve the rights gate, or (ii) treat the gate as unresolved and rerun, downgrade, or escalate. For catastrophe-covered cells, the run MUST either (i) apply a governed conservative scenario/cell bound sufficient to preserve TRC, or (ii) treat TRC as unresolved and rerun, downgrade, or escalate. Implementations MUST set RIGHTS_CELL_UNKNOWN_GATE_CRITICAL or CATASTROPHE_CELL_UNKNOWN_GATE_CRITICAL, as applicable, using only canonical severities defined in Section 14.3.

5.8 Scenario-Conditioned Impacts (Normative for TRC runs)

When TRC is in use (Tier 3 required; Tier 2 required when catastrophe relevance plausible), impacts MUST be scenario-conditioned at least for catastrophe cells:

Scenario probabilities p_s are governed (Appendix D). Scenario conditioning enters through ℓ_k and/or instance presence, and through propagation if scenario-specific kernels are declared.

5.9 Worked Examples (Non-Normative, Computation-Illustrative)

Example 5.1: Direct impact, Community-Social cell

Decision: Remote-work policy option a. Cell: u=3 (Community), d=3 (Social).

Assume T_ref = 25, β = 2. Here likelihood terms denote expected frequency/exposure, not an all-or-nothing event probability. Use unrounded values in computation.

Instance 1: Reduced in-person interaction

• μ₁ = -0.30, r₁ = 0.80, t₁ = 3 years, ℓ₁ = 0.90, c₁ = 0.70, e₁ = 1, h_{1,base} = 1, h_{1,welfare} = 1

Instance 2: Increased online community participation

• μ₂ = +0.15, r₂ = 0.50, t₂ = 5 years, ℓ₂ = 0.70, c₂ = 0.50, e₂ = 1, h_{2,base} = 1, h_{2,welfare} = 1

Compute temporal weights:

• τ(3) = ln(4)/ln(26) ≈ 0.43

• τ(5) = ln(6)/ln(26) ≈ 0.55

Compute contributions:

• Inst1: 0.80 × [ln(4)/ln(26)] × 0.90 × 0.70 × 1 × 1 × (-0.30) ≈ -0.064334

• Inst2: 0.50 × [ln(6)/ln(26)] × 0.70 × 0.50 × 1 × 1 × (+0.15) ≈ +0.014436

Aggregate pre-saturation:

• Ĩ_dir ≈ -0.064334 + 0.014436 ≈ -0.049898

Saturate:

• I_dir(3,3,a) ≈ tanh(2 × -0.0498984666) ≈ -0.099467

Example 5.2: Missing-data penalty

Cell u=7 (Biosphere), d=7 (Environment) is active (non-maskable for environment-relevant decisions). Analyst lacks defensible estimates.

Phantom instance yields:

• Ĩ_dir = 1 × 1 × 1 × 1 × 1 × 1 × (-0.10) = -0.10

• I_dir = tanh(2 × -0.10) ≈ -0.20

This is a declared ignorance-penalty display, not evidence of actual harm or a gate PASS; UNKNOWN_IMPACT and the required uncertainty/review handling remain controlling.

SECTION 6: RIPPLE PROPAGATION: KERNEL AND EPISTEMIC HUMILITY

6.0 Purpose (Normative)

Ripple propagation models how direct impacts in one cell causally and institutionally ripple into other cells across unions and dimensions. This makes cross-scale externalities explicit and auditable.

Tier posture: Tier 1-3 permit NONE or QUICK propagation. FULL propagation is a Tier-4 design target only and MUST NOT be used for Tier 1-3 compliance claims.

6.1 Kernel Definition and Convention (Normative)

Let the 49 welfare cells be indexed by i = φ(u,d) with φ(u,d) = 7(u-1) + d. The ripple kernel is a sparse matrix K ∈ ℝ^{49×49}.

Kernel convention (MUST):

• K_{ij} maps effect from source cell j to target cell i (target-row, source-column).

• Propagation uses left multiplication: Ĩ_prop = I_dir + K × I_dir

Interpretation:

Scale semantics and first-order propagation note (Normative clarification). The bounded cell impacts used by RippleLogic are governance scores anchored to declared indicators and baselines, not claims that dignity, liberty, or meaning are measured as cardinal utility in nature. The kernel K is a declared first-order propagation operator for bounded local approximation under the chosen decision horizon. It does not claim that all socio-technical dynamics are globally linear. Non-linearities and threshold behavior are handled elsewhere in the architecture through saturation, scenario branching, rights floors, tail-risk screening, containment, escalation, and versioned recalibration of K. Implementations MUST NOT present K as a proof of empirical linearity; they MAY present it as a transparent, auditable approximation layer governed by the PCC.

• K_ij > 0: improving source j tends to improve target i.

• K_ij < 0: improving source j tends to harm target i.

• K_ij = 0: no modeled pathway.

6.1A Scope Blocks, Causal Provenance and No Duplicate Propagation (Normative)

Use the existing flattening map phi(u,d)=7(u-1)+d. The 49 by 49 kernel can be read as a seven by seven array of seven by seven blocks: K^(u<-v)[d,d_prime] := K[phi(u,d),phi(v,d_prime)]. Target rows and source columns are unchanged. T_(v->u), where used in an explanatory diagram, is only an alias for this block, not a second propagation operator. Cross-scope blocks are not identity maps by default; an unmodelled edge is not evidence that no pathway exists.

Each relied-upon edge SHALL reference its source and target constructs, effect/pathway evidence, causal direction and sign, coefficient and units or normalization, lag and horizon, configuration/domain, uncertainty, validity and review trigger. This is the provenance extension of existing KQS/KOPS and PCC records, not a replacement kernel-quality gate. Do not infer a coefficient from visual taxonomy, raw compute load, blockchain consensus or a linguistic analogy.

Every direct-versus-propagated construction SHALL state whether a downstream effect is already included. A direct total-effect estimate and K times its upstream cause cannot both add the same endpoint consequence. Shared causes, mediation, feedback and repeated observations require explicit attribution or exclusion rules. This rule preserves genuine distinct downstream outcomes rather than treating causality itself as duplication.

A state-dependent susceptibility modifier, if researched, is structural telemetry rather than a Welfare Dimension, sentience estimate or hidden e_k/weight multiplier. Any numerical use requires a separately warranted model, fixed mapping, joint uncertainty and tests of the final effective kernel against the existing stability, KQS and sensitivity conditions. No Gamma vector, inverse reserve formula or automatic cross-substrate welfare mapping is adopted by this specification.

Diagonal-edge clarification. A nonzero K_ii is not automatically a new effect or additional welfare entitlement. It requires a distinct, evidence-supported within-cell secondary pathway and lag, the ordinary kernel bounds, and an explicit check that the endpoint is not already included in direct impacts. With no such warrant, use K_ii=0. This is the existing causal-provenance and no-duplicate-propagation rule applied to the diagonal, not a new propagation mode.

6.2 Propagation Modes (Tier 1-3) (Normative)

Stream note (Normative). Propagation is applied per stream x∈{base, welfare} as defined in Appendix B. In Section 6 (and any tables using shorthand), I_dir and I_prop are shorthand for I_dir,x and I_prop,x when the stream is clear from context. Admissibility gates (NCRC, TRC, CSV) use the Base stream; RLS uses the Welfare stream.

Normative restriction: FULL propagation is PROHIBITED for Tier 1-3 claims in the current v13.0 release line.

6.3 Post-Propagation Saturation (Normative)

Because propagation can push values outside [-1,+1], apply elementwise saturation:

I_prop_x(u,d,a) = tanh(β_prop × Ĩ_prop_x(u,d,a))

Notation: I_prop_base and I_prop_welfare denote the x=base and x=welfare outputs respectively.

Default: β_prop = 1.

Propagation-mode comparability rule (Normative clarification). NONE and QUICK are different declared transformations: QUICK includes a second saturation step while NONE preserves the direct saturated value. Consequently, a NONE-versus-QUICK comparison is not a pure estimate of the kernel term alone, and a humility fallback from QUICK to NONE is a model change rather than simple deletion of K. The PCC MUST disclose that distinction, recompute the complete result under each declared mode, and separate kernel sensitivity from mode/saturation sensitivity. If the preferred option or gate interpretation changes because of the mode boundary, the stronger deterministic claim MUST be narrowed or treated as unresolved. A future formula change intended to make the null-kernel limit identical across modes requires a versioned equation change and reference-suite replay; it MUST NOT be introduced silently as a same-run implementation convenience.

6.4 Stability Constraints and Humility Fallbacks (Normative)

Kernel stability guardrails (defaults; may be tightened by governance):

• Entry bound: |K_{ij}| ≤ k_max, default k_max = 0.5

• Absolute row-sum bound (required): ∥K∥∞ := max_i Σ_j |K_{ij}| ≤ ρ_max, default ρ_max = 0.9.

• Spectral radius constraint (satisfied by construction under the row-sum bound): If ∥K∥∞ < 1, then ρ(K) < 1 is treated as satisfied for Tier 1-3 purposes because ρ(K) ≤ ∥K∥∞. Implementations MUST NOT require additional spectral-radius computation to claim Tier 1-3 conformance when the row-sum bound holds.

Kernel stability verification rule (Normative). A Tier 1-3 implementation MUST compute and record (in PCC when kernel is used): (i) max_{ij} |K_{ij}| and (ii) ∥K∥∞. If either exceeds its bound (entry bound or row-sum bound), the run MUST execute the humility fallback (propagation_mode = NONE) and record KERNEL_HUMILITY_FALLBACK = TRUE.

If the declared kernel violates entry bounds or row-sum bounds (and therefore fails the Tier 1-3 stability verification rule above), the run MUST:

• Set propagation_mode = NONE, and

• Record a PCC limitation: KERNEL_HUMILITY_FALLBACK = TRUE.

Rationale: An unstable or over-amplifying kernel is worse than no kernel; it creates false certainty and is easy to game.

6.5 Kernel Quality Score (KQS) (Normative)

KQS summarizes readiness of the kernel for decision-relevant propagation:

KQS = w_cov × C_cov + w_id × C_id + w_stab × C_stab + w_pred × C_pred

Default component weights:

Component meanings (each in [0,1]):

• C_cov: coverage evidence proportion (share of relied-upon edges with cited evidence)

• C_id: identifiability (edges are specified with clear endpoints and sign; replayable)

• C_stab: stability margin (satisfies bounds with margin)

• C_pred: predictive accuracy (backtest/pilot performance where available; otherwise conservative prior)

6.5.1 Canonical KQS computation (Tier 1-3 deterministic) (Normative)

Definition (Normative). A ‘relied-upon edge’ is any kernel edge (i,j) with |K_ij| ≥ k_use_min that touches at least one active cell (Section 10.3) or any non-maskable cell in C_r or C_cat. Default k_use_min = 0.05 unless the PCC declares a stricter value.

C_cov (Normative). Let E_use be the set of relied-upon edges. Let E_evid be those edges in E_use whose evidence fields include (i) an EvidenceClass ∈ {A,B,C} and (ii) a citation or provenance reference sufficient for retrieval. Then C_cov := |E_evid| / max(1, |E_use|).

C_id (Normative). Let E_id be those edges in E_use with declared source union/dimension, target union/dimension, sign, and numeric magnitude fields present and within canonical bounds. Then C_id := |E_id| / max(1, |E_use|).

C_stab (Normative). If QUICK is used, compute PCC.Kernel.RowSumAbsMax = ||K||_∞ and PCC.Kernel.EntryAbsMax = max_ij |K_ij| per Section 6.4. Set C_stab := 0 if any bound is violated; otherwise C_stab := clip((ρ_max - ||K||_∞)/ρ_max, 0, 1), with default ρ_max = 0.9.

C_pred (Normative). If no backtest or pilot evidence exists for the decision domain, set C_pred := 0.30 (NO_EVIDENCE_DEFAULT) as already required. If empirical evidence exists, the PCC MUST declare the predictive metric used and compute C_pred as clip((MetricScore - MetricBaseline) / (MetricTarget - MetricBaseline), 0, 1) with all three values disclosed in PCC so an auditor can recompute.

Disclosure rule (Normative). The PCC MUST record k_use_min, the edge counts |E_use|, |E_evid|, |E_id|, and the computed component values C_cov, C_id, C_stab, C_pred used in the KQS calculation.

Default C_pred prior (Normative). If no backtest/pilot evidence exists for the decision domain, set C_pred := 0.30 (NO_EVIDENCE_DEFAULT). The PCC MUST (i) mark this basis as NO_EVIDENCE_DEFAULT, and (ii) include a plan and timeline to obtain empirical validation evidence; until such evidence exists, C_pred SHALL NOT be reported as higher than the prior.

Interpretation of KQS components (Normative clarification). C_id measures the specified field completeness and replayability, not statistical or causal identification. C_pred = NO_EVIDENCE_DEFAULT is a declared prior, not measured predictive accuracy. C_stab measures margin below the stated numerical bound, not empirical validity of a causal model. Aggregate KQS eligibility does not establish predictive validation or override Reality Grounding, uncertainty, evidence-domain or robustness requirements. The existing component equations, eligibility rules and sensitivity requirements remain unchanged.

KQS policy (MUST) for Tier 3:

• Evidence-coverage eligibility floor: if C_cov < 0.40, the kernel MUST NOT be used for QUICK propagation regardless of the aggregate KQS; set propagation_mode = NONE and record KERNEL_EVIDENCE_COVERAGE_INSUFFICIENT. Formal field completeness, stability, or a no-evidence prediction prior cannot compensate for inadequate evidence coverage.

• If KQS < 0.40: Kernel MUST NOT be used; propagation_mode = NONE.

• If 0.40 ≤ KQS < 0.50: QUICK allowed only with mandatory kernel sensitivity; otherwise use NONE.

• If KQS ≥ 0.50: Kernel use permitted with required sensitivity at Tier 3.

Tier 1-2 default: propagation_mode = NONE unless the PCC explicitly declares kernel use and its KQS.

6.6 Kernel Sensitivity Requirements (Normative for Tier 3 when QUICK is used)

When QUICK propagation is used at Tier 3, the PCC MUST include sensitivity analysis:

• Perturb each relied-upon edge in E_use (as defined in Section 6.5.1) by ±0.05 (or ±10% of its magnitude, whichever is larger; declare the rule).

• Recompute the cascade for each perturbation set (at minimum one-at-a-time).

• If admissibility outcomes (NCRC, TRC, CSV) or the selected option changes, set audit_flag = DECISION_FRAGILE_KERNEL and escalate per tier policy.

6.7 KOPS and Starter Kernel (Tier 2-3) (Normative plus Provisional Labeling)

RippleLogic permits a governed subset of kernel edges called the Key Operational Pathways Set (KOPS). KOPS is the set of “load-bearing” pathways that are documented with evidence notes, sign-checked against literature or backtests, and sensitivity-audited.

A Starter KOPS may be provided (Appendix K) and MUST be labeled PROVISIONAL with evidence classes and a global shrink factor for elicited edges (default 0.35). If a starter kernel is used, the PCC MUST disclose this and MUST include kernel sensitivity.

6.7A Continuous-Time Research Bridge (Informative; not a new propagation mode)

A separately warranted physical or institutional state model may use dz/dt=M_dyn z+B_dyn a+xi. For a locally linear, time-invariant unforced model, z(t+Delta t)=exp(M_dyn Delta t)z(t), with M_dyn carrying inverse-time units in consistently normalized coordinates. The approximation exp(M_dyn Delta t) approximately equals Id+M_dyn Delta t is local in M_dyn Delta t and does not justify universal linear welfare dynamics. The existing K may be compared with M_dyn Delta t only after the state-to-impact bridge, units, horizon, saturation and omission treatment have been reconciled.

This research relation does not replace NONE or QUICK, certify a matrix exponential as stable, or make FULL/Tier-4 claims available. Positive feedback can amplify losses; recovery must be modeled as an intervention with resource costs, delays, failure modes and externalities. Neither a harmonic-amplification theorem nor reversal of physical entropy is asserted.

6.8 Scenario-Conditioned Propagation (Tier 1-3 Default Rule)

Default: Kernel is not scenario-conditioned; scenario enters via instance likelihoods ℓ_k and scenario-specific instance activation. Scenario-conditioned kernels K_s may be used only with explicit PCC justification and must carry KQS and sensitivity per scenario class.

SECTION 7: RIGHTS LAYER: NON-COMPENSATORY RIGHTS CONSTRAINT (NCRC)

7.0 Purpose and Union-Based Ethics Rationale (Normative)

RippleLogic enforces non-compensability: certain harms are not permitted to be “paid for” by aggregate benefits elsewhere. NCRC operationalizes this by removing rights-violating options prior to any welfare optimization.

Union-Based Ethics (UBE) justification: Under UBR, harms propagate across layered and intersecting analytical scopes and dependency paths; without a rights-first constraint, local optimization systematically externalizes costs onto vulnerable subgroups and future stakeholders. NCRC is therefore a structural safeguard against value scalarization and moral laundering (Rawls, 1971; Sen, 2009).

7.1 Canonical Rights Set (Normative)

RippleLogic defines eight core rights as feasibility floors:

Table 7.1: Canonical Rights Thresholds (Normative)

Ecological Integrity boundary. ECOL is a MathGov non-compensatory enabling-condition protection for biosphere integrity and life-supporting ecological conditions. It may overlap with legal environmental rights where recognized, but this Canon does not claim universal legal status by itself.

Normative interpretation rule: Thresholds θ_r are admissibility floors, not weights. They do not represent “how important” a right is; they represent the minimum allowable protection level.

Threshold governance. All thresholds are explicitly challengeable. Revisions require justification, version increment, PCC documentation preserving prior values, and sensitivity outcomes over a reference decision suite.

Threshold epistemic boundary. Rights thresholds are versioned governance priors, not discovered empirical constants or jurisdiction-specific legal conclusions. They may be challenged, localized, stress-tested, and revised under governed update rules, but they remain non-compensatory while active in a run.

Sensitivity requirement. In Tier 3 runs, each θ_r MUST be perturbed by ±0.05 and the cascade recomputed. If admissibility changes for any option under perturbation, the decision is flagged as threshold-sensitive and the PCC MUST document which rights are near-binding, which options are affected, and how the final selection responds to that near-binding status.

Proxy disclaimer. Governance indices (such as press freedom or rule-of-law indices) may be used as operational proxies for anchoring reference conditions, but are not treated as moral ground truth and MUST be accompanied by documented limitations in the PCC.

Right INFO (θ = -0.40). Normative anchor: systematic censorship, epistemic coercion, or deliberate degradation of the information environment such that agents cannot form informed preferences. Example anchors: systematic media control and censorship per RSF Press Freedom Index “Very Serious Situation” (score below 40); persistent large-scale disinformation operations affecting public health, safety, or governance; surveillance-driven chilling effects that measurably suppress information seeking or expression.

Right PROC (θ = -0.45). Normative anchor: denial of fair hearing, non-transparent coercive procedure, or absence of meaningful recourse against institutional power. Example anchors: no meaningful access to justice or independent review per WJP Rule of Law Index bottom quintile; consequential automated decisions without explanation, appeal, or human review; systematic procedural exclusion; coercive institutional action without proportionality review.

Right NEED (θ = -0.50). Normative anchor: severe deprivation of material conditions necessary for survival and minimally adequate functioning. Example anchors: sustained severe food insecurity at IPC Phase 3 or above; homelessness or severe housing deprivation per UN-Habitat standards; lack of safe water and sanitation; denial of essential healthcare access such that treatable conditions become severe or lethal.

Right DIGN (θ = -0.55). Normative anchor: systematic humiliation, dehumanization, or targeted degradation that denies inherent worth and equal standing. Example anchors: institutionalized dehumanization of groups per the UN Framework of Analysis for Atrocity Crimes; degrading treatment per ECHR Article 3; systematic exclusion from participation in social and civic life; discriminatory institutions that deny equal standing below capability thresholds (Nussbaum, 2011).

Right ECOL (θ = -0.65). Normative anchor: breach of biosphere integrity or entry into high-risk Earth-system transgression corridors that threaten enabling conditions for continued life. Example anchors: actions that materially increase probability of crossing critical climate or ecosystem tipping elements per Lenton et al. (2008); ecosystem regime shifts effectively irreversible on human-relevant timescales; depletion of foundational natural capital (aquifers, soils, fisheries) beyond recharge capacity; biodiversity loss sufficient to undermine ecosystem services.

Right LBTY (θ = -0.65). Normative anchor: arbitrary detention, forced labor, coercive confinement, or systematic deprivation of freedom of movement and association. Example anchors: deprivation of liberty without legal basis or review per ICCPR Article 9; forced labor patterns consistent with ILO indicator bundles (restriction of movement, debt bondage, retention of identity documents, isolation); coercive confinement not justified by legitimate, proportionate public safety measures.

Right BODY (θ = -0.70). Normative anchor: severe injury, disability, torture, or serious violation of bodily autonomy falling short of lethality but constituting fundamental harm to physical and psychological functioning. Example anchors: torture or cruel treatment as defined by the UN Convention Against Torture; serious bodily injury resulting in permanent disability or substantial loss of function per WHO disability classification frameworks (ICF; WHODAS 2.0); forced medical procedures or systematic bodily violations; sustained exposure to hazards expected to cause serious chronic illness.

Right LIFE (θ = -0.90). Normative anchor: near-certain or highly probable death, lethal exposure, or elimination of conditions necessary for continued biological existence for the worst-off subgroup. Example anchors: direct lethal violence or exposure; catastrophic deprivation conditions such as IPC Phase 5 famine (≥20% extreme food gaps, crude death rate >2 per 10,000 per day); collapse of life-sustaining infrastructure (water, sanitation, shelter) without viable alternatives; mass-casualty disaster exposures. The threshold is set above -1.0 because -1.0 corresponds to guaranteed death for all affected persons, a theoretical maximum rarely achieved even in extreme scenarios.

7.1.1 Threshold Calibration Protocol (Normative)

The eight canonical rights thresholds are normative governance priors, not empirically derived frequencies. Each threshold encodes a severity level on the normalized impact scale [-1, +1] at which a predicted impact is treated as a rights-floor violation that cannot be traded away for aggregate benefit elsewhere.

Calibration follows two principles:

First, thresholds are placed relative to the semantics of the impact scale: -1.0 denotes an extreme, worst-case welfare decrement in the relevant domain; +1.0 denotes an extreme improvement.

Second, the ordering of thresholds reflects both a severity gradient and an enabling-conditions logic: rights protecting against lethal and bodily harms sit closer to the floor, while rights protecting procedural and epistemic conditions are set closer to zero because their violation can enable cascading downstream rights failures. When information environments are degraded or due process is absent, communities lose the epistemic and procedural capacity to detect and contest violations of life, bodily integrity, and liberty.

Operationally, a threshold is justified by two to four anchor conditions per right, a mapping rule from anchors to the [-1, +1] scale using threshold anchoring (Section 5.6.2), and a mandatory sensitivity sweep.

7.2 Rights Coverage Sets C_r (Normative)

Coverage interpretation. Absence of D6 from the default floor-coverage sets is not an exemption from rights review. A Meaning-dimension finding that evidences a categorical, severe-hazard or other protected-rights concern reopens RF/NCRC under the applicable rights profile and WDBIP routing rules; retain the effect identity and do not duplicate welfare mass merely to create a rights view.

Each right applies to a defined subset of welfare cells C_r. NCRC evaluates each right across its coverage set and uses the worst-off subgroup for rights-covered cells.

Canonical coverage sets (authoritative):

Coverage note (Normative clarification). ECOL is scoped to capture enabling-conditions harms to the biosphere and to humanity’s life-support systems. Canonically this is implemented via Environment-dimension cells in the Humanity / Global Coordination and Biosphere unions (and any additional declared cells via governed extension). Implementations MAY extend ECOL coverage to additional cells only by explicit governance declaration in the PCC, and MUST NOT silently re-scope ECOL between runs.

7.3 Worst-Off Subgroup Semantics (Normative)

Rights cannot be averaged away. For every rights-covered cell (u,d) in any C_r, define:

I_rights(u,d,a,r) = min_{g ∈ G_RF(u,d,a,r)} I_RF(u,d,a|g,r)

G_RF MUST NOT be empty for a material rights-covered cell. When no governed subgroup split is material, the declared base population is the sole member. If neither a governed subgroup record nor a defensible base-population record exists, the cell is NCRC_UNKNOWN; an empty set MUST NOT pass vacuously.

Where G_RF(u,d,a,r) is the governed set of protected subgroups relevant to that right and cell. The right identifier r MUST remain explicit in machine records even where display equations suppress it for readability. The ordinary Welfare/Base-stream value I_prop_base may inform evidence discovery, but it is not the canonical rights-floor input unless separately reconstructed under the Section 7.4 non-attenuation rules.

Tier requirements:

• Tier 3: Subgroup enumeration is REQUIRED for rights-covered cells (Appendix H PCC requirements).

• Tier 2 (strict posture): Subgroup enumeration is REQUIRED at least for directly affected populations in rights-covered cells; when infeasible, the PCC MUST record SUBGROUP_LIMITATION and apply a conservative bound rule (Section 7.3.2).

7.3.1 Minimum subgroup categories (Normative minimum)

At minimum, when applicable and feasible, G_{u,d} SHOULD include subgroups defined by:

• Age (children; elderly)

• Disability status

• Legally protected characteristics relevant in jurisdiction

• Economic vulnerability (for example, bottom income quintile)

• Geographic exposure (for example, high-risk locations)

• Domain-specific protected groups (for example, patients, detainees, precarious workers, indigenous communities)

7.3.2 Conservative fallback when subgroup disaggregation is infeasible (Tier 2-3) (Normative)

If subgroup-specific rights-floor impacts I_RF(u,d,a|g,r) cannot be produced for a rights-covered cell, the run MUST:

• Record SUBGROUP_LIMITATION in the PCC, and

• Apply a conservative rights bound for that cell:

Let γ_subgroup be a conservatism factor (default γ_subgroup = 1.5). Then define:

• If the separately constructed base-population rights-floor impact I_RF_base(u,d,a,r) < 0, set I_rights(u,d,a,r) = max(-1, γ_subgroup × I_RF_base(u,d,a,r))

• Else set I_rights(u,d,a,r) = I_RF_base(u,d,a,r)

This bound applies only for NCRC checking, not for RLS scoring.

Fallback applicability (Normative clarification). A nonnegative welfare average does not establish the absence of protected-subgroup harm. SUBGROUP_LIMITATION does not waive material subgroup closure. Where a decision-material subgroup harm remains unresolved and no defensible rights bound can be established, the run MUST use NCRC_UNKNOWN and the existing escalation or refusal route rather than treating the fallback as evidence of passage. The governed gamma_subgroup factor is a screening convention, not a distribution-free guarantee for every unobserved subgroup. The adverse-only rights construction in Section 7.4 remains controlling.

Emergency comparison tie rule (Normative). The saturated I_rights value remains controlling for ordinary admissibility. If two or more Emergency Mode options tie on v_r^floor because the conservative clamp maps them to −1, the run MUST use the unclamped conservative value γ_subgroup × I_RF_base as a secondary ordering key for that right, with more negative values treated as worse and the trace recorded in the PCC. This secondary key does not convert any failing option into an ordinary NCRC pass.

If I_RF_base cannot be constructed from reviewed rights-floor instances, the cell is NCRC_UNKNOWN; the run MUST collect evidence, narrow, escalate, or refuse rather than reuse a temporally or confidence-attenuated welfare value as a rights pass.

Calibration note (Normative guidance). The default γ_subgroup = 1.5 is a conservative governance prior rather than an empirically estimated constant. The value is set as a moderate worst-off uplift between the identity case (γ_subgroup = 1.0) and stronger stress-test settings used to examine subgroup vulnerability under uncertainty. It is intended to reduce subgroup erasure without asserting a precise empirical constant across domains. Tier 3 deployments SHOULD review γ_subgroup against their reference decision suite at least annually or after a material accumulation of rights-sensitive runs. Any non-default γ_subgroup MUST be declared in the PCC, justified, and accompanied by sensitivity reruns over the reference suite. The sensitivity sweep for γ_subgroup SHOULD include at minimum γ_subgroup ∈ {1.0, 1.3, 1.5, 2.0} to test whether admissibility outcomes or selection change materially.

7.4 Rights-Specific Severity, Hazard, and NCRC Admissibility (Normative)

7.4.1 Rights-floor impact channel (Normative)

The welfare-impact stream is not by itself sufficient to decide rights admissibility. For every adverse impact instance k that is material to a protected right r, the run MUST construct a rights-floor instance using the exposed protected subgroup as the reach denominator.

For adverse rights-floor instances, set the rights temporal factor τ_RF(t_k) := 1.0. Duration remains recorded and may aggravate severity, remedy, and emergency comparison, but short duration MUST NOT attenuate a categorical or severe rights violation into admissibility. Analyst confidence c_k is evidence metadata rather than a protective discount: low confidence MUST trigger conservative bounding, evidence collection, narrowing, escalation, or refusal, not a weaker rights check.

Let ℓ_k^U be the declared conservative upper likelihood bound for the rights event. The rights-floor contribution is:

x_RF(k,r,a) = μ_k · r_k^R · ℓ_k^U · e_k

where r_k^R uses rights-specific exposed-subgroup reach. Only adverse rights-floor instances enter this channel; positive effects remain in welfare analysis and cannot offset a protected loss.

For each rights-covered cell, let K_RF(u,d,a) be the reviewed set of material adverse rights-floor instances and define:

X_RF(u,d,a) = Σ_{k ∈ K_RF(u,d,a)} x_RF(k,r,a)

I_RF(u,d,a) = tanh(β_RF · X_RF(u,d,a))

The canonical default is β_RF = β, the governed saturation parameter used for direct welfare impacts in Section 5.5. In this rights-specific channel, I_RF and I_rights are evaluated separately for each protected right r; the r subscript is suppressed in legacy display equations only. Machine records and validators MUST preserve the right identifier and MUST NOT merge overlapping rights into one compensable cell value. β_RF is a governed rights parameter, not an empirical constant. Every Tier 2-3 PCC MUST record it. Tier 3 and high-stakes Tier 2 runs MUST test the canonical value and at least one lower and one higher preregistered value whenever a plausible change could cross a rights threshold. Larger positive β_RF magnifies both positive and negative pre-saturation values toward the bounds and therefore makes a negative floor breach more likely for a fixed negative X_RF; “tighter” MUST NOT be used without stating that direction. A non-default β_RF MUST be set ex ante, justified, applied symmetrically, and accompanied by the canonical-default counterfactual. If rights admissibility changes across the required sensitivity range, the run MUST report RIGHTS_SATURATION_SENSITIVE and MAY NOT claim an unqualified RF/NCRC result until governed review resolves the parameter basis. For the subgroup set G_RF(u,d,a) required by Section 7.3, define I_rights(u,d,a) = min_{g ∈ G_RF(u,d,a)} I_RF(u,d,a|g); when no governed subgroup split is material, the declared base population is the sole member of G_RF. Apply the remaining Section 7.3 visibility and evidence rules without attenuation. Low confidence, short duration, or positive welfare elsewhere cannot attenuate this rights-floor channel.

7.4.2 Categorical-prohibition channel (Normative)

For each material rights instance, declare z_k,r ∈ {0,1}, where z_k,r = 1 means the option authorizes, requires, or knowingly imposes a categorical rights violation under the declared rights profile. Examples may include torture, intentional killing outside a lawful protective exception, non-consensual invasive medical intervention, arbitrary detention, deliberate deprivation below a basic-needs floor, or another prohibition explicitly declared by the governing profile.

A categorical flag is profile-governed and challengeable. It MUST NOT be inferred merely from rhetoric, and it MUST NOT be removed because the event is brief, affects a small protected subgroup, or produces benefits elsewhere.

7.4.3 Severe rights-hazard channel (Normative)

Explicit screening record (Normative). For every adverse rights-covered instance, the PCC MUST contain an explicit severe-rights-hazard screening field that records ACTIVE, reviewed NOT_MATERIAL, or UNKNOWN, together with the event-class and threshold basis, evidence source, reviewer status, and reopen trigger. An absent or blank screen is UNKNOWN, not NOT_MATERIAL. A run MUST NOT obtain RF/NCRC passage merely by omitting EventClass, h_sev, p^U, the exposed-subgroup denominator, or another field needed to determine whether the channel activates.

The severe-rights-hazard channel is distinct from the ordinary rights-floor threshold. It is activated by either a governed event class or a separate hazard-activation threshold. Decision-materiality screen. The background existence of a severe event class in a domain does not by itself activate the channel for every option. The run MUST determine whether the option creates, increases, transfers, conceals, controls, or makes a material claim about the protected population's exposure relative to the declared baseline. A reviewed NOT_MATERIAL finding requires an option-specific rationale, evidence source, reviewer status, and reopen trigger; it MUST NOT be represented as proof that background risk is zero.

For impact instance k and right r, define:

SevereRightsHazardActive(k,r) := (EventClass_k ∈ C_severe,r) OR (h_sev,k,r ≥ η_r).

Canonical default: η_r := min(0.50, |θ_r|). Domain profiles MAY tighten η_r but MUST NOT set it above 0.50 or disable a canonical event-class trigger.

C_severe,r includes, where applicable: credible fatality pathways; torture or cruel, inhuman, or degrading treatment; serious bodily injury or forced invasive intervention; arbitrary detention or confinement; deprivation of basic subsistence; collapse of due process or remedy; severe information coercion or manipulation; and irreversible or severe ecological destruction affecting protected life-support conditions.

When the channel is active, the run MUST separately declare intrinsic severity conditional on occurrence, likelihood or scenario probability, reversibility, consent/authority status, worst-affected subgroup, evidence status, and the governed tolerance or prohibition. The ordinary temporally weighted welfare product does not determine whether the hazard is reviewed. Missing gate-critical evidence produces NCRC_UNKNOWN, escalation, or refusal rather than an implied pass.

7.4.4 Violation components and predicate (Normative)

For each right r, define:

v_r^floor(a) = max_(u,d in C_r) (θ_r - I_rights(u,d,a))^+

v_r^cat(a) = max_(k in K_r(a)) z_k,r

v_r^risk(a) = max_(k in K_r(a): SevereRightsHazardActive(k,r)) (p_k,r^U - ρ_{k,r})^+

where (x)^+ = max(x,0).

Reviewed-empty-set convention (Normative). For the categorical and severe-risk channels, max ∅ = 0 only after the run has completed the required stakeholder, event-class, and evidence review and has established that no material instance belongs in the applicable set. This convention does not apply when a required field, stakeholder, event class, or evidence trace is missing or unresolved; such cases produce NCRC_UNKNOWN, escalation, or refusal rather than zero.

If a required severe-hazard field is missing, set the rights evidence status to UNKNOWN rather than zero.

Rights-risk tolerance provenance rule (Normative). rho_r is a governed maximum tolerated probability for an already activated severe-rights hazard; it is not inferred from the ordinary floor theta_r, analyst convenience, or the option’s welfare score. Every non-zero rho_r MUST identify the governing authority or domain profile, protected population and event class, evidence date, uncertainty basis, challenge/appeal path, and review trigger. Categorical prohibitions ordinarily use rho_r=0. If rho_r is missing, stale, unauthorized, or contested at a gate-material point, the severe-risk channel is NCRC_UNKNOWN, not zero. For each tested probability constraint, the tolerance MUST specify the protected bearer or population, adverse-event family, time horizon or exposure unit, and per-pathway or aggregate interpretation. Write the applicable tolerance as rho_{k,r}; rho_r in prose abbreviates that scoped value. For an aggregate tolerance, group all material pathways to the same protected event within that boundary and test a justified joint or union probability bound before taking the maximum violation. The risk-check index k includes these required aggregate probability records as well as individually constrained pathways; aggregate records are not additional welfare contributions. Independence, exclusivity, shared causes and repeated exposure require explicit treatment; a conservative union bound may be used where warranted. Do not assume independence or sum overlapping event probabilities as if disjoint. Keep individual constraints as additional checks. An unbounded material aggregate exposure or unresolved tolerance boundary yields NCRC_UNKNOWN, not passage.

Activation/computation examples (Normative). Failing case: for LIFE, let theta_LIFE=-0.90, eta_LIFE=0.50, intrinsic fatality-pathway severity h_sev=0.80, conservative probability bound p^U=0.03, and governed tolerance rho_LIFE=0.01. The hazard activates because 0.80 >= 0.50, even though 0.80 < 0.90; therefore v_LIFE^risk=(0.03-0.01)^+=0.02 and ordinary NCRC passage is blocked. Passing case: under an authorized domain profile for the same event class, let p^U=0.004 and rho_LIFE=0.005, with complete provenance, conservative uncertainty, independent review, and a reopen trigger. Then v_LIFE^risk=(0.004-0.005)^+=0; the severe-risk channel passes, but the floor, categorical, evidence-completeness, TRC, CSV, and authority conditions remain independently binding. These examples do not establish a universal rho_r; tolerances remain right-, population-, event-, domain-, and authority-specific.

Three-channel worked illustration (Informative; equations normative in Section 7.4.4).

The three channels are non-substitutable: a pass on one channel cannot compensate a violation on another, and an unresolved material field yields NCRC_UNKNOWN rather than zero.

NCRC(a) = TRUE if and only if, for every right r:

• v_r^floor(a) = 0;

• v_r^cat(a) = 0;

• v_r^risk(a) = 0; and

• no material rights evidence field is unresolved.

The NCRC-passing set is:

A_NCRC = {a in O : NCRC(a) = TRUE}

Interpretation: a short-duration or low-confidence rights violation cannot pass merely because welfare-style temporal or confidence multipliers are small. Rights-floor impact, categorical prohibition, and severe-hazard exposure are tested separately and non-compensatorily.

Rights-conflict precondition (Normative). Before Rights Emergency Mode is invoked, the run MUST attempt and document feasible alternative generation, redesign, scope narrowing, sequencing, delay, mitigation, or other means of producing at least one RF/NCRC-passing option. An unresolved rights conflict remains a structured rights-vector problem; it MUST NOT be converted into an ordinary welfare trade-off. Only when no rights-passing option remains may Section 7.5 be used, subject to necessity, least-rights-infringing means, time limitation, independent challenge, remedy, and return-to-normal requirements.

7.4.5 RightsEffectToken Non-Dilution (Normative)

Every decision-material rights harm SHALL carry one RightsEffectTokenID binding the affected bearer or exposed subgroup, protected right, state, option, floor baseline, causal pathway, maximal contiguous time window, and evidence object.

RF/NCRC SHALL evaluate the full unallocated token once before any analytical Union-Scope allocation. Allocation, deduplication, scope tagging, dimension routing, or emergent-scale analysis MAY affect residual RLS accounting but MUST NOT reduce the token-level rights calculation.

For rights token j, right r, and option a, define X_RF^token(j,r,a)=μ_j·r_j^R·ℓ_j^U·e_j, with τ_RF=1, c_gate=1 for adverse gate computation, and h_base=1. Define I_RF^token=tanh(β_RF·X_RF^token) and v_j,r^token=max(0, θ_r−I_RF^token) under the sign convention and threshold orientation of Appendix C.

The controlling floor-channel violation is the maximum of the existing cell-level violation and every applicable unallocated token-level violation. Categorical and severe-hazard channels remain independently required.

If one token is presented through multiple sub-threshold scope views, or token identity is missing where allocation could affect the result, set RIGHTS_PARTITION_SENSITIVE or RIGHTS_EFFECT_TOKEN_MISSING. The option MUST NOT receive RF_PASS until the unallocated token has been evaluated and all required fields are resolved.

Distinct harms to different bearers remain distinct tokens. This rule prevents dilution of one harm; it does not sum unrelated small harms into a synthetic super-harm.

7.5 Emergency Mode (Rights-Failure Handling) (Normative)

If A_NCRC = ∅ (no option passes rights), RippleLogic enters Emergency Mode. Emergency Mode is not a loophole; it is a controlled failure protocol.

7.5.1 Emergency Mode rights priority order (Normative)

Rights are ordered lexicographically by the canonical emergency default priority:

[LIFE, BODY, ECOL, LBTY, NEED, DIGN, PROC, INFO]

This order is a provisional governance default for constrained emergency comparison, not a discovered universal moral ranking. It prioritizes immediate survival and bodily integrity, then ecological conditions capable of undermining life-support systems, while retaining liberty, need, dignity, procedure, and information as independently non-compensatory rights outside Emergency Mode. The default MUST be used for the canonical result, but every Tier 3 or high-stakes emergency run MUST also test at least one defensible alternative ordering that moves PROC and INFO earlier when procedural or epistemic failure could causally enable LIFE, BODY, LBTY, or NEED harms. If the selected option changes under a defensible alternative order, RippleLogic MUST report EMERGENCY_RIGHTS_ORDER_SENSITIVE, refuse to portray the result as uniquely entailed by the framework, and route the decision to lawful accountable authority with independent challenge and the complete rights vector disclosed.

7.5.2 Emergency Mode selection rule (Normative)

Construct a compound violation tuple for each right r:

q_r(a) = (v_r^cat(a), v_r^risk(a), v_r^floor(a))

and the option vector:

q(a) = (q_LIFE(a), q_BODY(a), q_ECOL(a), q_LBTY(a), q_NEED(a), q_DIGN(a), q_PROC(a), q_INFO(a))

Select the option that lexicographically minimizes q(a), so categorical prohibition is considered before severe-hazard excess and floor depth within each right. If tied:

• Minimize TRC CVaR (if TRC scenarios exist or are rapidly constructed), then

• If at least one tied emergency candidate passes TRC, compare residual welfare only among those tied TRC-passing candidates. If every tied candidate also fails TRC, apply Section 8.8 Tail Emergency Mode and do not use ordinary RLS ranking.

7.5.3 Independent Challenger Requirement (Normative)

Before Emergency Mode can be invoked, an independent challenger MUST propose at least one alternative option.

Independence requirements (MUST):

• No reporting relationship to decision owner

• No material interest in decision outcome

• Access to the same information set

Minimum challenger effort:

• Tier 2: ≥30 minutes active option generation

• Tier 3: ≥2 hours active option generation

If time pressure prevents this, PCC MUST record CHALLENGE_DEFERRED_EMERGENCY and a retrospective challenge review MUST occur within 24 hours (or earliest feasible time) with an addendum PCC.

7.5.4 Emergency documentation requirements (Normative)

PCC MUST include:

• Emergency declaration and trigger conditions

• v_r(a) for each option

• Lexicographic comparison trace

• Mitigation/remediation plan

• Review cadence and return-to-normal triggers

7.6 Anti-Gaming Rules Specific to NCRC (Normative)

• Rights-covered cells MUST NOT be masked out of RLS aggregation if they are non-maskable by policy (Appendix H audit flags).

• Rights checks MUST use worst-off subgroup semantics and must not be evaluated on averages.

• “Unknown” data MUST NOT be treated as neutral; missing data triggers ignorance penalties (Section 5.7).

• Emergency Mode MUST NOT be used without challenger protocol and remediation plan.

SECTION 8: CATASTROPHIC RISK LAYER: TAIL-RISK CONSTRAINT (TRC)

8.0 Purpose and UBE Rationale (Normative)

Even when rights floors are respected in expectation, a decision can carry non-trivial probability of catastrophic harm to Humanity / Global Coordination or the Biosphere. Under UBE, catastrophe avoidance is lexicographically prior to welfare optimization because catastrophic outcomes can eliminate future choice across unions and collapse enabling conditions.

TRC therefore bounds catastrophic exposure using CVaR, a coherent tail-risk measure (Artzner et al., 1999; Rockafellar & Uryasev, 2000). This posture is motivated by ruin dynamics under deep uncertainty (Taleb, 2012) and by Earth-system research indicating that destabilization of life-support conditions can occur through tipping cascades and boundary transgression corridors with multi-scale downstream harms (Rockström et al., 2009, 2023; Steffen et al., 2015; IPCC, 2023).

Modeled-safety interpretation (Normative clarification). Passing TRC demonstrates compliance with the declared scenario library, probability policy, catastrophe-cell construction, and corridor threshold for the run. It does not prove empirical invulnerability outside the modeled scenario set. Implementations MUST NOT present TRC passage as a guarantee that no catastrophic pathway exists; it is a governance-grade bound within the declared scenario model.

8.1 Tier Requirements for TRC (Normative; strict posture)

8.1.1 Catastrophe relevance trigger (Normative)

Catastrophe relevance is plausible if any of the following are true:

• The decision materially affects any catastrophe cell in C_cat (Section 8.2), OR

• The decision has plausible pathways to tipping cascades (climate, bio, conflict, infrastructure, financial), OR

• The decision is materially irreversible or creates lock-in at Polity/CMIU/Biosphere scales, OR

• Credible challengers identify a plausible catastrophic failure mode even if decision owners prefer not to model it.

If triggered, TRC MUST be executed at the tier’s required rigor.

TRC not-triggered state (Normative). If a documented catastrophe-relevance assessment addresses every Section 8.1.1 trigger and finds none plausible within the declared decision and evidence boundary, the run records TRC_NOT_TRIGGERED. This is a pass-equivalent qualification state for cascade routing only. It MUST NOT be described as TRC_PASS, as a CVaR result, or as evidence that catastrophe is impossible. The assessment, evidence boundary, reviewer status, and reopen triggers MUST be recorded. New catastrophic, irreversible, lock-in, or ruin-relevant evidence reopens TRC before RLS.

8.2 Catastrophe Cell Set C_cat (Normative)

Base catastrophe cell set:

C_cat_base = {(6, Health), (6, Environment), (7, Environment)}

These correspond to:

• Humanity / Global Coordination-Health: Global-scale health viability (pandemic mortality, mass disability, collapse of health capacity)

• Humanity / Global Coordination-Environment: Environment-as-civilization-condition (habitability, agricultural stability, climate-driven displacement)

• Biosphere-Environment: Earth-system integrity (planetary boundaries, biodiversity, biogeochemical stability)

The base set explicitly includes biosphere integrity and civilization-scale habitability conditions because “safe operating space” and “safe and just boundaries” analyses identify global environmental corridors as central determinants of long-run human and ecological viability (Rockström et al., 2009, 2023).

Extensions: Tier 1-3 MAY extend C_cat only with explicit PCC justification and MUST apply the same set to all compared options.

Non-dilution rule for catastrophe profiles (Normative). Adding an extension MUST NOT lower the measured loss or improve the TRC disposition for an unchanged base catastrophe merely because normalized weight is spread across more cells. The base catastrophe profile and every triggered extension profile SHALL therefore be normalized and evaluated separately. Compute L_p(a,s) and CVaR_alpha,p(a) for each active profile p; ordinary TRC qualification requires every active profile to satisfy its governed corridor. A combined summary MAY be reported, but it cannot rescue a failed profile. Any alternative non-dilutive construction requires ex ante governance, proof that unchanged base losses cannot decrease when an extension is added, symmetric application across options, and PCC disclosure.

Clarification (Normative). C_cat_base is the default habitability/civilization catastrophe proxy. It cleanly captures biosphere degradation and civilization-scale health/environment collapse. Governance lock-in, coercive surveillance, procedural collapse, information-ecosystem capture, or other agency-destroying catastrophes are catastrophe-relevant and SHALL NOT be treated as rhetorically covered by the base triplet alone. When any governance-lock-in trigger is plausible, including surveillance normalization, emergency-power persistence, due-process suspension, information-ecosystem capture, irreversible dependency lock-in, or concentrated arbitrary control over critical infrastructure, the run MUST activate the default governance-lock-in extension profile defined in Appendix D.1A, unless a stricter governed profile is declared in the PCC. The chosen profile MUST be applied symmetrically across all compared options and recorded in the PCC.

WTSL-AIX / governance-lock-in tail category is mandatory when AI deployment or governance-lock-in triggers are plausible, including surveillance normalization, emergency-power persistence, due-process suspension, information-ecosystem capture, irreversible dependency lock-in, or concentrated arbitrary control. AI_DEPLOYMENT=YES is sufficient but not necessary.

8.3 Scenario Governance (Normative)

Scenario-discovery record (Normative). Tier 3 and high-stakes or decision-material Tier 2 runs MUST identify the scenario-discovery method or combination of methods, material sources, participating experts or affected stakeholders, independent challenger or red-team contribution where required, search boundary, and disposition of materially plausible rejected scenarios. Suitable methods may include structured elicitation, domain hazard analysis, incident and near-miss review, historical analogues, affected-stakeholder input, literature and standards review, and AI-assisted candidate generation. Generated or institutionally supplied scenarios are discovery inputs; they are not self-validating probability estimates or proof that the scenario surface is complete.

TRC is evaluated over a governed scenario set S with probabilities p_s such that p_s ≥ 0 and Σ_s p_s = 1.

8.3.1 Mandatory Tail Scenario Categories (Normative)

The scenario set MUST include the following tail categories unless explicitly justified as not plausible for the decision context. Governance / lock-in catastrophe is a mandatory tail category if and only if the governance-lock-in extension profile in D.1A is active; otherwise it is recommended but not mandatory. When that profile is active, the scenario set MUST include at least one governance-lock-in tail category with category probability floor p_floor ≥ 0.02.

• Pandemic/biological disruption

• Climate tipping cascade

• Financial system collapse

• Major conflict escalation

• Critical infrastructure failure

Governance / lock-in catastrophe

Minimum probability floor per category: p_floor ≥ 0.02

This prevents “include but set near-zero probability” gaming.

Probability-floor epistemic boundary. The p_floor value is an anti-omission governance prior, not a calibrated empirical frequency estimate. It prevents mandatory tail classes from being made invisible by arbitrary near-zero assignment and must be sensitivity-tested where decision-material.

Scenario partition and dependence rule (Normative). Tail categories are coverage labels, not automatically mutually exclusive events. The PCC MUST declare whether scenarios form a mutually exclusive partition, overlap, or belong to dependence clusters. Overlapping category floors MUST NOT be summed as though independent. Tier 3 and decision-material Tier 2 runs MUST either construct mutually exclusive scenarios, use bounded probability intervals/sets, or run a robust CVaR sensitivity over plausible probability assignments. Correlated compound scenarios and shared causal drivers MUST be tagged so probability mass is not double-counted and independence is not silently assumed.

Rejected-scenario log. Tier 3 runs and high-stakes Tier 2 runs MUST record any material tail category or challenger scenario rejected as implausible, including the rejection rationale, evidence basis, reviewer status, and whether the rejection would change if the reality surface, probability floor, or time horizon changed.

These mandatory tail categories are not intended as exhaustive; they are a minimal governance floor reflecting cross-domain systemic risk exposure in tightly coupled global systems, including climate-driven boundary cascades (Rockström et al., 2009, 2023; Steffen et al., 2015; IPCC, 2023).

8.3.2 Implausibility test for exempting mandatory tail categories (Normative)

If a deployment wishes to exempt a mandatory tail category as “implausible,” the exemption requires:

(i) Written justification in the PCC explaining why the category is implausible for this specific decision context

(ii) Independent reviewer sign-off (Tier 3 required; Tier 2 recommended)

(iii) Recording in PCC with audit flag MANDATORY_TAIL_CATEGORY_MISSING_WITH_JUSTIFICATION

The burden of proof is on omission, not inclusion. This preserves UBE.

8.3.3 Scenario set size minima (Normative)

If a tier cannot meet its minimum scenario count, the run MUST NOT claim tier compliance for TRC coverage and MUST record audit_flag SCENARIO_LIBRARY_MIN_EXCEPTION in the PCC, including written justification and a remediation plan to reach the minimum scenario count for the next comparable run.

8.4 Loss Construction (Tier 1-3: Bounded-Impact TRC) (Normative)

Tier 1-3 TRC uses bounded-impact loss based on propagated Base-stream impacts in catastrophe cells.

Domain constraint: All propagated impacts are bounded: I_prop_base,c(a|s) ∈ [-1, +1].

For each scenario s, define scenario loss:

L(a,s) = Σ_{c ∈ C_cat} ω_c × max(0, −I_prop_base,c(a|s))

Normative stream binding (Design A): TRC MUST be computed from the Base stream (I_prop_base). TRC MUST NOT use Welfare-stream (sentience-weighted) impacts.

Where:

• ω_c ≥ 0, Σ_{c ∈ C_cat} ω_c = 1 (catastrophe weights are normalized)

• max(0, x) returns x if x > 0, otherwise 0 (only negative impacts contribute)

• I_prop_base,c(a|s) is the propagated impact in catastrophe cell c under scenario s

Default catastrophe weights (if not otherwise governed): Uniform weights over C_cat.

Catastrophe-weight governance (Normative). Any non-default ω_c vector MUST be declared ex ante in the PCC, normalized within the active catastrophe profile, justified by a named evidence or governance source, and applied symmetrically across compared options and scenarios. It MUST NOT weaken the base-profile non-dilution rule, hide a material catastrophe cell, or convert an unchanged severe loss into a pass merely through weight spreading. Tier 3 and decision-material or high-stakes Tier 2 runs using non-default ω_c MUST report a uniform-weight counterfactual and any material sensitivity in loss, CVaR, severity-class disposition, or TRC status.

TRC loss-reference rule (Normative). In this edition, I_prop_base,c(a|s) represents the scenario-conditioned residual condition under option a relative to the declared safe-corridor reference for catastrophe cell c, after supported controls and the applicable GateAdverseBound. It is not merely the change from a potentially unsafe no-action outcome. Use the same declared exposure domain, reference, horizon and catastrophe-weight profile across compared options. The domain must include material affected stakeholders, dependencies and foreseeable exposure; any exclusion needs evidence and challenger-visible rationale and cannot be chosen to manufacture a pass. Exogenous scenarios remain required where applicable, but their inclusion does not assert that every unrelated planetary condition belongs to every local decision. Report same-scenario continuation and option-attributable change separately when they aid causal interpretation; subtracting continuation loss MUST NOT erase residual unsafe exposure. No action, delay and continuation receive the same qualification tests. A pre-existing in-scope corridor breach can make every ordinary option fail; then use the existing redesign, escalation or explicitly qualified emergency procedures, never an automatic zero-loss baseline. Option-varying scenario losses are compatible with this residual-state interpretation and do not, by themselves, establish incremental-only semantics.

Interpretation:

• Only negative impacts in catastrophe cells contribute to loss.

• Loss is bounded in [0,1] because weights are normalized and impacts lie in [-1,+1].

• Positive impacts in catastrophe cells (improvements) do not offset losses; they simply contribute zero to the loss function.

Example: If C_cat = {(6, Health), (6, Environment), (7, Environment)} with uniform weights (ω_c = 1/3 each), and under scenario s the propagated impacts are:

• I_prop_base(6,Health,a|s) = -0.30 → contributes 1/3 × 0.30 = 0.10

• I_prop_base(6,Environment,a|s) = +0.10 → contributes 1/3 × max(0, -0.10) = 0

• I_prop_base(7,Environment,a|s) = -0.60 → contributes 1/3 × 0.60 = 0.20

Then L(a,s) = 0.10 + 0 + 0.20 = 0.30

8.4A Catastrophe Severity-Class Overlay (Normative)

Bounded loss supports stable computation but can compress materially different catastrophe classes near the same ceiling. Every TRC scenario MUST therefore declare one severity class in addition to L(a,s): C1_SEVERE, C2_SYSTEMIC, C3_CIVILIZATION_THREATENING, or C4_EXISTENTIAL. The class is evidence-governed and challengeable; it is not inferred from rhetoric or from the bounded loss number alone.

• C1_SEVERE: large but bounded harm with functioning recovery institutions.

• C2_SYSTEMIC: multi-system or cross-polity disruption with major recovery burden.

• C3_CIVILIZATION_THREATENING: plausible loss of durable civilizational capacity, global coordination, or planetary habitability conditions.

• C4_EXISTENTIAL: plausible permanent destruction of humanity or comparable foreclosure of future moral patients.

A governed profile MAY set class-specific probability caps or stricter corridors. Until such a profile is declared, any material C4_EXISTENTIAL pathway prevents an ordinary TRC pass unless its conservative upper probability bound is shown to be below an explicitly governed existential-risk tolerance. A C3_CIVILIZATION_THREATENING pathway requires independent challenge, class-specific monitoring/controls, and sensitivity to a stricter corridor. This is an overlay inside TRC, not a sixth gate, and it prevents a bounded scalar from erasing the qualitative difference between severe, systemic, civilization-threatening, and existential outcomes.

8.5 CVaR Computation (Normative)

Let L(a) be the random loss induced by scenarios s with probabilities p_s.

Value-at-Risk: VaR_α[L(a)] = inf{z : P(L(a) ≤ z) ≥ α}

CVaR operational definition (Tier 1-3). For RippleLogic Tier 1-3 discrete scenario libraries, CVaR_α[L(a)] is the probability-weighted average loss over the worst β = 1−α probability mass, computed by the canonical discrete algorithm in Appendix D.7.

Continuous-case shorthand. In continuous loss distributions without probability mass at VaR, this corresponds to the familiar expression E[L(a) | L(a) ≥ VaR_α[L(a)]]. In discrete scenario sets with atoms at the VaR boundary, that shorthand is not controlling and MUST NOT override Appendix D.7.

The Appendix D.7 discrete tail-mass algorithm is normative, audit-replayable, and controlling for all finite Tier 1-3 scenario sets, including partial mass at the boundary scenario when required.

8.6 TRC Admissibility Predicate (Normative)

An option passes TRC if and only if:

CVaR_alpha[L(a)] <= tau_TRC, and every active class-specific cap or tolerance under Section 8.4A is satisfied, with no unresolved material C3 or C4 field.

Define:

A_adm = {a ∈ A_NCRC : TRC(a) = TRUE}

8.7 Default TRC Parameters by Context (Normative Defaults)

These are defaults; governance may tighten them. Loosening requires explicit governance justification and PCC recording.

High-alpha effective-maximum disclosure (Normative clarification). With discrete scenarios, CVaR_α equals the worst modeled loss whenever the worst-loss scenario probability is at least the tail mass 1-α. Under the mandatory scenario probability floor, this will commonly occur for α=0.99 or 0.999. This is an intended conservative limit, not an averaging result. The PCC MUST report the effective tail support, whether CVaR is numerically identical to the modeled maximum loss, and the consequence of that equivalence for the TRC result. A maximum-equivalent CVaR remains bounded by the declared scenario library and does not establish that every catastrophic pathway has been identified.

Low-alpha corridor interpretation (Informative clarification). In lower-stakes contexts such as the Personal default, the scalar CVaR corridor can be permissive for a very-low-probability severe modeled loss at the mandatory probability floor. The Section 8.4A severity-class overlay remains a separate conjunctive backstop: a material C3/C4 pathway does not become an ordinary pass merely because the scalar corridor passes. Where the overlay, rather than the scalar corridor, controls disposition, the PCC SHOULD say so explicitly. This clarification changes no alpha, tau_TRC, p_floor, or severity-class rule.

8.7A TRC Trigger Challenge and High-α Limit (Normative Clarification)

High-stakes Tier 2 and Tier 3 uses of TRC_NOT_TRIGGERED require an independent challenger disposition or documented infeasibility of independent challenge. Without that disposition, the strongest permitted claim is ASSUMPTION_BOUND and the run SHALL preserve a reopen trigger.

Discrete CVaR procedure. Normalize scenario probabilities, sort losses from highest to lowest, identify the boundary scenario at which cumulative probability reaches tail mass 1−α, take all probability mass above the boundary, take only the exact fraction of the boundary scenario required to fill the tail, and divide the resulting loss mass by 1−α. The sorted table, boundary index, partial boundary mass, and final value SHALL be retained.

High-α limit. When 1−α is smaller than the probability assigned to the worst modeled scenario, CVaR_α equals the worst modeled loss. At that setting TRC acts as a maximum-modeled-loss screen; probability improvements inside that worst scenario do not change CVaR until the tail boundary changes. This is conservative and SHALL be disclosed.

This clarification does not recalibrate α, p_floor, τ_TRC, severity classes, or corridor values. Any recalibration requires a versioned reference suite, sensitivity analysis, and independent review.

8.8 Tail Emergency Mode (Normative; replaces automatic TRC fallback)

If A_NCRC is non-empty but no rights-admissible option passes TRC, the ordinary selectable set is empty. The default response is redesign, delay, escalation, no-action review, or refusal. A least-CVaR option MUST NOT be automatically promoted into ordinary selection.

Tail Emergency Mode MAY be invoked only when the PCC demonstrates all of the following:

• redesign and materially safer alternatives have been actively attempted;

• delay, refusal, or no-action is unavailable or is evidenced to create equal or greater ruin exposure;

• an independent challenger has reviewed the emergency claim and proposed alternatives;

• a governed absolute maximum exposure τ_TRC_max has been declared and the provisional option does not exceed it;

• the action is time-bounded, scope-bounded, reversible where possible, and paired with mitigation, monitoring, shutoff, remedy/redress, and explicit exit criteria;

• one-tier-higher approval and lawful authority are recorded; and

• the decision will be reopened on a declared review cadence or immediately when a safer option becomes available.

Within the emergency candidate set that satisfies these conditions, choose the provisional option with minimum CVaR_alpha. Record TAIL_EMERGENCY_MODE_INVOKED, the CVaR deficit above τ_TRC, the absolute-cap margin, the necessity evidence, challenger record, controls, burden bearers, and return-to-normal trigger.

The result is TAIL_EMERGENCY_PROVISIONAL_ACTION. It is not TRC_PASS, SELECT, aligned, safe, or ordinarily admissible. Ordinary RLS ranking is prohibited in Tail Emergency Mode.

If no candidate remains below τ_TRC_max, RippleLogic MUST refuse the stronger action claim unless a separately authorized rights-and-tail emergency protocol with stricter public-law or domain controls governs the case. If both NCRC and TRC fail for every option, Section 7.5 rights priority governs first, while the Tail Emergency conditions in this section remain binding for any option that also exceeds the ruin corridor.

8.9 Anti-Gaming Requirements for TRC (Normative)

• Mandatory tail categories cannot be omitted without explicit implausibility justification per Section 8.3.2.

• Probability floors apply per category; they cannot be silently violated.

• Scenario sets must be comparable across options (same S, same p_s).

• PCC must record scenario provenance and how probabilities were assigned.

• Tier 2-3: if probabilities are highly uncertain, the PCC SHOULD include sensitivity over p_s (Tier 3 required).

SECTION 9: CSV GATE: CONTAINMENT AND STRUCTURAL VIABILITY

9.0 Purpose and UBE Rationale (Normative)

CSV means Containment and Structural Viability. CSV is the strengthened fourth public level in the five-level RippleLogic cascade inside the MathGov framework:

RG -> RF -> TRC -> CSV -> RLS

Public-language mnemonic:

Ground -> Protect -> Bound -> Contain/Verify -> Score

CSV prevents a core failure mode under Union-Based Reality: a local option can look beneficial for a sub-union while quietly degrading the larger system, capacity, relation, ecological support, institutional trust, or future choice-space that makes the benefit possible. Under Union-Based Ethics, such “gains” are not counted as system-level improvement when they materially degrade, hollow out, overload, or exploit their containing systems beyond tolerance.

CSV is therefore the selectability gate applied after NCRC and TRC and before final RLS ranking. CSV is not a sixth public level. It is the upgraded fourth level, replacing the older public label “Containment” with the more complete label “Containment and Structural Viability.” Structural Viability is no longer merely a quiet subcheck; it is explicitly visible inside CSV.

Core question:

Can this option deliver its claimed good without secretly breaking, hollowing, overloading, exploiting, or depending on the systems that make the good possible?

Plain-language rule:

CSV is not a purity filter. CSV is a reality-integrity filter.

9.1 CSV Non-Purity Rule (Normative)

A negative ripple is not automatically a CSV failure. Every real action carries some cost, burden, risk, or tradeoff. CSV MUST distinguish between detected harm, material residual harm, conditionable harm, redesign-trigger harm, and gate-failing harm.

CSV SHALL NOT demand zero harm. CSV SHALL demand that harms are not hidden, unbounded, structurally degrading, rights-adjacent without review, irreversible without authorization, dependency-producing without transition, or unjustly externalized onto affected unions.

Status categories:

Normative consequence:

RLS may rank ordinary residual tradeoffs among selectable options. RLS MUST NOT rescue an option that fails CSV.

9.2 CSV Status Ladder (Normative)

CSV outputs one of the following status values:

A CSV_PASS_WITH_CONTROLS is a pass only for the controlled option. If controls are removed, expire, fail, or are materially altered, CSV MUST be rerun.

A CSV_EMERGENCY_PROVISIONAL disposition MUST include a time limit, harm cap, monitoring plan, review trigger, and transition or remediation plan. It MUST NOT be marketed as full alignment, ordinary selectability, deployment certification, or Tier 4 validation.

9.2A CSV status resolver guide (Normative for Tier 3; recommended for Tier 2)

The following resolver constrains how evidence and diagnostics map into CSV statuses. It does not eliminate reviewer judgment, but reviewer judgment must be recorded against these routing rules.

Resolver precedence (Normative clarification). Ordinary PASS, PASS_WITH_CONTROLS and NOT_MATERIAL rows cannot override an applicable FAIL, REDESIGN_REQUIRED, ESCALATE or unresolved-evidence route. Established non-viable or beyond-tolerance harm controls over permissive rows. Where redesign and evidence escalation both apply, record both requirements and the controlling disposition; neither permits ordinary selectability until resolved. CSV_EMERGENCY_PROVISIONAL is a separate prerequisite-bound exception and never a less restrictive ordinary pass.

CSV maturity boundary. CSV may be binding in Tier 3 run-level conformance using declared provisional structural indicators, but this does not imply cross-domain validated UCI/HOI measurement, ProofPack readiness, or machine-verifiable structural truth. UCI/HOI remain diagnostics unless and until separate validation artifacts establish stronger measurement status.

9.3 CSV Core Tools (Normative)

CSV uses five core tools. Implementations MAY add domain-specific tools, but MUST preserve the five core functions when material.

9.3.1 Containing-System Map

Identify the systems that hold, sustain, receive, or absorb the option’s consequences. Relevant systems MAY include persons, households, communities, organizations, institutions, infrastructure, ecology, attention, trust, labor capacity, knowledge systems, public legitimacy, supply chains, financial reserves, legal authority, and future option-space.

Minimum questions:

• What local good is the option claiming?

• Which union receives the local gain?

• Which larger unions contain or sustain that gain?

• What capacities, relations, resources, and ecological supports does the option depend on?

• What systems receive spillover costs?

• Which affected groups can contest, consent, or recover?

9.3.2 Structural Viability Check

Structural Viability asks whether the option can actually stand in the declared reality surface. Ethical attractiveness is not enough. A desirable option may be a design target while still failing current execution viability.

Minimum subchecks:

An option with material SVC failure is not selectable for current execution, regardless of RLS rank.

9.3.3 Externality Containment Ledger

CSV MUST make spillovers visible. For material runs, the PCC SHOULD include an ExternalityContainmentLedger with at least:

Unrecorded material externalities are not neutral. They create CSV uncertainty and may trigger CSV_ESCALATE or CSV_REDESIGN_REQUIRED.

9.3.4 Substitution Ladder

CSV MUST ask whether a less harmful feasible alternative exists. The ladder is not a requirement to choose the ideal option immediately; it is a discipline against convenience-based harm.

Default substitution ladder:

• Avoid the harmful need.

• Reduce the demand.

• Use low-harm alternative.

• Use hybrid/backup alternative.

• Use higher-harm option only with controls.

• Use emergency provisional option only under necessity and review.

• Reject or redesign if harms cannot be contained.

If a materially cleaner and feasible alternative exists, choosing a more harmful option for convenience, profit, or status SHOULD trigger CSV_REDESIGN_REQUIRED or a high residual RLS penalty, depending on severity.

9.3.5 Necessity Corridor

A harmful option MAY receive CSV_PASS_WITH_CONTROLS or CSV_EMERGENCY_PROVISIONAL only when it satisfies the necessity corridor:

The necessity corridor prevents CSV from becoming impossible purity ethics while preserving its ability to block structural laundering.

9.4 CSV Diagnostic Concern Scale (Normative guidance)

CSV MAY use internal diagnostic concern levels. These levels are not an RLS score and MUST NOT be treated as final welfare ranking.

Suggested diagnostic dimensions:

• Containment integrity

• Structural viability

• Hollowing risk

• Dependency or lock-in risk

• Substitution pressure

• Mitigation adequacy

• Monitoring adequacy

• Reversibility / exit

• Accumulation risk

• Governance or legitimacy stress

Default status rule:

If any material diagnostic = 4, CSV_FAIL. If any material diagnostic = 3, CSV_REDESIGN_REQUIRED or CSV_ESCALATE. If any material diagnostic = 2, CSV_PASS_WITH_CONTROLS only if controls are binding and auditable. If all material diagnostics are 0 or 1, CSV_PASS and residuals carry to RLS.

9.5 Formal CSV Predicate (Normative)

Let A_adm be the set of options that pass NCRC and TRC, subject to Reality Grounding supporting the claim boundary.

For each option a in A_adm, compute CSV_status(a).

Default selectable set:

A_sel = {a in A_adm : CSV_status(a) in {CSV_PASS, CSV_PASS_WITH_CONTROLS, CSV_NOT_MATERIAL}}

Emergency provisional options are not ordinary members of A_sel. A CSV_EMERGENCY_PROVISIONAL option may be temporarily selected only through emergency protocol, with explicit time limit, harm cap, mitigation, review, and no full alignment claim.

CSV_NOT_MATERIAL is pass-equivalent only for the declared claim boundary after the PCC records the rationale that no material CSV burden is present. It MUST NOT be used to waive Structural Viability subchecks when execution feasibility, resource closure, dependency closure, reversibility, operational capacity, or internal coherence is material. In high-stakes or execution-bearing runs, CSV_NOT_MATERIAL may apply to the containment-integrity dimension while Structural Viability remains separately required where execution feasibility is material. If later evidence makes CSV material, CSV MUST be rerun.

RLS is applied only to A_sel, except where emergency protocol explicitly invokes fallback comparison.

9.6 UCI, HOI, and Structural Diagnostic Placement (Normative)

CSV is the authority layer for cross-scale structural integrity. UCI, HOI, Adaptive Reserve, and related structural indicators are diagnostic instruments. When such indicators are material to whether an option degrades a containing union, hollows out capacity, creates dependency, or undermines structural viability, they are evaluated inside CSV before RLS.

UCI/HOI are not public cascade stages. They are not separate gates by default. They are structural diagnostics inside CSV when material, and residual tie-break or monitoring signals only after options are already selectable and RLS is tied, close, uncertainty-overlapped, or non-decisive.

If UCI/HOI or equivalent structural diagnostic evidence is required for a CSV determination and unavailable, the implementation SHALL record CSV_STRUCTURAL_DIAGNOSTIC_UNAVAILABLE or the more specific CSV_UCI_HOI_UNAVAILABLE flag. A run with unresolved material diagnostic unavailability SHALL NOT claim an unqualified CSV pass or Tier 3 CSV conformance.

9.7 CSV Fail Conditions (Normative)

CSV MUST fail, redesign, or escalate an option when any of the following are material and unresolved:

• Container destruction: the option damages the system that makes the claimed benefit possible.

• Forced externalization: the option works by pushing burden onto people, ecosystems, or future agents who cannot consent, contest, or recover.

• Structural non-viability: the option cannot execute under real resource, dependency, capacity, authority, or contradiction constraints.

• Hollowing: the option improves surface metrics while weakening the deeper capacity the metric was meant to serve.

• Lock-in or dependency: the option creates avoidable dependency that makes better futures harder.

• Unbounded accumulation: individually small harms scale into systemic degradation when repeated.

• Unmonitored invisible harm: material harms exist without monitoring, audit, review, or feedback path.

• Better feasible alternative ignored: a much cleaner or safer feasible option exists, but the harmful option is chosen for convenience, status, or profit.

9.7A Distributional Burden and Non-Erasure Review (Normative)

When Section 2.4A is triggered, CSV MUST create a DistributionalBurdenReview before the selectable set is formed. The review is a record feeding the existing CSV state machine; it does not create a new gate or a new pass-equivalent CSV verdict.

The review SHALL evaluate severity, incidence, concentration, duration, recurrence, reversibility, remedy, ability to consent/contest/exit/recover, forced externalization, invisible or unmonitored burden, constitutive mitigation, accountable carrier, monitoring, and materially less-harmful feasible alternatives.

CSV_PASS is available only when the burden is bounded within the declared tolerance and no constitutive controls are required. CSV_PASS_WITH_CONTROLS is available only for the controlled option. CSV_REDESIGN_REQUIRED applies where a materially less-harmful feasible alternative or redesign exists. CSV_ESCALATE applies where evidence or authority is insufficient. CSV_FAIL applies to uncontained, beyond-tolerance, forced, invisible, unrecoverable, or structurally degrading burden.

A population mean MUST NOT be the sole basis for clearing a severe concentrated burden. If every feasible option imposes severe unavoidable burden, the run SHALL identify the least-harm selectable option, make mitigation and remedy constitutive, preserve representation and appeal, record residual-harm authorization separately, and maintain transition/review triggers.

CSV_NOT_MATERIAL is unavailable where any of the following is plausibly material: irreversibility; severe third-party externality; uncontrolled dependency; rights-adjacent exposure; material lock-in; unbounded accumulation; inability to consent, contest, exit, or recover; or a challenger-supported distributional omission. A contrary disposition requires independent reviewer rationale.

9.8 CSV Pass Conditions (Normative)

CSV MAY pass an option when harms are visible, rights floors are intact, tail risk is bounded, containment burden is limited, structural viability is real, externalities are mitigated, residual harms are carried into RLS, monitoring exists where needed, lock-in is avoided or justified, better alternatives are unavailable or disproportionate, and transition or review plans exist where material.

Plain-language test:

Harm does not equal fail. Hidden, unbounded, unjust, irreversible, or structurally degrading harm equals fail, redesign, escalation, or emergency provisional treatment.

9.8A Binding-control and obligation-integrity condition (Normative)

A CSV_PASS_WITH_CONTROLS is claimable only when every selectability-material control satisfies Section 4.10A. Controls that are promised, unowned, under-resourced, unmonitored, consequence-free, dependent on silent carrier compensation, or alterable without governed change control SHALL NOT upgrade CSV status. If carrier nonperformance, control expiry, or unauthorized control modification would leave a material harm uncontained, the option must be redesigned, escalated, suspended, or failed according to severity and available alternatives.

9.8B Human-compensation-load diagnostic (Normative when triggered)

CSV SHALL test hidden human compensation when current performance, proposed automation, scaling, outsourcing, or role removal could conceal a dependency on undocumented judgment or recovery work. A bounded and supported human contribution may remain part of a viable design. A material, unrecorded, involuntary, saturated, single-carrier, or non-substitutable compensation burden requires binding controls, capacity restoration, documentation, redistribution, redesign, escalation, or failure. This diagnostic remains inside CSV and does not create a new gate or presume that all human adaptation is undesirable.

9.9 Worked Normative Example: Backup Diesel Generator (Informative but Canon-Guiding)

A small organic cafe may need a backup diesel generator during power cuts. The generator produces smoke, noise, local air pollution, and emissions. Without it, the cafe may lose food, income, jobs, community function, and operational continuity.

CSV MUST NOT treat this as an automatic fail merely because harm exists. CSV MUST also not allow the cafe’s local survival benefit to hide uncontained harm.

Illustrative dispositions:

Canonical lesson:

CSV is not “diesel bad, therefore fail.” CSV is “diesel carries a containment burden; if necessary, bounded, mitigated, transparent, monitored, and transitional, it may conditionally pass and be ranked against cleaner options by RLS.”

9.9A Qualified Controls, Timing and Recovery (Normative)

A qualified control envelope is the existing control/obligation record made explicit: control and option identity, hazard/endpoint, trigger, scope, accountable authority, operational carrier, capacity and resources, response-time bounds, effectiveness evidence and uncertainty, dependencies, failure modes, reversibility, residual harms, expiry, fallback and outcome verification. Where a field already exists, reference it rather than create a competing status object. The control is constitutive of the option; crediting it changes the option and requires the affected prior checks.

Runtime prevention credit requires evidence that the control can reach the required safe state before the earliest unacceptable endpoint under the declared credible timing bounds. A useful conservative test is T_control_upper+margin<T_harm_lower. The margin and bounds are governed domain inputs, not universal constants. Failure of this test forbids claiming timely prevention of that endpoint; it does not imply that all later mitigation, recovery or independent ex-ante protection has zero value. Credit those different endpoints separately when supported.

Effectiveness eta in [0,1] and residual transmission psi=1-eta are permitted explanatory parameters only for a specified controllable pathway with adequate warrant. A generic equation, boolean shield flag, cryptographic key or high shock velocity cannot reduce real loss. Unknown effectiveness receives no asserted protective discount for the decision-critical endpoint. Reserve benefits require units, accessible capacity, consumption/depletion and replenishment evidence. Do not multiply multiple controls as independent without support, conceal costs or externalized burdens, or let private reserves determine entitlement to protection.

Observability, available intervention capacity and authority SHALL be distinguished. Adequate observation and control are task-, endpoint-, horizon- and configuration-specific; global full-state observability or controllability is not a universal prerequisite for a particular safe stop. Monitoring alone is not control, and a stop button alone does not prove a feasible timely safe state.

Recovery proposals must pass applicable RG, RF/NCRC, TRC and CSV, with separately bound authority and execution controls. Maintain observation, proposed action, authorization, attempt and verified outcome as separate records. Repeated delivery, retries, restarts or failover must not multiply an authorized real-world intervention. Unknown execution outcome requires reconciliation rather than blind retry; an opposite-signed score is not an inverse physical intervention.

9.10 RLS Relationship (Normative)

RLS ranks only options that survive RG claim support, the Rights Floor (formal NCRC), TRC, and CSV. Decision-material residual welfare consequences identified during CSV SHOULD be represented once through their ordinary evidenced EffectTokens and RLS cells, including pollution, dependency, lock-in, ecological burden, social trust loss and meaning/agency degradation. Do not add a separate CSV penalty for a consequence already included in the residual field; failed qualification remains outside ordinary RLS.

RLS MUST NOT rescue CSV failure. CSV protects the doorway into ranking; RLS ranks what may legitimately enter.

9.11 CSV Parameter Governance and Escalation (Normative)

CSV thresholds, diagnostic concern levels, necessity-corridor judgments, UCI/HOI trigger thresholds, and structural-viability sufficiency standards MUST be recorded in the PCC when material. Tier 3 runs SHOULD include sensitivity analysis over near-binding CSV determinations.

If no option passes CSV, the run MUST NOT pretend a good option exists. Required actions include option redesign, additional evidence gathering, transition planning, escalation to a higher governance tier, emergency provisional protocol if genuinely necessary, or refusal of deterministic selection.

CSV does not override NCRC or TRC. It operates after admissibility and before residual welfare ranking.

SECTION 10: OPTIMIZATION LAYER: RIPPLELOGIC SCORE (RLS)

10.0 Purpose and Scope (Normative)

RLS ranks selectable options by expected welfare improvement across unions and dimensions, after ripple propagation and saturation, under declared weights and applicability mask rules.

RLS MUST NEVER override NCRC, TRC, or CSV. It operates only on selectable options A_sel.

10.0A RLS Claim Boundary and Profile-First Reporting (Normative)

RLS ranks selectable options through a bounded, governance-defined, constitution-conditional residual welfare-impact index under the declared evidence, effect representation, reference structure, baseline, probability semantics, temporal treatment, welfare-inclusion hypotheses, uncertainty model, applicability mask, interaction assumptions, and weight constitution.

RLS does not establish a natural quantity of total welfare, interpersonal utility, universal cross-substrate value, risk-adjusted expected utility, moral truth, or an unconditional ethically best option. A common numerical range is not proof of a common cardinal welfare unit.

Profile-first rule. Before the scalar summary, claim-bearing reports SHALL show the 7×7 profile, active and non-maskable cells, subgroup and lower-tail findings, worst materially affected groups, uncertainty and dependence posture, evidence maturity, reference/baseline family, weight-profile status, material sensitivities, and any incomparability or non-decisiveness.

The point-score leader, framework-selected option, authority-selected option, and execution-authorized action are four distinct states and MUST NOT be collapsed.

10.1 Normalized RLS Definition (Normative)

Define the effective residual cell weight:

q(u,d) = w_u · v_d · m(u,d) · κ(u,d)

Weight-separability assumption (Normative disclosure). The reference construction factorizes scope prominence and dimension prominence through w_u · v_d, with κ(u,d) available only as a bounded, declared interaction correction. This is a transparent model assumption, not an empirically validated claim that scope and dimension importance are universally separable. Tier 3 and decision-material or high-stakes Tier 2 runs MUST test a plausible non-separable cell-weight matrix or bounded interaction alternative whenever scope-by-dimension interaction could materially change ranking or decisiveness. If the result changes, set the applicable sensitivity/review state and treat deterministic selection as unresolved until governed review is completed.

and the active effective mass:

Q = Σ_u Σ_d q(u,d)

For Q > 0:

RLS(a) = [Σ_u Σ_d q(u,d) · I_prop_welfare(u,d,a)] / Q

If Q = 0, RLS is undefined. Return RLS_NO_ACTIVE_MASS, repair the mask/weight declaration, narrow the claim, or refuse deterministic ranking; zero MUST NOT be imputed.

Constructed-index caution (Normative claim boundary). RLS is a bounded, governance-defined index over declared, baseline-relative welfare-impact judgments. It is not a natural welfare unit, an interpersonal utility meter, empirical validation of the 7×7 structure, or a scalar proof of moral truth. Its arithmetic is authoritative only within the declared model and selectable set, with evidence status, uncertainty, weighting authority, subgroup visibility, and sensitivity disclosed.

Where:

• w_u are union weights (HDW-governed; Section 13; Section 13.1 constitutional floors controlling)

• v_d are dimension weights (HDW-governed; Section 13; Section 13.1 constitutional floors controlling)

• m(u,d) is the applicability mask for RLS aggregation only

• κ(u,d) is a declared positive cell multiplier, default 1

• I_prop_welfare(u,d,a) is the post-propagation, post-saturation welfare impact

Normalization by Q preserves the public interpretation of RLS within [-1,+1] when cell impacts lie within [-1,+1], including when masks or non-default κ values change the active effective mass.

κ(u,d) governance rule (Normative). The default is κ(u,d) = 1. Non-default κ(u,d) values are permitted only for pre-declared, governance-approved cell-level emphasis that does not alter admissibility semantics. Unless a stricter charter rule is declared, κ(u,d) MUST remain positive and bounded within [0.5,1.5]. A non-default κ(u,d) MUST NOT reverse sign, erase or dilute rights-covered or catastrophe-relevant harm, or function as a back-door mask, rights-floor rewrite, or prominence override. Tier 3 runs using non-default κ(u,d) MUST record justification, authorized source, affected cells, Q, and sensitivity reruns in the PCC.

Local-use note (Informative). Section 10.2A defines a Practical Local Scope Scoring profile. PLSS preserves the same normalized equation and constructs w_u within the residual mass above constitutional floors.

10.1A Exact Contribution Decomposition and Notation (Normative clarification)

Using the canonical effective cell weight q(u,d)=w_u v_d m(u,d) kappa(u,d) and Q=sum_(u,d) q(u,d), define C_ud(a)=q(u,d) I_prop,welfare(u,d,a)/Q for Q>0. Then RLS(a)=sum_(u,d) C_ud(a)=sum_u C_u(a)=sum_d C_d(a), where C_u=sum_d C_ud and C_d=sum_u C_ud. These are alternate decompositions of the same score; adding the row and column totals together would double count it.

The Contribution Matrix SHALL be available for a reported numerical RLS, together with the active-cell basis, unrounded values, rounding policy and the governing weight profile. Report gross positive and gross negative final-cell contributions where useful; their sum is RLS, but they do not recover harms hidden by within-cell netting. Preserve effect-level and subgroup findings separately. A display of 100 times RLS is a rescaled index, not a percentage of alignment, safety, welfare delivered or ethical correctness.

The cell decomposition is exact algebra; causal-source attribution through tanh, interaction models or other nonlinear transforms is not automatically additive. Report source contributions before saturation or use a named, assumption-disclosed attribution method. Do not present invented causal percentages. UNKNOWN is not a number and cannot be repaired by an attractive color, clipping or a zero-filled chart.

K denotes the propagation matrix when used as a matrix; K(u,d,a) remains the existing set-of-impact-instances notation where explicitly indexed as a set. The probability-ownership and scenario-first rules, confidence sensitivities, rights/base versus welfare streams, normalization, every-contender discrimination and authority separation are unchanged.

10.2 Applicability Mask Rules (Normative)

Masking exists to avoid meaningless aggregation in some contexts, but is a primary gaming vector. Therefore:

Definition (Normative). Masking means setting m(u,d)=0, which affects RLS aggregation only. Omission/exclusion means failing to compute, disclose, or evaluate a required cell for NCRC, TRC, or CSV. Masking SHALL NOT be used as a substitute for omission rules.

Masking affects RLS aggregation only. Whether a cell must be constructed is determined by active-cell rules (Section 10.3) and tier coverage requirements, not by masking. Accordingly, masking MUST NOT be used to skip or modify:

• Impact construction (Section 5),

• Propagation (Section 6),

• NCRC checks (Section 7),

• TRC loss and CVaR computation (Section 8),

• Or containment evaluation (Section 9).

Non-maskable cells (MUST be unmasked):

• All rights-covered cells in any C_r

• All catastrophe cells in C_cat

Non-maskable persistence rule (Normative). Rights-covered cells remain non-maskable even after NCRC admissibility filtering. This prevents post-gate dilution and preserves rights-salience when ranking admissible options, especially under adversarial pressure and Goodhart dynamics.

Rationale (Informative). The admissibility gates prevent selecting options that violate non-compensatory rights floors, but they do not by themselves prevent near-miss normalization among admissible options. Keeping rights and catastrophe cells in RLS aggregation preserves continuous optimization pressure toward larger safety margins, reduces proxy gaming pressure (for example, satisfying a threshold while degrading adjacent rights conditions), and makes rights and tail-risk performance legible for governance review and accountability.

Baseline consistency for non-maskable gate cells (Normative). For any cell in C_r or C_cat that remains included in RLS under the non-maskable persistence rule, the welfare-stream baseline SHALL also use the gate floor-reference baseline unless a governed dual-baseline method is explicitly declared. Where a dual-baseline method is declared, the floor-reference value SHALL remain the controlling value for gate-consistency interpretation and validator conformance.

Nonlinear baseline-sensitivity boundary (Normative clarification). Because cell impacts are saturated nonlinearly, shifting from STATUS_QUO to FLOOR_REFERENCE is not guaranteed to add a rank-neutral constant across options. RLS values for non-maskable cells using FLOOR_REFERENCE therefore describe movement relative to the rights-safe or safe-corridor reference, not ordinary net change from status quo. Tier 3 and high-stakes Tier 2 runs MUST report a governed status-quo counterfactual for ranking whenever a defensible status-quo welfare baseline exists and the baseline choice could alter ranking or decisiveness. If ordering changes, the run is BASELINE_RANK_SENSITIVE; the floor-reference result remains controlling for gate consistency, but deterministic residual selection MUST be narrowed, escalated, or routed to accountable authority rather than presented as baseline-invariant.

• Any cells mandated by minimum governance coverage for the run (declared in PCC; default includes at least U₁, primary affected unions, and U₇ Environment when environmental relevance exists)

Audit rule: If any non-maskable cell is masked, set audit_flag RIGHTS_CELL_MASKED_INVALID (or CATASTROPHE_CELL_MASKED_INVALID) and PCC is INVALID.

10.2A Practical Local Scope Scoring (PLSS) (Normative)

Purpose. PLSS specifies a canon-consistent local-use profile for RippleLogic Score (RLS) when a decision is primarily local in its direct effects, but broader scopes remain morally relevant as rights, tail-risk, and containment guardrails. PLSS allows routine decisions to concentrate most residual welfare-ranking attention on the scopes that are actually live in the decision, without weakening NCRC, TRC, CSV, non-maskable cell rules, or Section 13 constitutional weight floors.

Interpretive anchor (Informative). Union Scopes are not a closed list of who matters. They are the stable scopes of aggregation and accountability used by the framework. Stakeholder instances feed the scopes; the scopes ensure that impacts do not disappear.

Terminology lock (Informative). LSS names the upstream stakeholder object, PLSS names the residual weight-construction procedure used within RLS, and FLGG - Focus Local, Guard Global - names the governing design principle.

10.2A.0 Attention-Safety Separation Principle (Normative, architecturally grounded). PLSS operates only within the residual welfare-ranking layer. Admissibility under RF/NCRC, TRC, and CSV SHALL remain invariant under any valid PLSS weight construction satisfying Sections 10.2A.4-10.2A.6. Therefore, a change in PLSS prominence declarations or PLSS weight allocation SHALL NOT convert an inadmissible option into an admissible option. This principle follows from the lexicographic separation of admissibility gates from the welfare-ranking layer.

PLSS does not determine who matters; it determines how residual welfare-ranking attention is distributed after universal admissibility conditions have already been imposed.

10.2A.1 Relation to existing gates (Normative)

PLSS applies only to welfare ranking within Section 10. It SHALL NOT alter:

• NCRC evaluation over the required rights coverage sets C_r,

• TRC evaluation over the catastrophe cell set C_cat,

• Containment requirements under Section 9,

• non-maskable cell requirements under Section 10.2,

• constitutional weight floors defined in Section 13.1.

A PLSS run therefore remains:

• full-scope for admissibility, where required by RF/NCRC, TRC, and CSV,

• local-scope only in residual welfare emphasis, after admissibility has been preserved.

Structural diagnostic preservation under PLSS (Normative). PLSS SHALL NOT down-weight, omit, mask, or defer structural diagnostic evidence required for Containment. If a local-scope run uses PLSS but plausible containment-relevant UCI/HOI, Adaptive Reserve, lock-in, hollowing, governance-spillover, ecological-spillover, or institutional-capacity evidence exists outside the prominent scopes, that evidence remains admissibility-relevant. The run SHALL escalate, broaden scrutiny, or refuse the stronger local-scope claim when containment-relevant structural evidence is unavailable or unresolved.

10.2A.2 Prominent scopes and guardrail scopes (Normative)

For a declared run, each operational Union Scope u ∈ {U1, …, U7} may be classified in the PCC as one of the following:

• Prominent scope: a scope whose direct or near-field ripple is substantial enough that it should receive meaningful residual welfare weight in the current run.

• Guardrail scope: a scope whose direct ripple in the current run is limited, but which remains protected by constitutional floor weight and by admissibility constraints.

Guardrail scope classification SHALL NOT be interpreted as moral irrelevance. A guardrail scope may carry little or no residual weight in a local run, but it remains:

• constitutionally represented through Section 13 floors,

• admissibility-relevant where rights, catastrophe, or containment conditions apply.

10.2A.3 Representation rule: instances first, scopes second (Normative)

PLSS SHALL preserve the Section 2.2A and Section 5 representation architecture:

• stakeholder discovery is performed at the instance level,

• instances are mapped to one or more Union Scopes,

• impacts are aggregated within each scope row,

• scope rows are then combined by RLS.

Let I_u denote the declared stakeholder instance set mapped to scope u.

For non-rights scoring, the default aggregation rule remains the canonical population-weighted mean across affected instances:

I_agg(u,d,a) = [ Σ_(i ∈ I_u) π_i · I_i(u,d,a) ] / [ Σ_(i ∈ I_u) π_i ]

where π_i is the declared aggregation weight for instance i, for example population share, exposure share, or another declared ReachBasis-consistent basis.

For rights-covered cells, aggregation SHALL NOT average away the worst-off subgroup. Rights evaluation remains governed by the worst-off subgroup operator:

I_rights(u,d,a) = min_(g ∈ G_(u,d)) I_g(u,d,a)

This subsection does not change Section 7 semantics.

10.2A.4 Local prominence signal and residual allocation rule (Normative)

PLSS introduces a declared local prominence signal q_u for each scope u, used only to distribute the residual union-weight mass that remains after constitutional floors.

Each q_u SHALL be recorded in the PCC and SHALL be justified by reference to the current decision context. A recommended default construction is a declared combination of:

• expected magnitude of ripple in scope u,

• probability that the effect materializes,

• temporal persistence or duration,

• propagation potential beyond immediate contact.

A recommended default operator is:

q_u = ψ(M_u, P_u, T_u, G_u)

with M_u, P_u, T_u, G_u ∈ [0,1], and a default transparent choice:

ψ(M_u, P_u, T_u, G_u) = (M_u P_u T_u G_u)^(1/4)

This recommended operator is informative by default unless separately elevated by governance rule; the required part is that the PCC declare the operator used.

Prominence evidence discipline (Normative). Prominence sub-component declarations for q_u, including magnitude, probability, temporal persistence, and propagation potential, are subject to the same PCC justification and evidence documentation discipline that applies to impact-instance parameters under Section 5.2, including ReachBasis declaration where applicable. Tier 2+ runs SHALL record the evidentiary basis used to justify each declared prominence component.

Cross-deployment comparability note (Normative guidance). The geometric-mean operator remains the default comparability anchor for q_u. Any deployment using a non-default operator MUST document why the operator preserves anti-gaming discipline, boundedness, and monotonicity, and SHOULD include a sensitivity comparison against the geometric-mean default in the PCC or companion validation record.

Define residual shares:

ρ_u = q_u / Σ_j q_j, if Σ_j q_j > 0

If all q_u = 0, the residual SHALL be allocated uniformly unless another declared fallback is specified in the PCC.

Let w_u^floor be the Section 13.1 constitutional floor for scope u. Then the PLSS union weights are:

w_u^PLSS = w_u^floor + (1 - Σ_j w_j^floor) ρ_u

subject to the canonical constraints:

w_u^PLSS ≥ 0

Σ_u w_u^PLSS = 1

w_u^PLSS ≥ w_u^floor

for every scope u.

Interpretation (Informative). PLSS does not re-write the constitution. It lets local runs place most of the residual emphasis on nearby scopes while retaining the constitutional baseline presence of broader scopes.

10.2A.5 PLSS RLS equation (Normative)

For any selectable option a ∈ A_sel, the local-scope welfare ranking is:

q_PLSS(u,d) = w_u^PLSS · v_d · m(u,d) · κ(u,d)

Q_PLSS = Σ_u Σ_d q_PLSS(u,d)

RLS_PLSS(a) = [Σ_u Σ_d q_PLSS(u,d) · I_prop_welfare(u,d,a)] / Q_PLSS, for Q_PLSS > 0

where:

• w_u^PLSS is defined by Section 10.2A.4,

• v_d remains governed by Section 13,

• m(u,d) remains governed by Section 10.2,

• κ(u,d) remains governed by Section 10.1,

• I_prop_welfare(u,d,a) remains governed by Sections 5–6.

If no kernel propagation is declared, then:

I_prop_welfare(u,d,a) = I_dir(u,d,a)

per the existing NONE propagation pathway.

10.2A.5A Discrimination threshold and non-decisive handling (Normative). The discrimination threshold defined in Section 10.4 applies identically to RLS_PLSS. If the lead against any other selectable option is non-decisive under the declared uncertainty method, the tie-break chain in Section 11.5 MUST be applied. PLSS SHALL NOT bypass uncertainty handling, decisiveness testing, or tie-break governance.

10.2A.5B PLSS prominence sensitivity (Normative)

When PLSS is used in Tier 3, the PCC MUST rerun the welfare ranking under at least two alternative valid prominence constructions:

(i) the uniform residual fallback, and

(ii) a broadened guardrail-sensitive vector in which every scope classified Guardrail receives q_u at least 0.10 times the maximum q_u among prominent scopes, unless a stricter charter rule is declared.

If the ranking order of selectable options or the selected option changes under these alternative valid prominence constructions, the run MUST set audit flag PLSS_PROMINENCE_SENSITIVE and document the sensitivity in the PCC.

When OTHER_DECLARED uses a direct-q normalization such as DIRECT_Q_NORMALIZATION_V1, the published sensitivity bundle MUST show at minimum: the declared direct-q result; the default geometric-mean prominence result; the uniform-residual fallback; and a broadened guardrail-sensitive result where plausible wider-scope effects are increased. The PCC MUST state whether ranking, decisiveness, or authority selection changes under each construction.

This requirement does not alter admissibility, which remains governed by the Attention-Safety Separation Principle and the upstream gates.

10.2A.6 Masking and non-maskable rule under PLSS (Normative)

PLSS SHALL NOT modify the Section 10.2 mask rule.

In particular:

• masking remains RLS aggregation only,

• masking SHALL NOT be used as omission,

• rights-covered cells and catastrophe-relevant cells remain non-maskable where required by the canon,

• reduced-scope or local-scope presentation SHALL NOT bypass admissibility on required cells.

Thus PLSS narrows practical emphasis, not moral coverage.

10.2A.7 Escalation triggers (Normative)

A run SHALL NOT remain in PLSS-only posture, or SHALL be rerun with broader scrutiny, if any of the following are plausible:

1. rights-covered harm beyond the prominent scopes,

2. catastrophe relevance or irreversible loss,

3. meaningful externalities crossing Community, Organization, Polity, Humanity / Global Coordination, or Biosphere pathways,

4. lock-in, precedent, or nontrivial governance spillover,

5. a credible challenger claim that a stakeholder class or scope was omitted,

6. Containment requires unavailable evidence for containing scopes,

7. repeated comparable runs continue to use local-scope framing without the required next-run expansion plan.

Audit flag (Normative). If one or more escalation triggers in Section 10.2A.7 is plausibly active, but the run proceeds in PLSS posture without escalation or documented justification, implementations MUST set audit flag PLSS_ESCALATION_TRIGGER_UNRESOLVED with severity ESCALATE. The PCC MUST then either record the broader posture adopted or provide a specific justification for non-escalation, including evidence basis and reviewer sign-off where required by tier. If no such disposition is recorded, the validator MUST reject the run as non-conformant.

Boundary heuristic note (Normative guidance). Implementations MAY use lightweight pre-screen heuristics to decide whether FLGG escalation is required before full local scoring proceeds, for example trigger scans over rights exposure, catastrophe relevance, cross-scope externality breadth, lock-in, precedent, and containment-evidence availability. Any such heuristic is advisory only: once a trigger is plausibly active, the canonical escalation requirements of Section 10.2A.7 control.

Ex ante method declaration rule (Normative). Any method choice that can materially affect decisiveness, ranking within the selectable set, or tie-break outcome, including PLSS prominence construction, alternative PLSS operator, scope-posture escalation disposition, and UCI comparison method, SHOULD be declared ex ante in the PCC where practicable. If first declared only after comparative outcomes are observed, the PCC MUST record a reason code, reviewer sign-off where required by tier, and a sensitivity note sufficient for independent review.

Scope posture classification note (Normative). When PLSS is used, each scope SHALL be classified in the PCC as either Prominent or Guardrail. v9.0 removes the undefined “Mixed” category to reduce audit drift; if a deployment wants finer descriptive language, it MAY add non-canonical comments, but the PCC classification field SHALL remain binary.

10.2A.8 Plain-language reading rule (Normative)

When not to use PLSS (Normative guidance statement). PLSS is intended primarily for local or moderately bounded decisions in which direct welfare effects are concentrated and no escalation trigger is plausibly active at the outset. PLSS SHALL NOT be used as the primary posture for irreversible cross-border policy, large-scale public AI deployment, biosecurity governance, active military or security operations, high-lock-in infrastructure decisions, or any case in which ET-1 through ET-7 is plausibly active at decision entry. Such cases require a broader deliberative posture or higher-tier structured evaluation.

For instructional and public-facing use, the framework MAY describe PLSS with the following plain-language sentence:

“In local decisions, score most strongly where the ripple is near, but keep every wider scope present through floors and guardrails. PLSS narrows residual attention, not moral coverage. It MAY change welfare ranking within the selectable set, but it MUST NOT make an inadmissible option admissible.”

This sentence is interpretive only and SHALL NOT override the equations above.

10.2A.9 Worked example: family café local run (Informative)

Decision. A family café must choose between:

• Option A: cheap single-use cups,

• Option B: reusable deposit-return cups with a local wash partner,

• Option C: ultra-cheap cups from an unverified supplier with plausible toxic-material or labor-abuse exposure.

Declared stakeholder instances by scope:

• U1 Self: 1 instance

• U2 Household: 1 instance

• U3 Community: 5 instances

• U4 Organization: 2 instances

• U5 Polity: 3 instances

• U6 Humanity / Global Coordination: 1 instance

• U7 Biosphere: 1 instance

This run illustrates the distinction between instances and scopes. The café does not score Community in the abstract. It scores the affected Community instances, then aggregates them into the U3 row.

Declared local prominence signals:

q = (U1,U2,U3,U4,U5,U6,U7) = (0.95, 0.85, 0.55, 0.50, 0.10, 0.03, 0.02)

These sum to 3.00.

Under Section 13.1, the union floors are:

w^floor = (0.20, 0.06, 0.06, 0.06, 0.08, 0.10, 0.10)

The floor total is 0.66, so the residual is 0.34. The resulting PLSS weights are:

w^PLSS ≈ (0.308, 0.156, 0.122, 0.117, 0.091, 0.103, 0.102)

Interpretation. Self, Household, Community, and Organization receive most of the residual attention. Polity, Humanity / Global Coordination, and Biosphere remain meaningfully present because the current constitution keeps them above zero even in local runs.

Table 10-1. Illustrative local prominence signals and PLSS union weights

Illustrative scope-level welfare composites:

Table 10-2. Illustrative scope composites by option

Then:

RLS_PLSS(A) ≈ 0.0656

RLS_PLSS(B) ≈ 0.2444

So Option B wins on welfare ranking among selectable options.

Worked-example uncertainty note. The raw RLS_PLSS values shown in this example do not by themselves determine final selectability. Under the declared uncertainty method, the lead against every other selectable option SHALL be tested against the Section 10.4 discrimination threshold. If the result is non-decisive, the Section 11.5 tie-break chain applies. This example is intended to illustrate PLSS weight construction and score propagation, not to waive the framework’s general decisiveness discipline.

Admissibility note. If Option C carries plausible rights-floor or catastrophe concerns through toxic exposure or abusive supply-chain conditions, it may fail NCRC or TRC before RLS ranking. If so, it is not saved by local convenience or low cost.

Lesson (Informative). PLSS does not say “ignore broader scopes.” It says: let local decisions place most additional attention where the ripple is near, while still preventing local gain from laundering wider harm.

10.2B Comparison Mask and Active-Cell Symmetry (Normative)

The applicability mask and comparison active-cell set are run-level comparison declarations. The same m(u,d) and comparison-cell basis SHALL be applied across all options being ranked.

Parameter-lock cross-reference. The comparison-mask declaration is fixed before outcome-sensitive ranking under the existing parameter-lock and methodological-integrity rules. A legitimate revision is recorded through governed change control and requires affected qualification, scoring and robustness checks to be rerun; it is not an outcome-selected exception.

A genuine structural difference in applicability MAY be represented by an option-specific exception only when the cell construct is literally undefined or absent for that option, the reason is independent of the desired result, the exception is challenger-visible, and the ranking is stress-tested under a common comparison basis.

Unjustified option-specific masking, or option-specific denominator Q manipulation, sets MASK_ASYMMETRY_INVALID and invalidates the comparative RLS claim. Gate-critical and non-maskable cells remain active regardless of residual masking.

10.3 Uncertainty Handling (Tier 2+ Required for Active Cells) (Normative)

RippleLogic recognizes epistemic uncertainty. Tier 2 and Tier 3 runs MUST record uncertainty and apply the discrimination rule for all active cells (definition below). Tier 1 runs SHOULD record uncertainty when feasible, especially on rights-covered and catastrophe-relevant cells.

Active cell definition (Normative; v9.0 tightened). A cell (u,d) is active for a run if any of the following holds: (i) m(u,d)=1 and the cell contributes to RLS aggregation, (ii) the cell lies in any rights coverage set C_r used for NCRC evaluation (regardless of mask status), (iii) the cell lies in the catastrophe cell set C_cat used for TRC evaluation (regardless of mask status), (iv) the cell is explicitly populated in the run for any gate, diagnostic, or justification, or (v) the cell is required by the run’s minimum governance coverage rules declared in the PCC.

Active cells MUST NOT be treated as unknown-by-default without disclosure. Masking (m(u,d)=0) excludes a cell from RLS aggregation only; it does not remove the cell from active status if any of conditions (ii) through (v) hold.

10.3.1 Cell-level uncertainty proxy declarations (Normative)

Definition of σ(u,d,a) (normative minimum): PCC MUST declare one of the following cell-level uncertainty proxies and apply it consistently across options:

The PCC MUST choose and record the uncertainty proxy before outcome-sensitive ranking. Method A uses a declared interval half-width; Method B uses the confidence-derived procedure in §10.3.2; Method C is permitted only within the demonstration and calibration boundaries stated below. The selected method, assumptions, validity limits, dependence treatment, and recheck trigger apply consistently across options.

Method A (interval half-width): If the PCC records a confidence interval [L,U] for the cell impact I(u,d,a), set σ(u,d,a) = (U − L)/2.

Method B (confidence-derived contribution-mass rule): Let x_k be each pre-confidence signed instance contribution in the cell after reach, temporal, likelihood, adjustment, and permitted sentience terms but before cell saturation. Define A_cell(u,d,a) = min(1, Σ_k |x_k|). If the PCC records cell confidence c(u,d,a) ∈ [0,1], set σ(u,d,a) = (1 − c(u,d,a)) × A_cell(u,d,a). This prevents uncertain positive and negative contributions from cancelling to a deceptively small uncertainty value.

Method C (calibrated table): Use a pre-registered mapping from qualitative uncertainty labels (for example, LOW/MED/HIGH) to σ values, stored in the ProofPack or PCC appendix.

10.3.2 Cell-level confidence derivation (Normative; Method B binding)

When the PCC uses Method B (confidence-derived) to compute cell uncertainty for a cell impact estimate, the PCC MUST define cell confidence c(u,d,a) in [0,1] from the set of impact-instance confidences {c_k} k∈K(u,d,a) using one declared CellConfidenceAggregationMethod. Implementations MUST apply the same method across all options in the run.

Let the instance contribution weight be defined as:
q_k := r_k · τ(t_k) · ℓ_k · e_k · h_k · |μ_k|
and let Q_cell := Σ_{k∈K(u,d,a)} q_k.

The PCC MUST declare one of the following canonical aggregation methods:

CCAM_MIN_V1 (conservative default):
c(u,d,a) := min_{k∈K(u,d,a)} c_k
Use case: high-stakes, high-adversarial-pressure contexts where “weakest-link” confidence is the appropriate posture.

CCAM_WMEAN_V1 (weighted mean): if Q_cell>0,c(u,d,a) := (1/Q_cell) · Σ_{k∈K(u,d,a)} (q_k · c_k)If Q_cell=0,

set c(u,d,a) := min_{k∈K(u,d,a)} c_k.

Edge case (Normative). If K(u,d,a)=∅ and the Phantom Instance Rule applies, distinguish point-estimate construction from epistemic uncertainty. The phantom instance uses c_point=1.0 only so the declared ignorance penalty is not attenuated in the point estimate. For Method B uncertainty, the cell MUST use c_uncertainty=0.0 and therefore σ(u,d,a)=A_cell(u,d,a) (subject to the ordinary cap), while remaining marked UNKNOWN_IMPACT. An implementation MUST NOT assign zero uncertainty to a phantom-active cell merely because the point-estimate penalty was applied at full strength.

Range rule (Normative). The derived c(u,d,a) MUST be clipped to [0,1] and recorded in PCC for each active cell when Method B is used.

Reconstruction rule. If a worked vector begins from a single-instance post-confidence saturated welfare value I_prop_welfare = tanh(beta * c_k * x_preconf), it MUST reconstruct x_preconf = atanh(I_prop_welfare)/(beta * c_k), not divide by beta alone. For multiple instances, the run MUST retain or reproduce the instance ledger; a cell total generally cannot identify the pre-confidence absolute contribution mass uniquely. Computability precondition. If the instance ledger cannot be accessed or reproducibly reconstructed, Method B is unavailable unless an explicitly warranted single-instance model uniquely identifies every required term, including nonzero confidence and the applied saturation/propagation path. A net multi-instance cell total MUST NOT substitute for absolute instance contribution mass. Any replacement by Method A or Method C requires its own admissible evidence, a documented PCC reason, and the required requalification and robustness checks; it MUST NOT be chosen merely to obtain a preferred result. If no warranted alternative exists, withhold the uncertainty estimate and refuse a stronger decisiveness claim. An uncalibrated Method C constant remains demonstration-only.

Scale-consistency rule (Normative). The retained Method B formula is a confidence-derived pre-saturation support proxy, not a calibrated sampling standard deviation or a guaranteed post-saturation error bound. The local derivative of tanh(beta x) is beta sech^2(beta x), so the transform can expand small-signal discrepancies or compress large-signal discrepancies. A shrinkage-to-unshrunk difference alone does not establish true statistical uncertainty. Any run at any tier using Method B to support ALLOW_FRAMEWORK_SELECTION or SELECTED_DECISIVE SHALL also declare and pass a transformation-consistent uncertainty treatment on the final I_prop scale, including the actual beta, scenario aggregation, propagation mode, material dependence and relevant measurement/model uncertainty. One admissible construction is an evidence-supported input interval propagated through the actual nonlinear pipeline and reported as a final-impact interval under Method A; the interval support and interpretation must be disclosed. If a warranted transformed treatment is unavailable, report the legacy proxy and point score only and refuse unique selection. A fixed sigma-times-two test can be informative near zero when beta=2, but does not by itself establish scale consistency for other beta values, kernels or uncertainty models. Historical Method B worked values remain reproducible illustrations, not exemptions from this selection-claim rule.

σ values MUST be clipped to [0,1]. Unless a stricter governed method is declared, σ(u,d,a) is interpreted as the pre-κ cell-level uncertainty input and SHALL be aggregated into σ_RLS using the same w_u, v_d, m(u,d), and κ(u,d) posture used for RLS.

Auditability binding (Normative). The PCC MUST record the source, elicitation basis, or calibration table used for σ(u,d,a) and any declared aggregation rule that produces it. If an allowed alternative uncertainty method or aggregation rule would change decisiveness, that sensitivity MUST be disclosed.

Tier 3 uncertainty hardening (Normative). Tier 3 runs MUST rerun decisiveness using σ×0.5 and σ×2.0 stress tests (or the nearest declared equivalent for Method A interval widths) and MUST record whether the every-contender decisiveness result changes.

Direction of the common-multiplier stress. Holding scores and other inputs fixed, reducing positive uncertainty widths raises the absolute Gap and can turn a formerly non-decisive comparison into a decisive one. It cannot overturn an already decisive positive lead solely by increasing its denominator. Therefore sigma-times-0.5 remains a sensitivity diagnostic; it is not universally decision-irrelevant. The exact multiplier relation in Section 10.4 governs the sigma-times-two interpretation.

Cross-tier computed-sensitivity rule (Normative). Whenever a run at any tier actually computes a declared uncertainty, dependence-cluster, baseline, weighting, saturation, or other governed sensitivity and the decisive/non-decisive classification changes under a tested variant, the run MUST set the applicable sensitivity flag, including UNCERTAINTY_DECISIVENESS_SENSITIVE where uncertainty is causal, and SHALL be treated as non-decisive until the tie-break chain or governance review is completed. Optional sensitivity work cannot be ignored merely because the tier did not require it.

Measurement-resolution rule (Normative). The declared σ(u,d,a) method MUST include the material elicitation, measurement, coding, model, and anchor-resolution uncertainty relevant to the cell claim. A zero uncertainty value is permitted only for an exact deterministic input whose transformation and reference are themselves exact for the declared claim. Where material resolution is unknown or unsupported, the run MUST not manufacture decisiveness from an arbitrarily small denominator; it must widen uncertainty, narrow the claim, or treat selection as non-decisive.

Method C restriction (Normative). Method C may be used only with a pre-registered calibrated table. A bare constant σ applied to all active cells is permitted only for worked examples, training artifacts, or explicitly non-operational demonstrations. A DEMONSTRATION_ONLY, UNVALIDATED, or materially sensitivity-flipping uncertainty posture MAY display point scores and a demonstration Gap, but MUST NOT support ALLOW_FRAMEWORK_SELECTION, SELECTED_DECISIVE, or an unqualified operational claim of unique framework selection.

Define approximate RLS uncertainty:

σ_RLS(a) = √[Σ_u Σ_d (q(u,d) × σ(u,d,a))²] / Q, for Q > 0

This is the independent-cell approximation. Tier 3 and decision-material Tier 2 runs MUST declare dependence clusters and compute the perfect-correlation or covariance-aware stress specified by the Dependence-cluster uncertainty rule in Section 10.3. If ranking or decisiveness changes, set RLS_DEPENDENCE_SENSITIVE and treat the result as non-decisive until governed resolution. The declared cell uncertainty MUST also include material measurement or elicitation resolution; exact zero is allowed only for exact deterministic inputs.

Dependence-cluster uncertainty rule (Normative). The formula above is the independent-cell approximation. Because cells may share sources, causal pathways, stakeholder populations, scenario assumptions, models, or evaluators, the PCC MUST declare uncertainty-dependence clusters for Tier 3 and decision-material Tier 2 runs. At minimum, compute a perfect-correlation stress within each declared cluster by summing absolute weighted uncertainty contributions inside the cluster, then combine independent clusters by root-sum-square. Where covariance estimates exist, a covariance-aware calculation MAY replace the stress approximation. If ranking or decisiveness changes relative to the independent-cell result, set RLS_DEPENDENCE_SENSITIVE and treat the result as non-decisive until the tie-break or governance review is complete.

Selection-claim materiality clarification (Normative). Any Tier 2 run that emits or publicly claims ALLOW_FRAMEWORK_SELECTION, SELECTED_DECISIVE, or an equivalent unique framework selection is decision-material for the dependence requirement above. The unique-selection claim must survive every required declared dependence treatment; the independent-cell result is an optimistic diagnostic rather than a substitute for cluster or covariance analysis. When material dependence cannot be credibly bounded, use the within-cluster perfect-correlation stress and refuse unique selection if the leader or decisive/non-decisive classification changes.

Optional risk-adjusted score:

RLS_adj(a) = RLS(a) − λ × σ_RLS(a)

Default: λ = 0.5. Use is optional but must be declared.

By default, RLS_adj is diagnostic only and MUST NOT replace RLS for ranking or decisiveness unless the run declares ex ante that risk-adjusted ranking is the governing ranking basis. If such a declaration is made, the same declared basis MUST be used consistently for ranking, Gap, and decisiveness across all compared options in the run.

10.3A Dependence-Bound and Numerical-Guard Reporting (Normative)

Every Tier 3 and high-stakes Tier 2 decisiveness report SHALL identify the uncertainty aggregation method, dependence clusters, and the reason the method is appropriate. The independence or weak-dependence estimate MAY be reported, but it cannot be the sole decisiveness basis where shared evidence, common causes, common measurement instruments, or cross-cell pathways make dependence material.

Unless a covariance-aware model with declared provenance controls, report both the declared estimate and a conservative dependence bound or stress. SELECTED_DECISIVE requires Gap>δ under every required dependence treatment. A reversal sets RLS_DEPENDENCE_SENSITIVE.

The ε term in Gap is a numerical division guard, not empirical evidence and not hidden certainty. Reports SHALL state its value and whether it materially affects the denominator. If ε changes the decisive/non-decisive classification, set GAP_NUMERICAL_GUARD_SENSITIVE and refuse unique selection until the treatment is governed. Although numerical in purpose, a positive epsilon also regularizes the denominator on the declared score scale and can change a decisiveness classification. It is not evidence of uncertainty or certainty; retain the required numerical-guard sensitivity disclosure and do not alter epsilon after viewing the preferred result.

10.4 Discrimination Threshold (Decisive vs Non-Decisive) (Normative)

Stress-threshold reading rule. Let V=sigma_a^2+sigma_b^2 under the declared independence-form arithmetic. A common uncertainty multiplier k requires DeltaScore > delta sqrt(k^2 V+epsilon). The corresponding base Gap requirement is delta sqrt((k^2 V+epsilon)/(V+epsilon)); it is approximately k delta only when epsilon is negligible relative to V. Neither delta nor this proxy Gap is a statistical z-score. All applicable dependence and robustness rules still apply.

Define gap between two options:

Gap(a,b) = abs(RLS(a) - RLS(b)) / sqrt(sigma_RLS(a)^2 + sigma_RLS(b)^2 + epsilon)

Default: delta = 2, epsilon = 1e-6.

Rationale (Informative). δ = 2 is a conservative governance convention for the normalized Gap definition, not a claim that Gap is a literal z-score or that a specific distributional assumption holds. Its purpose is to reduce premature declarations of decisiveness when option-level uncertainty materially overlaps. Domains may tune delta, but any non-default delta MUST be declared in the PCC, justified, and applied consistently across options in the run.

When at least two options are selectable, let a* be the highest-scoring option under the declared governing ranking basis. Score(a)=RLS(a) by default; Score(a)=RLS_adj(a) only when permitted and declared ex ante under Section 10.3. For each other selectable option b, define SignedGap(a*,b) = [Score(a*) - Score(b)] / sqrt(sigma_RLS(a*)^2 + sigma_RLS(b)^2 + epsilon). The pairwise absolute Gap remains a diagnostic; decisive selection uses the signed leader comparison.

Decisive lead rule:

• A unique decisive lead requires min_{b in A_sel, b != a*} SignedGap(a*,b) > delta under every required comparison and uncertainty variant, the same leader in every required construction, and complete satisfaction of Section 10.4B. A missing, undefined or non-finite required comparison, or an incomplete contender/variant set, precludes unique selection; an empty comparison set cannot pass by default. These governed discrimination tests do not confer familywise statistical confidence. A sole surviving option is reported as a sole survivor without a fabricated pairwise Gap; qualification and authority requirements remain binding.

• If any selectable rival has SignedGap(a*,b) <= delta in any required variant, or the leading option changes, the lead is non-decisive. Retain the unresolved contenders and apply Section 11.5; an intervening point-score runner-up MUST NOT conceal an unresolved lower-scoring rival. A permitted joint-uncertainty method must compare the leader against every rival over its declared joint set.

Cross-option dependence sensitivity (Normative clarification). The nominal Gap above is retained. Its root-sum-square denominator does not establish independence of option-estimation errors. Every Tier 3 or decision-material Tier 2 unique-selection claim SHALL assess whether common evidence, shared parameters or opposing allocation responses can create selection-material cross-option dependence. A computed material sensitivity at any tier remains subject to the cross-tier rule. Record the assessment and treatment in GapSensitivityRecord under the existing dependence robustness module; no new gate or decision state is created.

Where sigma values have a warranted final-score error interpretation and a supported joint-error model, a pairwise sensitivity may use V_diff(a,b)=sigma_a^2+sigma_b^2-2*Cov(error_a,error_b) and SignedGap_dep=(Score(a)-Score(b))/sqrt(V_diff+epsilon). For positive sigma_a and sigma_b, Cov=rho_ab*sigma_a*sigma_b with rho_ab in [-1,1]. Use the adverse supported covariance bound, not an outcome-selected favorable correlation. Joint covariance constructions must be positive semidefinite and consistent with the declared marginals. If a sigma is exactly zero under its governing evidence rule, its covariance is zero; do not estimate a correlation by dividing by zero. A materially negative variance indicates invalid inputs/model, not a quantity to silently clamp into a decisive result.

For material but unbounded cross-option dependence, do not assume zero covariance. A conservative pairwise stress uses the lower correlation bound rho_ab=-1, giving V_diff=(sigma_a+sigma_b)^2. This is a separate worst-case bound for each pair, not a claim that all pairs jointly have correlation -1. Non-statistical interval or heuristic proxies require a warranted joint interval/bound sensitivity on the final score scale; a covariance label alone cannot validate them. A missing warranted treatment blocks a unique-selection claim. Retain the nominal comparison and all required adverse variants; a reversal sets the existing RLS_DEPENDENCE_SENSITIVE and the result remains non-decisive under §§10.4A–10.4B. Favorable covariance cannot be used alone to rescue failed nominal decisiveness. The variance identity is standard uncertainty algebra, not evidence that RippleLogic estimates are empirically calibrated (NIST Technical Note 1297, Appendix A).

10.4A Non-Decisive Gap Enforcement (Normative)

If the leading options are tied, close, uncertainty-overlapped, or sensitivity-flipping under the declared discrimination rule, FrameworkVerdict MUST NOT state or imply deterministic framework selection. If any required SignedGap(a*,b) <= delta, or if any actually computed governed sensitivity changes the decisive/non-decisive classification, or if the uncertainty basis is limited to an unvalidated demonstration that cannot support the claimed operational strength, the run MUST either apply a governed tie-break rule over already-selectable options, return REFUSE_DETERMINISTIC_SELECTION, or route to AuthoritySelectionRecord without claiming that RippleLogic itself selected uniquely.

Any run that claims deterministic framework selection despite one of those non-decisive conditions SHOULD set DECISIVENESS_OVERRIDE_INVALID with severity INVALID. Authority selection may still choose among admissible non-decisive options, but it must be recorded as authority selection, not framework determinism.

10.4B RLS Robustness Completeness (Normative)

Before ALLOW_FRAMEWORK_SELECTION, SELECTED_DECISIVE, or equivalent unique technical-selection language, the PCC SHALL contain one RLSRobustnessRecord drawn from the finite Canonical Robustness Module Registry.

Each module SHALL be in exactly one state: NOT_TRIGGERED_WITH_RATIONALE, PASS_NO_REVERSAL, SENSITIVE, UNRESOLVED, or REQUIRED_NOT_EVALUATED. NOT_TRIGGERED_WITH_RATIONALE SHALL identify the trigger examined, evidence basis, reviewer status, and reopen condition. High-stakes non-trigger determinations require independent review where practicable.

The registered module families are: effect-token and WDBIP completeness; rights non-dilution; partition and temporal-token integrity; likelihood semantics and probability order; adverse confidence; distributional/subgroup closure; reference family; baseline family; comparison-mask symmetry; interaction/non-separability; dependence and Gap guard; weight profile; option-set closure; MPS hypothesis; phantom/unknown; PLSS prominence; kernel/saturation; and any domain-mandated module.

Unique framework selection is available only when every required module is PASS_NO_REVERSAL or NOT_TRIGGERED_WITH_RATIONALE, no module is SENSITIVE, UNRESOLVED, or REQUIRED_NOT_EVALUATED, and the same leading option is decisively separated from every other selectable option under Section 10.4 in every completed selection-material variant.

Admissible-alternative bound. An alternative construction enters the robustness set only when it is evidence-supported, selection-material, independently motivated rather than invented after outcome inspection, and accepted through the declared adjudication process. Rejected alternatives SHALL be logged with rationale. This closes both under-testing and indefinite adversarial over-testing.

Joint-stress rule (Normative clarification). Required uncertainty-scale variants SHALL be evaluated within each required dependence treatment using that treatment’s governing joint model or bound. Other required robustness perturbations SHALL also be evaluated jointly when they are mutually compatible, can plausibly coexist and their interaction can be selection-material. Do not double-count the same uncertainty source or combine logically incompatible models. Record the joint constructions and justified exclusions in the existing RLSRobustnessRecord and GapSensitivityRecord under the admissible-alternative bound; a material unresolved interaction blocks unique selection. This requires justified joint coverage, not an indiscriminate Cartesian product of all modules.

A sensitive or incomplete record does not erase the RLS calculation. It limits the claim to conditional ranking, non-decisive comparison, or authority selection. Later authority choice SHALL remain separate.

10.5 RLS Output Requirements (Normative)

PCC MUST record, per option in A_sel:

• I_prop_welfare(u,d,a) (or a retrievable summarized representation)

• RLS(a) and σ_RLS(a) and the uncertainty method

• Ranking and whether decisive (Gap vs δ)

Human-facing numeric rendering (Normative presentation rule). Machine records and calculation traces SHALL retain the precision needed for deterministic replay. Ordinary human-facing summaries SHOULD render RLS, CVaR, normalized Gap, uncertainty, and derived scores to no more than three decimal places unless additional displayed precision is decision-material and its evidential basis is stated. Rounded displays MUST identify the controlling full-precision calculation record and MUST NOT be used to reconstruct a different gate or selection result.

SECTION 11: TIE-BREAKS, HOLLOWING DIAGNOSTICS, AND STRUCTURAL MONITORING

11.0 Purpose (Normative)

This section defines the special-case role of UCI/HOI after the core method has already formed a selectable set. UCI/HOI are not public headline cascade stages and are not independent late-stage admissibility gates. Their gate-relevant structural work belongs in Containment. Their residual work occurs only when RLS is tied, close, uncertainty-overlapped, or non-decisive, or when monitoring and hollowing-risk documentation are required.

• UCI is a structural metric used primarily as CSV evidence where material and secondarily as a residual tie-break signal when RLS cannot decide.

• HOI is a hollowing and drift diagnostic that flags welfare-up/coherence-down patterns for Containment, monitoring, and residual tie-break contexts.

11.0A Instrument-Placement Rule for UCI/HOI (Normative)

UCI and HOI are structural diagnostic instruments with two possible uses.

1. Containment use. When UCI/HOI evidence is material to cross-scale structural integrity, it is evaluated inside the CSV Gate under Section 9. This includes severe coherence loss, hidden hollowing, institutional brittleness, burnout, trust collapse, ecological degradation, governance-capacity loss, lock-in, or other structural damage to a containing union.

2. Residual tie-break use. When no containment threshold is crossed and options have already passed RF/NCRC, TRC, and CSV, UCI/HOI may be used after RLS only to resolve tied, close, uncertainty-overlapped, or non-decisive welfare rankings, document residual structural preference, trigger monitoring, or inform future-run steering.

Level 5 public-facing language SHALL NOT present UCI/HOI as a regular cascade stage. The public Level 5 is RippleLogic Score. The UCI/HOI rule is a special-case tie-break and monitoring rule attached to RLS non-decisiveness and CSV diagnostics.

11.1 Union Coherence Index (UCI) (Normative)

11.1.1 UCI components (canonical)

For each union u, define component scores in [0,1]:

Let A_u be the set of components that are substantively applicable and measured for union scope u. Compute:

UCI_u = [sum_{j in A_u} alpha_j * X_{u,j}] / [sum_{j in A_u} alpha_j]

where X_{u,j} is H_u, F_u, R_u, or E_u. Default weights are alpha_H = alpha_F = alpha_R = alpha_E = 0.25 when all four components are applicable. An inapplicable component is recorded as NA and the remaining weights are renormalized; it MUST NOT be assigned a perfect score merely to avoid a penalty.

For Self (U1), equity-as-distribution is ordinarily NA; the default computation therefore renormalizes across Cohesion, Flow, and Resilience unless a domain-specific within-self equity construct is explicitly defined and measured. For Biosphere (U7), Equity is likewise NA unless a defensible ecological-distribution or justice indicator is declared. Missing but applicable evidence is UNKNOWN, not NA, and triggers the applicable UCI-unavailability or claim-narrowing rule.

11.1.2 Structural independence rule (Normative; Tier 3 binding)

UCI MUST be computed from structural/process indicators distinct from welfare indicators used for RLS.

At Tier 3:

• Deriving UCI from welfare-cell impacts is PROHIBITED.

• If structural indicators are unavailable, UCI is treated as unavailable and escalation/judgment-call protocol must be used (Section 11.5; Appendix E).

11.1.3 ΔUCI computation (Normative)

11.1.3A UCI Measurement Maturity Statement (Normative acknowledgement)

Structural coherence and viability are load-bearing in the RippleLogic architecture. UCI is one governed diagnostic for those properties and a residual tie-break interface; it is not a universally mandatory measured input and does not by itself define CSV. A run MAY resolve CSV from direct, domain-appropriate structural evidence without computing UCI where UCI is not material, provided every applicable CSV subcondition, dependency, control, reversibility, monitoring, authority/legitimacy, carrier-capacity, and evidence-sufficiency requirement is explicitly resolved. Where UCI is material, it informs rather than substitutes for the structured CSV evidence case. The current release line specifies UCI component definitions (Cohesion, Flow, Resilience, Equity), structural independence requirements, and indicator families per scope, but does not yet provide universally validated measurement instruments with published psychometric properties (reliability, validity, normalisation benchmarks) across domains.

Consequence for Tier 3 claims (Normative). Tier 3 run-level conformance claims are possible under the current specification when the run declares its UCI indicator sources, normalisation rules, and structural independence posture (Appendix E). Framework-level claims that UCI is empirically calibrated or cross-domain validated are PROHIBITED until a companion UCI Measurement Annex is published with at minimum: (i) named instruments per component per scope for U3, U4, and U5, (ii) normalisation rules with declared reference populations, (iii) structural independence verification evidence, and (iv) inter-rater reliability data (target ICC >= 0.70 on UCI component scores).

Validation commitment. Publishing such an annex is a Phase 2 validation priority (Section 17.3). Until it exists, the UCI measurement gap is the single largest barrier to framework-level empirical operational-readiness claims for Containment and tie-break governance.

Interpretive hardening (Normative). Until a companion UCI Measurement Annex is published, the structural questions UCI is intended to illuminate remain load-bearing, while UCI itself remains an empirically provisional diagnostic at the framework level. UCI therefore has no independent decision authority merely because a numerical value can be computed. CSV MAY resolve from direct, domain-appropriate structural evidence when UCI is not material, provided every applicable CSV subcondition is explicitly resolved; where UCI is material, it informs and challenges that evidence case rather than substituting for it. This limitation SHALL be surfaced in the Reader Guide, in Tier-claim language, and in any public claim about Containment or tie-break readiness. No framework-level claim of cross-domain calibrated or cross-domain validated UCI is permitted in the current v13.0 release line.

Provisional-UCI high-stakes restriction (Normative). A provisional UCI result MUST NOT be the sole evidential basis for either a high-stakes CSV_FAIL or an unqualified high-stakes CSV_PASS / CSV_PASS_WITH_CONTROLS, and MUST NOT by itself convert an otherwise non-decisive high-stakes RLS result into deterministic framework selection. A high-stakes fail requires a structured CSV evidence case that identifies the concrete structural mechanism, affected containing scope, evidence and uncertainty, threshold or failure condition, reviewer status, and available controls or redesign path. A high-stakes pass requires independently supported evidence that the relevant structural mechanism, dependencies, controls, reversibility, monitoring, and carrier capacity are adequate. If UCI is the only remaining discriminator among otherwise selectable options, the PCC SHALL disclose UCI measurement maturity, uncertainty, indicator provenance, structural-independence posture, and the underlying structural evidence; absent sufficient support, preserve the non-decisive result and route any later choice through the separately identified authority/governance path. Where provisional UCI raises or clears a material concern but the structured evidence case is not yet sufficient, use ASSUMPTION_BOUND, CSV_ESCALATE, or CSV_REDESIGN_REQUIRED as appropriate rather than a falsely certain fail, pass, or deterministic selection.

For each option a:

ΔUCI_u(a) = UCI_u(a) − UCI_u(baseline)

Containment uses ΔUCI for containing unions (Section 9).

11.2 Aggregate UCI (Optional, informative)

An aggregate coherence score may be computed:

UCI_agg = Σ_u γ_u × UCI_u

Where γ_u are declared aggregation weights. This aggregate is optional and MUST NOT replace per-union UCI in containment logic unless explicitly governed.

11.3 Hollowing-Out Index (HOI) (Normative as monitoring definition)

HOI detects a drift pattern: welfare score improves while coherence degrades over time.

Let t index review periods. Define:

• ΔRLS_t = RLS_t − RLS_{t-1}

• ΔUCI_t = UCI_agg,t − UCI_agg,{t-1} (or a declared union-specific UCI; must be consistent)

Define exponential moving average EMA_λ with a declared smoothing parameter (default half-life 3 periods).

HOI_t = EMA_λ(ΔRLS_t / s_RLS)_t − EMA_λ(ΔUCI_t / s_UCI)_t

Scale rule (Normative). s_RLS and s_UCI MUST be positive, preregistered reference scales derived from a declared reference range or robust dispersion estimate and held fixed for the review window. If either scale is unavailable or unstable, HOI is UNAVAILABLE; raw unstandardized changes MUST NOT be subtracted.

Interpretation:

• Persistent HOI > 0 means standardized welfare change exceeds standardized coherence change; by itself it does not prove deterioration because both quantities may be improving. A strict hollowing pattern requires the declared EMA of standardized welfare change to be positive while the declared EMA of standardized coherence change is negative. When HOI > 0 but coherence is non-negative, report RELATIVE_COHERENCE_LAG rather than structural deterioration. HOI remains a monitoring diagnostic and never a gate or selection rule.

• HOI is diagnostic; it does not by itself make an option inadmissible, but it can trigger monitoring escalation and influence tie-break risk flags.

Normative limitation. HOI SHALL NOT by itself render an option rights-admissible, inadmissible, non-selectable, or rejected under Containment. Its normative use in the current release line is limited to monitoring escalation, reviewer caution, and tie-break risk signaling unless an explicit future version declares a stronger role.

11.4 Reserved for Future Structural-Diagnostic Extension (Normative numbering marker)

Section 11.4 is intentionally reserved so that established Section 11.5 and later cross-references remain stable. No operational rule is assigned to this marker in the current release line.

11.5 Canonical Tie-Break Chain (Normative)

This section applies only after the selectable set A_sel has been formed by Reality Grounding, RF/NCRC, TRC, and CSV, and only when the leading residual welfare options remain tied, close, uncertainty-overlapped, or non-decisive under the Section 10.4 discrimination rule. The tie-break chain does not reopen NCRC, TRC, or CSV and is not part of the public headline method.

The governed tie-break order below applies only within the selectable set and under the Section 10.4 discrimination rule. If RLS is decisive, residual UCI/HOI is not required for selection, though it may still be recorded for monitoring or hollowing-risk documentation where appropriate.

Methods used here that can materially affect the outcome MUST be declared and applied consistently across compared options. Residual UCI or HOI SHALL NOT be used to compensate for unavailable containment evidence, failed Containment, insufficient Reality Grounding, or any prior gate failure. If structural evidence is gate-relevant, it belongs in Section 9 Containment, not in Section 11 tie-break.

Step 0: Ensure options under comparison are selectable (hold qualifying Reality Grounding, RF/NCRC, TRC and full CSV states).

If top RLS option fails containment, it is not in A_sel and must not be tie-broken into selection.

Step 1: UCI dominance rule.

Prefer the option with higher predicted UCI outcomes if the difference exceeds a governed UCI dominance threshold Δ_UCI.

Default: Δ_UCI = 0.05 (must be recorded; may be tightened).

Operationally: compare the minimum-coherence-change among critical containing unions and/or the relevant union UCI profiles. The PCC must declare the tie-break UCI comparison method:

• Method UCI-A (default): Maximize minimum ΔUCI_u over containing unions relevant to the decision scope; or

• Method UCI-B: Maximize sum of ΔUCI_u over the directly affected unions; or

• Method UCI-C: Maximize declared aggregate UCI_agg change.

Whichever method is used MUST be declared and applied consistently across compared options.

UCI tie-break maturity restriction (Normative). At Tier 3 and in other high-stakes uses, a provisional UCI difference does not by itself authorize deterministic tie resolution. The PCC SHALL identify the structural evidence underlying the UCI comparison, its measurement maturity, uncertainty, indicator provenance, and independent-review status. If that evidence is insufficient, disputed, or the provisional UCI value is the only discriminator, retain REFUSE_DETERMINISTIC_SELECTION and proceed to Step 3 rather than manufacturing framework determinism from an unvalidated index.

Step 2: HOI risk flag (if monitoring context exists).

If one option is associated with persistent positive HOI in comparable deployments or in modeled trajectory, treat it as riskier and prefer the alternative if the risk is material, or escalate.

Step 3: Escalation / judgment call.

If UCI is unavailable or non-decisive and HOI does not resolve, the decision MUST escalate to:

• Additional data collection (structural indicators), and/or

• A higher tier, and/or

• A documented governance judgment call (PCC labeled JUDGMENT_CALL_TIEBREAK_NONDECISIVE) with explicit monitoring plan.

Serialization and authority boundary (Normative). A Step 1 or Step 2 preference is a governed tie-break, not RLS decisiveness. While the Section 10.4/10.4B unique-selection conditions remain unmet, FrameworkVerdict MUST remain REFUSE_DETERMINISTIC_SELECTION; record the declared tie-break method, preferred option, evidence and remaining uncertainty in the PCC. A tie-break alone MUST NOT emit ALLOW_FRAMEWORK_SELECTION or SELECTED_DECISIVE. A separately lawful AuthoritySelectionRecord may adopt that preference and serialize the decision as SELECTED_BY_AUTHORITY_NON_DECISIVE. Without that authority act, retain the recorded refusal or escalation disposition. Execution authorization remains a separate, current, scope-bound requirement. New evidence may support a fresh decisive run only after the applicable qualification and robustness requirements are re-evaluated.

11.6 UCI Unavailability Rule (Tier 3) (Normative)

If UCI cannot be computed without violating structural independence:

• UCI MUST be treated as unavailable.

• If RLS lead is non-decisive, decision MUST either: (i) escalate for more structural data / higher tier, OR (ii) record a governance judgment call with explicit labeling and monitoring plan.

Audit label required: JUDGMENT_CALL_UCI_UNAVAILABLE.

11.7 Structural Safeguard Anti-Gaming (Normative)

• UCI MUST NOT be computed from RLS welfare impacts at Tier 3.

• UCI indicator choices must be documented; changes require versioning and are subject to challenge.

SECTION 12: MORAL STATUS, PROTECTION, PARTICIPATION, REALITY-MANAGEMENT CAPACITY, AND POWER: SGP v8.8 INTEGRATION (BINDING INTERFACE)

12.0 Purpose (Normative)

RippleLogic does not determine consciousness or moral patienthood on its own. It consumes only the governed interface outputs of the pinned Sentience Gradient Protocol v8.8. SGP outputs are evidence, profile, and status objects; they do not prove metaphysical consciousness or oneness, create legal status, reorder the cascade, establish species supremacy, or grant authority.

12.1 Type-Separation Rule (Normative)

The following objects MUST remain separate:

• MPS: Moral Patienthood Surface. Evidence band, interval, confidence, and protection posture concerning possible welfare-bearing experience.

• FPP: Full Protection Plateau. Constitutional or governed non-downgrade rights-of-protection status.

• GPR: Governance Participation Readiness. The mode by which an entity may participate directly, with support, or through representation in a named process.

• SPR: Stewardship/Power Readiness. Role-specific eligibility for a named consequential role under reality, rights, tail-risk, containment, competence, auditability, lawful-mandate, and revocability constraints.

• ICP: Intelligence Capacity Profile. Informative evidence about learning, generalization, understanding, reasoning, planning, metacognition, robustness, and resource efficiency.

• RMCP: Reality-Management Capacity Profile. Informative, multidimensional evidence about integrated reality-grounded modelling, recursive self-in-system representation, formal abstraction, cumulative knowledge, tool and intervention breadth, distributed coordination, long-horizon continuity, normative scope, causal reach, and responsibility tracking. P100 is the open top-plateau status for functional equivalence to or greater integrated reality-management capacity than the current human collective calibration anchor.

Strict rule: MPS and FPP govern protection; GPR governs participation design; SPR informs role-specific authority review; ICP informs competence; RMCP informs integrated reality-management capacity and may support CMIU, GPR, or SPR analysis only through separately governed records. No one surface substitutes for another. Low GPR, SPR, ICP, or RMCP MUST NOT reduce MPS or FPP. High ICP, RMCP, GPR, SPR, or P100 MUST NOT create sentience, FPP, CMIU membership, legal status, or authority. FPP MUST NOT create CMIU membership or authority.

12.2 SGP Authority and Version Pin (Normative)

RippleLogic Canon v13.0 pins SGP_v8.8.docx for its moral-patienthood, protection, participation, role-readiness, intelligence and reality-management-capacity interface. The local source hierarchy is in Appendix RELEASE. The prior repository source remains external and unchanged; remote publication is not claimed. v7.x SG_norm, SG_patient_norm, pillar scores and plateau/CMIU coupling remain legacy fields, not mathematical equivalents of the typed outputs; migration requires a documented current-protocol re-evaluation.

12.3 Human Full Protection Plateau (Normative; Non-Overridable)

For every human person H:

FPP(H) := 1

and every human welfare-impact instance uses:

h_{k,welfare} := 1.0

This is a constitutional anti-domination, equal-dignity, and full-inclusion rule, not an MPS evidence result or a claim that every human maximizes any consciousness or intelligence indicator. MPS(H,t) remains a separate evidence object and may be NOT_EVALUATED, MPS-NE, or otherwise evidence-governed without weakening FPP(H)=1 or h_{k,welfare}=1. The rule is independent of disability, age, illness, wakefulness, communication, productivity, or partial observability. No SGP or RippleLogic measurement may downgrade it.

Legacy compatibility note. Any historical field or display labelled MPSInterval_RL(H)=[1,1] SHALL be interpreted only as the fixed human welfare-inclusion set {1}. It is not an MPS evidence interval and MUST NOT be used as evidence that a human has been measured at a maximal consciousness level.

12.3A Humanity Collective RMCP-P100 Calibration (Normative Interface; Provisional Calibration)

Human FPP-100 and humanity RMCP-P100 are different claims. Every human person holds FPP-100. Separately, SGP v8.8 designates humanity collectively as the provisional current reference calibration anchor for integrated reality-management capacity because the human collective has demonstrated cumulative symbolic language, mathematics and science, technological intervention, intergenerational knowledge preservation, formal institutions, global coordination, planetary monitoring, Recursive Union Awareness, and causal reach across Earth systems.

The designation is a provisional, evidence-governed calibration construct, not a claim that every human individually has maximal capacity, that humanity governs wisely, that humans have greater intrinsic moral worth, or that P100 grants unrestricted authority. The open P100 plateau MAY also be assigned to biological, digital, hybrid, collective, or extraterrestrial intelligences that reach, exceed, or may already exist at functionally equivalent capacity, subject to a valid SGP v8.8 RMCP record and independent governed review. An entity that exceeds the human anchor remains in P100; the difference is represented in the profile rather than converted into a 101 supremacy caste.

12.4 Where SGP Enters RippleLogic (Normative)

Permitted interfaces:

• Protected-stakeholder and Rights Floor interface. MPS evidence and protection posture may identify a possible protected stakeholder and trigger precautionary RF/NCRC review. FPP establishes a non-downgradable protection floor. Absence of a pre-existing rights-coverage mapping is not permission for harmful treatment.

• Residual Welfare-stream interface. A valid SGP v8.8 record supplies a typed MPS evidence band/interval, protection posture, and record validity status. RippleLogic uses that record to construct a governed welfare-inclusion hypothesis set H_E for robust RLS sensitivity; it MUST NOT treat the MPS interval itself as a cardinal welfare multiplier. The Base stream fixes h_k:=1. Every human person and FPP entity uses H_E={1}. For a non-FPP entity with realistic or credible welfare-bearing possibility, H_E MUST include 1; where exclusion remains evidentially admissible it also includes 0. MPS-NE requires {0,1} when decision-material. Additional bounded coefficients require a separate governed and validated welfare-attention profile and cannot be inferred from the MPS band.

• Participation interface. GPR may inform direct, supported, or represented participation in a named governance process. GPR is not moral worth, voting weight, office eligibility, or command authority.

• Power interface. SPR may be admitted as one role-specific evidence object inside an AuthoritySelectionRecord, but it never replaces RG, RF/NCRC, TRC, CSV, domain competence, lawful mandate, institutional responsibility, or revocability.

• Competence interface. ICP may inform domain-competence evidence for GPR or SPR. It cannot alter MPS or FPP by itself.

• Reality-management capacity interface. A valid RMCP record may inform CMIU analysis, collective-capacity comparison, GPR design, or SPR role review. It MUST identify the evaluated individual, class, institution, collective, or distributed-system boundary; the declared domain and scale; each RMCP dimension and uncertainty interval; external scaffolding; causal reach; evidence dependencies; capacity-performance separation; P100 status if any; and revision triggers. RMCP, RMCI summaries, Recursive Union Awareness, and P100 MUST NOT alter MPS or FPP, act as cardinal moral-worth weights, or bypass lawful mandate and the cascade.

12.5 Interval-Sensitivity Rule (Normative)

If the preferred option, decisive/non-decisive status, subgroup result, or material welfare conclusion changes across the governed welfare-inclusion hypothesis set, the run MUST set MPS_HYPOTHESIS_SENSITIVE. The PCC MUST report the affected stakeholders, MPS evidence record, hypotheses tested, changed outputs, and disposition. Permitted dispositions are: collect additional evidence; adopt a precautionary policy acceptable across the hypothesis set; narrow the claim; preserve multiple options; or refuse a definitive ranking. Selecting a convenient intermediate coefficient or suppressing hypothesis sensitivity is non-conformant.

12.6 Prohibited Inferences (Normative)

The following are prohibited:

12.7 CMIU Governance Definition and Entry Boundary (Normative)

The Collective Managing Intelligence Union is the U6 governance-coordination view of intelligences, representatives, and institutions with a declared participation channel or lawful role in shared governance, coordination, and systemic-risk management. It is not a moral-status class and is not administered by SGP.

CMIU participation or membership, where an implementation uses that concept, requires an explicit institutional rule. For an entity, direct or supported participation SHOULD reference GPR; any consequential role MUST reference a role-specific SPR record and AuthoritySelectionRecord. A valid RMCP record MAY inform whether a candidate can model, coordinate, preserve, or manage shared reality at the relevant scale, but RMCP or P100 never supplies lawful mandate or membership by itself. Institutions may participate through lawful mandate and accountable representatives. MPS, FPP, RMCP, or P100 alone MUST NOT create CMIU membership.

12.8 Rights Expansion for Non-Human Stakeholders (Normative)

When SGP v8.8 supports a stronger protection posture or FPP for a non-human individual or class, RippleLogic may expand rights coverage only through a governed update: update C_r and subgroup protocols; map the typed SGP protection bundle to the applicable protected domains LIFE, BODY, NEED, DIGN, LBTY, PROC, INFO, and ECOL; version the decision; record membership and identity conditions; preserve prior PCCs; and provide notice, review, representation, and appeal. Class priors may raise protection but MUST NOT downgrade atypical individuals or create FPP without governed assignment.

SECTION 13: WEIGHT GOVERNANCE: HYBRID DEMOCRATIC WEIGHTING (HDW)

13.0 Purpose (Normative)

RLS requires union and dimension weights. Weights encode normative prioritization among admissible options. Without governance, weights become a capture surface. HDW provides legitimate, anti-capture weight governance by combining:

• Constitutional floors (non-negotiable minimum protection attention)

• Democratic tuning (stakeholder voice)

• Structural evidence input (system-level constraints)

HDW affects only ranking among selectable options. HDW MUST NOT alter admissibility gates (NCRC, TRC) or CSV gate.

13.1 Constitutional Floors (Normative; prior floor vector preserved through RippleLogic v13.0)

13.1.1 Union weight floors

Status of these numbers (Normative). The floor values below are chosen, challengeable governance priors - not discovered empirical constants. Any revision requires a declared justification, a versioned change, and sensitivity testing against retained alternatives. Floors MUST NOT be tuned after observing an outcome in order to manufacture a preferred ranking.

13.1.2 Dimension weight floors

13.1.3 Floor meaning (Normative)

Constitutional weight floors are minimum attention constraints in residual welfare ranking among options that have already passed the relevant admissibility gates. They are not rights. Rights are handled through NCRC in Section 7. They are not predictions of welfare salience for any particular decision. They are anti-erasure governance priors.

A floor value means that the corresponding Union Scope or welfare dimension may not be reduced to zero attention in residual welfare scoring merely because it is politically weak, distant, non-vocal, non-human, future-facing, or inconvenient to model.

Floor weights do not make all scopes equally active in every decision. PLSS may concentrate residual welfare attention on prominent scopes where the local ripple is strongest, provided that NCRC, TRC, CSV, non-maskable cells, and constitutional floors remain preserved.

Floor weights do not override evidence. They preserve representation. They ensure that optimization cannot erase a scope or dimension before the system has accounted for whether rights, tail-risk, containment, or welfare impacts are present.

Design logic. The canonical floor values are governance priors chosen to prevent erasure while leaving residual weight available for context-sensitive allocation. They are subject to governed revision only through the versioned update process, sensitivity analysis, and release-manifest discipline. They SHALL NOT be modified inside a run after outcome evidence is observed.

13.1.4 Floor derivation rationale (Normative governance prior; Informative derivation)

The constitutional floor values are governance priors designed to satisfy three structural requirements simultaneously: anti-erasure (no scope or dimension may be reduced to zero attention in welfare ranking among admissible options), proportionality (scopes with longer characteristic timescales, broader stakeholder coverage, or stronger enabling-condition roles receive moderately higher floors), and residual allocation headroom (floor totals are kept well below 1.0 to preserve meaningful democratic and structural tuning space).

Specific design logic for union floors:

Self (U1) = 0.20. Highest floor because individual-level experience, health, agency, and concentrated burdens are the constitutionally designated base welfare surface from which higher-scope aggregates are constructed. The floor prevents person-level impacts from disappearing inside household, organizational, polity, humanity, or biosphere summaries. It is not a decision-maker self-interest prior: a decision-maker or operator enters U1 only when materially affected and mapped under the same stakeholder and redundancy rules as anyone else. The floor remains below 0.25 so broader scopes collectively retain majority residual allocation.

Household (U2) through Organisation (U4) = 0.06 each. Set as equal modest floors reflecting that these scopes vary substantially in relevance across decision classes, so residual allocation rather than floor values should drive their relative emphasis.

Polity (U5) = 0.08. Modestly elevated above U2 through U4 because procedural legitimacy, enforcement capacity, and rule-of-law infrastructure are enabling conditions for all other scopes.

Humanity / Global Coordination (U6) and Biosphere (U7) = 0.10 each. Elevated because these scopes carry the longest characteristic timescales, the broadest stakeholder coverage, and the strongest enabling-condition roles. Degradation at these scopes is often irreversible and threatens the viability of all contained scopes.

Specific design logic for dimension floors:

Health (D2), Agency (D5), and Environment (D7) = 0.10 each. Elevated because these dimensions are most directly tied to rights-floor and enabling-condition protection: Health to survival and functioning, Agency to autonomy and non-domination, Environment to ecological viability.

Material (D1), Social (D3), and Knowledge (D4) = 0.08 each. Set as equal moderate floors reflecting their cross-cutting importance without prioritising any one.

Meaning (D6) = 0.06. Lowest floor because Meaning is the dimension most resistant to reliable cross-cultural measurement (Section 19.1) and most context-dependent in its governance relevance. The floor is non-zero to prevent erasure but is set conservatively pending measurement improvement.

Status (Normative). These floors are governance priors, not empirically derived constants. They are explicitly challengeable under the same governance rules that apply to all RippleLogic normative parameters: revision requires justification, version increment, PCC documentation preserving prior values, and sensitivity outcomes over a reference decision suite (Section 7.1). The values have remained stable since v6.0 and are carried forward in SGP v8.8 and preserved through RippleLogic v12.0 because no revision proposal has been submitted that satisfies these requirements.

Sensitivity guidance (Normative). Tier 3 deployments SHOULD include floor perturbation in their sensitivity bundle, testing at minimum +/-0.02 on each floor value (clamped to maintain sum <= 1 and all floors >= 0.02). If selection changes under floor perturbation, the PCC MUST document this sensitivity.

Floors prevent unions and dimensions from being reduced to zero by weight governance. Active-cell rules, applicability masks, and declared scope structure separately determine whether a given scope or dimension contributes to a specific run. Floors are not rights, because rights are handled by NCRC; floors are minimum attention constraints in welfare optimization among admissible options. The floor values specified below are the canonical v6.0 floors, carried forward in SGP v8.8 and preserved through RippleLogic v12.0, and preserved unchanged in subsequent releases unless explicitly amended in the version history.

13.2 HDW Blend Formula (Normative)

Let:

• w^floor be union floors,

• v^floor be dimension floors.

Define allocable mass:

• allocable_U = 1 − Σ_u w^floor_u = 0.34

• allocable_D = 1 − Σ_d v^floor_d = 0.40

Let w^dem and w^str be union proposal vectors on the simplex (Σ_u w^dem_u = 1, all nonnegative). Let λ_U be the democratic share of allocable union mass. Default: λ_U = 0.70.

Clarification (Normative). Proposal vectors are constrained to the probability simplex: all components nonnegative, sum to 1, and subject to any declared floor constraints before blending. Validators MUST reject proposal vectors that violate simplex or floor constraints.

Then:

w_u = w^floor_u + allocable_U × (λ_U × w^dem_u + (1 − λ_U) × w^str_u)

Similarly for dimensions with λ_D (default λ_D = 0.70):

v_d = v^floor_d + allocable_D × (λ_D × v^dem_d + (1 − λ_D) × v^str_d)

By construction:

• Σ_u w_u = 1,

• Σ_d v_d = 1,

• All floors are satisfied,

• Weights remain nonnegative.

13.3 Democratic Proposal Process (Normative minimum)

HDW requires a documented process for producing w^dem and v^dem. At minimum:

• Participants: Representatives from affected unions (including vulnerable populations),

• Method: Transparent vote or deliberative process with published results,

• Publication: Results recorded in PCC and (Tier 3 recommended) in an immutable ledger.

13.3A Democratic Tuning Procedure (Normative minimum)

At minimum, HDW democratic tuning SHALL use a declared participation protocol that produces reproducible proposal vectors for scopes and dimensions. The default ballot method is a two-ballot allocation: each eligible participant allocates 100 points across the seven operational scopes to produce a raw scope proposal, and 100 points across the seven welfare dimensions to produce a raw dimension proposal.

Normalization rule (Normative). Raw ballot totals SHALL be normalized onto the simplex to produce w^dem and v^dem. Ballots with missing, negative, or over-totaled entries MUST be corrected or excluded under a declared correction rule recorded in the PCC. The PCC MUST record participant eligibility, quorum rule, number of ballots counted, exclusion/correction rule, and the final normalized proposal vectors.

Minimum procedural safeguards (Normative). Tier 3 HDW runs MUST include: (i) declared eligibility criteria, (ii) quorum threshold, (iii) publication of aggregate results, (iv) challenger opportunity before final locking, and (v) retention of the raw ballot summary sufficient for independent recomputation. If these conditions are not met, the run MUST use a declared interim weight profile and MUST NOT present the democratic proposal as fully satisfied HDW governance.

Floor lock (Normative). Democratic tuning operates only over allocable mass above constitutional floors. No democratic proposal may reduce any scope or dimension below its Section 13.1 floor. For Tier 3 HDW runs, where a ballot-derived proposal would reduce a final combined weight w_u or v_d to at or within 0.02 above its constitutional floor, the Section 13.5 supermajority safeguard applies. Evaluate the final proposed weight after the declared HDW combination, not an unblended ballot share. Stricter applicable governance requirements remain binding.

13.4 Structural Proposal Process (Normative minimum)

w^str and v^str represent evidence-informed constraints (for example, externality reach, irreversibility, systemic risk). At minimum:

• Method: Documented rule for producing w^str, v^str,

• Inputs: Declared indicators and sources,

• Reproducibility: The same method yields same output given same data.

If a deployment lacks structural evidence, it may use a declared interim default w^str, v^str at Tier 2, but Tier 3 SHOULD converge to a governed structural method over time.

13.5 Anti-Capture Safeguards (Normative for Tier 3)

Tier 3 weight governance MUST include:

• Stratified representation: Delegates must include vulnerable population representation and biosphere stewardship for environment-relevant decisions.

• Supermajority lock near floors: Any Tier 3 proposal reducing a final combined weight w_u or v_d to at or within 0.02 above its floor requires ≥2/3 approval. The test uses the final proposed weight, not an unblended proposal share.

• Transparency ledger: All proposals, votes, rationales published (at least internally).

• Red-team testing: Proposed weights tested against reference decision suites to detect systematic bias.

• Conflict-of-interest disclosure: Material conflicts require recusal; recusals recorded.

13.6 Weight Use by Tier (Normative)

13.6A Weight Constitution, Induced Cell Floors, and Normative Underdetermination (Normative)

Every claim-bearing RLS run SHALL declare WeightProfileStatus as AUTHORIZED, INTERIM, CONTESTED, or UNSETTLED. AUTHORIZED means a legitimate ex-ante process selected the controlling profile; the resulting ranking remains conditional on that constitution.

INTERIM requires sensitivity across the live legitimate profiles. CONTESTED or UNSETTLED requires comparison across those profiles when selection-material. Arbitrary post-result profiles are inadmissible.

Constitutional union and dimension floors are minimum anti-erasure attention constraints. Because q(u,d) includes the product w_u·v_d, they also induce minimum cell-level ranking influence. The induced cell floor is multiplicative, not additive, and reports SHALL disclose the resulting cell-floor range when it is material. This influence is a chosen constitutional convention, not an empirically discovered marginal welfare exchange rate.

If two or more legitimate ex-ante weight constitutions select different options after the empirical and methodological surface is sufficiently closed, return REFUSE_DETERMINISTIC_SELECTION with NonDecisiveReason=NORMATIVE_UNDERDETERMINED. Additional empirical evidence cannot determine which moral or political constitution is uniquely correct. An accountable authority MAY select among the disclosed selectable options through a separate AuthoritySelectionRecord.

SECTION 14: AUDITABILITY AND DETERMINISM: PCC AND AIL (TIER 1-3; TIER 4 TARGET)

14.0 Purpose (Normative)

Without auditability, ethics frameworks become theater or are gamed. RippleLogic therefore requires a structured decision artifact (PCC) and integrity rules (AIL) to make decisions reconstructable, challengeable, and corrigible via NCAR.

Tier boundary: Tier 1-3 auditability is fully specified here. Tier 4 determinism and hash-bound replayability are explicitly a design target only (Appendix I) and MUST NOT be claimed in the current v13.0 release.

14.1 Artifact Integrity Law (AIL) Principles (Normative for Tier 2-3)

AIL is a set of integrity constraints governing how decisions are recorded and compared.

14.2 PCC Requirements by Tier (Normative)

PCC.EKRegistry (CONDITIONAL; REQUIRED when any non-default e_k is used, or when a Tier 2 named-instrument exception is invoked). For each instrument record: InstrumentID; Purpose; Source/Authority; AllowedRange; TierPermitted; ReasonCodeSet; DefaultCounterfactualRequired [TRUE/FALSE].

14.3 Audit Flags (Normative)

Audit flags are standardized labels for integrity failures or risk warnings. Flags MUST be recorded in PCC when triggered. If any INVALID flag triggers, the PCC is invalid and the decision run MUST be recomputed after correction.

Definitions for this section:

• Mode A (Containment as binding gate): Containment / CSV evaluation determines which options are selectable; options failing CSV MUST NOT be selected. See Section 9 and Appendix B.11.

• Mode B (diagnostic-only legacy posture): a structural diagnostic is computed for information but does not affect selection. Mode B is PROHIBITED for any ordinary ranking or selection claim. Current selection-relevant structural evidence belongs inside CSV under Section 9; residual non-gate-critical use is limited by Sections 10.4 and 11.

• KQS (Kernel Quality Score): Summary score indicating kernel readiness for propagation. See Section 6.5.

• Kernel perturbation test: Systematic edge perturbation of ±0.05 (or ±10% of magnitude, whichever is larger) applied one-at-a-time to relied-upon non-zero kernel edges. See Section 6.6.

Canonical Audit Flags - Current v13.0 Specification

14.3A Canonical Audit Flag Registry v13.0 (Normative)

Section 14.3A and docs/implementation/CANONICAL_AUDIT_FLAG_REGISTRY_v1.1.yaml are one controlling audit-flag registry expressed in human-readable and machine-readable form. The YAML controls token enumeration, owner, severity vocabulary, and source location; this section controls normative meaning and required action. A controlling token introduced anywhere in the Canon or an active companion MUST be added to the YAML and projected here or be explicitly labeled local/informative and non-controlling. The release verifier MUST fail when a normatively controlling token is absent from the machine registry or when the two surfaces assign incompatible ownership or severity.

Reading-package and machine-release boundary (Normative clarification). Every controlling token explicitly required by this Canon retains its meaning and required disposition even when an external registry is unavailable. Absence from a mirror or unavailable YAML MUST NOT be treated as permission to suppress it. Publication claiming registry-conformant machine interchange remains blocked until the complete YAML projection and its source meanings are manifest-pinned, reconciled and verified. A bounded research/reading package that explicitly disclaims that stronger conformance does not establish the missing external registry by assertion. Package-local derived directories are navigation/testing aids, not silently promoted replacements for that authority.

14.3A.1 Supplemental current-line ownership registry (Normative)

Ownership rule. Canon tokens govern framework conformance. Agent-runtime tokens are implementation events mapped to Canon states; they do not create new gates or modify Canon precedence. RUNTIME_BLOCK and RUNTIME_INVALID are runtime-action severities owned by the Agent System; they map respectively to execution blocking/escalation and invalid runtime-state claims. They do not extend the Canon PCC severity vocabulary {INVALID, ESCALATE, REVIEW, DISCLOSE}.

CBI PCC fields (Normative for triggered cases). When COMPUTABLE_BUT_INADMISSIBLE is triggered, the PCC MUST record: PCC.CBI.ComputedObject; PCC.CBI.InadmissibilityReason; PCC.CBI.Layer; PCC.CBI.AllowedUse; PCC.CBI.ProhibitedUse; PCC.CBI.ReviewStatus; and, where applicable, PCC.CBI.ReviewerNote or EscalationPath.

Stewardship audit-flag tokens are defined canonically in Appendix N.7 and MUST NOT be redefined in downstream specifications; downstream documents SHALL reference Appendix N.7.

No independent audit-flag mirror table is maintained in Appendix H.3. Implementers MUST consume Section 14.3A together with CANONICAL_AUDIT_FLAG_REGISTRY_v1.1.yaml, or a mechanically generated projection of that pair. Absence from an appendix, workbook, or companion does not retire a registry-listed controlling token.

Additional v9.0–v9.6 hardening flags (Normative). The canonical audit-flag set SHALL include PLSS_ESCALATION_TRIGGER_UNRESOLVED, DECISIVENESS_METHOD_POSTHOC, EK_NONDEFAULT_TIER2_INVALID, EK_PARAMETER_UNJUSTIFIED, UNCERTAINTY_PROVENANCE_MISSING, RIGHTS_CELL_UNKNOWN_GATE_CRITICAL, and CATASTROPHE_CELL_UNKNOWN_GATE_CRITICAL. These flags are triggered as specified in Sections 10.2A.7, 10.2A.8, 5.2, 5.7, and 15.1 and MUST be recorded in the PCC when applicable.

EK_NONDEFAULT_TIER2_INVALID trigger clarification (Normative). This legacy-stable token means that Tier 2 used non-default e_k without a valid, explicitly invoked named governed instrument in PCC.EKRegistry. It does not invalidate the named-instrument exception permitted by Section 5.2. The token name is retained for machine compatibility; implementations MUST use this trigger definition rather than infer that every Tier 2 non-default value is invalid.

EK_PARAMETER_UNJUSTIFIED (Normative). Trigger: non-default e_k is used without (i) a matching PCC.EKRegistry entry when required, (ii) declared rationale and source/instrument note, (iii) stated bounds, or (iv) the required tier-appropriate sensitivity disclosure. Required action: populate PCC.EKRegistry and missing disclosures, or reset e_k to 1.00 and recompute. Severity: INVALID.

14.3A.2 Representation, Evidence and Selection Token Completion (Normative)

This table consolidates tokens already required by the cited rules and vectors. Canon is their owner. Severity qualifies the affected claim; it does not replace the required action. NORMATIVE_UNDERDETERMINED is a NonDecisiveReason, not an additional gate or severity. Existing registry rows, including RLS_DEPENDENCE_SENSITIVE, remain controlling and are not duplicated here.

14.3B Minimal Validator Requirements (v10.6+; Normative)

Any conformant RippleLogic v13.0 validator MUST check the following:

• Every declared instance maps to ≥1 scope (InstanceMap completeness).

• Confirm PCC.ScopeCoverageDeclaration.Mode is declared as FULL_SCOPE or REDUCED_SCOPE; if Mode = REDUCED_SCOPE then ScopeCoverage block is present with a blind-spot statement and escalation triggers.

• If Mode = REDUCED_SCOPE: PCC.AdmissibilityAttestation.NCRC_full_Cr_computed is present and TRUE.

If Mode = REDUCED_SCOPE: PCC.AdmissibilityAttestation.TRC_full_Ccat_computed is present and (TRUE or NA).

If TRC is computed/required (i.e., not NA): verify mandatory tail categories are present (or justified) and per-category probability sums meet p_floor; otherwise require the corresponding audit flags (MANDATORY_TAIL_CATEGORY_MISSING / …WITH_JUSTIFICATION / MANDATORY_TAIL_PROB_FLOOR_VIOLATION).

If Mode = REDUCED_SCOPE: PCC.AdmissibilityAttestation.Containment_computed_as_applicable is present and (TRUE or NA).

If CONTAINMENT_UCI_UNAVAILABLE triggers: audit flag is present, and PCC.Containment.UCIUnavailableDisposition + PCC.Containment.UCIUnavailableRemediationTimeline are present (non-empty).

Tier-3 claim enforcement (Normative). If Implementation Tier = 3 and CONTAINMENT_UCI_UNAVAILABLE is present, the validator MUST reject Tier 3 compliance unless PCC.TierClaimDisposition = TIER_ATTEMPTED_NOT_ACHIEVED_DOWNGRADED and PCC.TierAchieved = 2.

• Non-maskable checks: rights-covered cells and catastrophe cells are unmasked (no bypass).

• If ALLOCATION used: Σα ≤ 1 for each declared effect-token.

• SCI level meets tier minimum (Tier 2: SCI ≥ 1; Tier 3: SCI ≥ 2).

• If SCI equals tier minimum: Next-Run Upgrade action present.

• Tier 2+ uncertainty: σ(u,d,a) declared for all active cells using Method A, B, or C.

If PCC.Uncertainty.Method = B: verify PCC.Uncertainty.CellConfidenceAggregationMethod is present and valid, and that c(u,d,a) is recorded (or recomputable) for all active cells.

• Tier-2 mapping triggers: if any trigger holds, instance mapping is present.

Provenance binding (Normative). Any analyst-entered parameter that can steer admissibility or decisiveness - including uncertainty method choice, scenario probabilities p_s, PLSS prominence inputs q_u, and any non-default aggregation operator - MUST have a reason code, source note or elicitation note, and a compact sensitivity note if altered values plausibly change the outcome.

If any welfare-relevant state, rights-relevant state, or enabling condition materially affects admissibility, precautionary handling, selection, or tie-break outcome, PCC.NormativeInputRegister is present.

For each ADMISSIBILITY_MATERIAL, PRECAUTION_MATERIAL, SELECTION_MATERIAL, or TIEBREAK_MATERIAL entry in PCC.NormativeInputRegister, the validator MUST verify the presence of NormInputID, InputType, Materiality, AffectedObjects, EvidenceBasisType, and at least one of: EvidenceReference, GovernedInterpretationBasis (not NONE), or PrecautionaryBasis (not NONE).

If PrecautionaryBasis ≠ NONE, the validator MUST verify that the precautionary basis is explicitly stated, the affected object(s) are identified, and, for Tier 3, a ReviewerNote is present.

If OptionSymmetryStatus = OPTION_SPECIFIC_WITH_JUSTIFICATION, the validator MUST verify that a SensitivityNote is present.

If the register is required but missing, or if a required material entry is incomplete, the validator MUST set NORMATIVE_INPUT_PROVENANCE_MISSING and reject the run as non-conformant.

• Rights-covered and catastrophe cells: never bypassed by reduced-scope mode or masking.

If PLSS is declared: q_u is present for all scopes, the operator is declared, the PLSS weight vector sums to 1, and each w_u^PLSS is greater than or equal to its constitutional floor.

If UCI is used: every component is VALUE, ESTIMATE, UNKNOWN, or NA; NA components are excluded and weights renormalized; UNKNOWN components do not receive an inserted score. If U6 is material: every U6 record includes a valid U6_View_Tag and mixed values include decomposition.

If all q_u = 0 under PLSS: the validator MUST verify that the declared uniform residual fallback (or another declared fallback with justification) was applied.

If an alternative PLSS operator is used: justification and a sensitivity note are present in the PCC.

If PLSS is declared: an escalation-trigger review field is present and the PCC.PLSS block is present.

If a gate-critical UNKNOWN_IMPACT occurs in C_r or C_cat: the validator MUST reject any attempt to resolve admissibility by phantom-instance fallback alone and MUST require the corresponding audit flag plus a declared conservative bound or rerun / downgrade / escalation disposition consistent with Section 5.7.

If a non-maskable rights or catastrophe cell remains in RLS aggregation: the validator MUST verify floor-baseline consistency or the presence of a governed dual-baseline declaration that preserves the floor-reference value as the controlling gate-consistency baseline.

If a dual-baseline method is declared: the validator MUST verify that the PCC contains a per-cell or per-cell-class dual-baseline declaration identifying the affected welfare cells, the welfare baseline used, the gate baseline fixed at floor-reference, and the rationale for the exception.

14.3C Record Semantics, Display Integrity and Privacy (Normative)

A claim-bearing interface SHALL distinguish evidence/telemetry, EffectTokens, derived impact snapshots, gate/verdict records, and authorized intervention/outcome records. Bind them to run, option, baseline, schema, component map, configuration, units, sign convention, provenance, time horizon and evidence-status identifiers. Schema validity checks record structure, not truth, orthogonality, completeness of real-world discovery, rights passage or authority. The supplemental record schemas and scoped reference checks listed in the release appendix do not replace the full run validator or required domain evidence.

Use stable U1-U7/D1-D7 identifiers and named fields or an explicitly pinned vector order. Preserve unknown/contested/out-of-domain states separately from numeric zero. Timestamp fields distinguish observation time, receipt time, monotonic uptime and authorization validity. Numerical conversion requires finite inputs, range checks, a declared scale and rounding/overflow policy. Representation-only reordering, display rounding, duplicate transport and storage failover must not change the effect ledger or grant a new decision state.

Display the signed residual field and its contribution decomposition separately from raw system diagnostics, quality/freshness indicators, qualification states, authority and execution. Defaults may not imply PASS, live telemetry, empirical coherence, recovered welfare or a measured alignment percentage. Every displayed result must resolve to a recorded calculation or observation; synthetic demonstrations stay visibly synthetic.

A signature or hash binds specified data under its cryptographic assumptions; it does not prove evidence truth, welfare measurement, lawful authority or physical safety. A privacy-preserving proof establishes only its declared formal relation over committed inputs. Record the relation/circuit, public inputs, commitment and trust sources, setup/verification assumptions, freshness, replay protections and the unproven facts. Protect vulnerable people without requiring them to possess an account, secret key or resource reserve.

Preserve enough decision-material evidence for legitimate reconstruction, challenge, remedy and requalification while minimizing unnecessary sensitive retention. A hash of predictable personal data is not anonymization. Retention expiry, redaction, lawful holds and deletion require explicit policies; deletion of material evidence changes future claim support and must remain auditable without recreating the removed sensitive content.

14.3D Measurement-Maturity Validator Requirements (Normative)

For Tier 2-3 claim-bearing runs, a conformant validator MUST verify that the PCC includes all Appendix V measurement-maturity fields applicable to the run. At minimum, the validator MUST check: PCC.UCI_Measurement_Readiness where UCI is used or unavailable at Containment or tie-break; PCC.Kernel_Use_Posture where numerical propagation is used or explicitly omitted; PCC.HDW_Capture_Audit for Tier 3 public or institutional weighting processes; PCC.PLSS_Escalation_Register whenever PLSS is used; PCC.Deployment_Context_Profile for Tier 2-3 claim-bearing deployments; and PCC.Biological_Evaluation_Maturity where biological SGP evidence is invoked.

The validator MUST reject or downgrade any claim that treats UCI-M1, K0/K1, BEM-1/BEM-2, unreviewed HDW, or unchallenged PLSS localism as empirically validated, capture-resistant, or operationally complete. Missing maturity fields trigger PCC_MATURITY_SURFACE_INCOMPLETE. A maturity field marked provisional may support a worked-run or architecture claim, but MUST NOT support empirical validation, ProofPack readiness, Tier 4 readiness, validated UCI, validated kernel propagation, or biological measurement-completeness claims.

14.4 Five-Sentence Public Rationale (5SPR) (Normative)

Tier 2-3 PCC MUST include a Five-Sentence Public Rationale:

14.5 Tier-4 Design Target Boundary Statement (Normative)

Tier 4 compliance claims are PROHIBITED in the current v13.0 release. Tier-4 content is design target only (Appendix I). No determinism, hash-bound replay, or ProofPack claims may be asserted until ProofPack is publicly replayable and independently verified.

14.6 Socio-Technical Embedding: Legitimacy, Contestation, and Institutional Use (Informative)

RippleLogic is designed for socio-technical governance settings where values are plural, power is unevenly distributed, and institutional incentives can distort decision quality. The framework therefore treats legitimacy as a procedural property rather than an assumed outcome.

Hybrid Democratic Weighting governs welfare weights through structured stakeholder participation with anti-capture safeguards, while constitutional rights and tail-risk constraints limit what can be traded away even when stakeholders disagree.

The Provenance and Compliance Certificate supports contestability: it makes normative parameters, scenario assumptions, subgroup handling, and constraint-gate outcomes explicit so that affected parties can challenge decisions with evidence rather than rhetoric.

Institutional embedding is expected to vary by context, but at minimum high-stakes deployments SHOULD include:

- Independent review capacity (at least one reviewer with no reporting relationship to the decision owner)

- Audit sampling (for example, random audit lotteries selecting ≥5% of Tier 3 PCCs for independent review)

- An escalation pathway when rights, tail-risk, or containment conditions are near-binding or sensitive under perturbations

- Designated channels through which affected stakeholders can access the PCC (or the 5SPR at minimum) and submit evidence-based challenges

- A governance body or designated authority responsible for adjudicating challenges, with documented procedures and timelines

RippleLogic does not remove politics; it makes the structure of political and ethical disagreement legible and auditable. The framework’s value proposition is not that it eliminates conflict but that it converts implicit, opaque tradeoffs into explicit, traceable, and challengeable ones.

Contestation architecture. The 5SPR (Five-Sentence Public Rationale) serves as the minimum contestability interface: any affected party should be able to read the 5SPR and understand what was decided, what was excluded and why, and what follow-up is planned. For Tier 3 decisions, the full PCC provides the detailed evidence base for substantive challenge. Challenges SHOULD be processed through a documented review procedure with:

- A defined response timeline (recommended: ≤30 days for initial response)

- Documented outcomes (challenge upheld, rejected with reasoning, or additional evidence requested)

- Version increment if the challenge results in parameter changes

- Preservation of the original PCC alongside the revised PCC

Power asymmetry awareness. In contexts where decision owners have significantly more power than affected stakeholders, the framework’s structural protections (NCRC, worst-off subgroup semantics, mandatory tail categories, independent challenger requirements) serve as institutional counterweights. However, these protections are only effective if the institutional context supports their enforcement. Deployments in contexts with weak rule of law, captured institutions, or suppressed civil society SHOULD be flagged for enhanced scrutiny and may require external oversight partnerships.

14.7 Stewardship Layer (Normative): Applicability and Binding Semantics

14.7.1 Applicability Predicate (Normative)

RippleLogic Stewardship requirements apply only when a run is performed in a stewardship-relevant role (power asymmetry, delegated influence, public/institutional impact, or execution capability). Define:

Stw_req(run) in {0,1}, where Stw_req(run) = 1 if and only if any of S1 through S4 holds. S5 is a modifier: it constrains provenance and influence controls when present, but S5 alone does not trigger Stw_req(run).

The Stw_req(run) predicate is defined in Section 14.7.1 and MUST NOT be redefined in downstream specifications; downstream documents SHALL reference this section.

• S1 (Delegated Influence): An assisting system is asked to recommend, rank, or narrow option space for a decision owner, such that the decision owner may reasonably rely on it.

• S2 (Public/Institutional Effect): Outputs are intended for public posting or institutional/policy use beyond the private decision owner.

• S3 (Execution Capability): The assisting system can execute actions (write/post/act) or trigger downstream actions beyond drafting.

• S4 (High-Stakes Rights Exposure): The assisted decision materially affects rights, safety, liberty, livelihood, or access to essential services, or produces irreversible/high-impact outcomes for protected stakeholders.

S5 (Authenticated Operator Channel; modifier): The system has an authenticated operator channel capable of altering configuration, permissions, or deployment posture; when S5 co-occurs with any of S1 through S4, additional provenance and influence disclosure requirements apply per Appendix N.

Interpretation notes (Normative).

S1 scope limiter: Delegated influence applies when the decision owner may reasonably rely on the system’s output to materially shape a consequential decision (including meaningful option-narrowing or ranking that guides action). Purely informational or educational responses where independent judgment and verification capacity are preserved do not by themselves trigger S1.

S5 scope limiter (no loophole): S5 alone, absent any of S1 through S4, does not trigger Stewardship instrumentation. When S5 co-occurs with any of S1 through S4, Stw_req(run)=1 is triggered by the co-occurring condition(s) (S1–S4), not by S5.

If Stw_req(run) = 0, Stewardship instrumentation is OPTIONAL and Stewardship audit flags do not apply. If Stw_req(run) = 1, Stewardship instrumentation is REQUIRED per Appendix N.

14.7.2 Stewardship vs Cascade (Normative)

Stewardship does not modify the RippleLogic cascade definitions for NCRC, TRC, CSV, RLS, or UCI/HOI. Stewardship governs assistance integrity (boundary stability, authorship preservation, influence transparency). When Stewardship is required (Stw_req = 1), failure conditions are enforced via audit flags and PCC validity rules defined in Appendix N.

14.7.3 Flag Semantics Pointer (Normative)

Stewardship flags follow the canonical audit-flag severity semantics:

• INVALID flags invalidate the PCC and require rerun/remediation.

• REVIEW flags require mitigation and monitoring but do not by themselves invalidate the PCC.

Stewardship audit flags are defined in Appendix N and apply only when Stw_req(run) = 1.

14.8 Computational Closure Declaration (Normative)

Purpose. Every RippleLogic run SHALL declare the boundary of computation so that claims do not silently extend beyond the scopes, horizons, evidence classes, or propagation modes actually evaluated.

A PCC.ComputationalClosure object SHALL include at minimum:

- scopes_evaluated: Union Scopes included in the run;

- scopes_guardrail_only: Union Scopes protected through floors, NCRC, TRC, or CSV but not materially weighted in residual welfare ranking;

- scopes_outside_computation: scopes not evaluated beyond humility-horizon recognition;

- time_horizon_evaluated: declared decision horizon;

- time_horizon_outside_computation: time horizons acknowledged but not modeled;

- kernel_mode: NONE, QUICK, or declared domain-kernel-id;

- propagation_edges_included: declared kernel edges or NONE;

- propagation_edges_excluded: known plausible edges excluded from computation;

- externalities_excluded: known plausible externalities excluded, with reason codes;

- claim_boundary: exact wording of what the run may and may not claim.

A run SHALL NOT claim coverage over scopes, horizons, externalities, or propagation pathways outside its ComputationalClosure boundary. Any public-facing summary SHALL preserve this claim boundary.

SECTION 15: IMPLEMENTATION GUIDANCE AND TIERS (NORMATIVE)

15.0 Purpose (Normative)

This section specifies minimum compliance requirements by tier and provides operational guidance for applying RippleLogic in real decisions. Tiers define minimum obligations; deployments may exceed them. The framework is designed to improve over time via NCAR learning and governed updates.

15.1 Tier Requirements Matrix (Authoritative; Normative)

Normative authority: This matrix is the single authoritative statement of tier compliance. If any other sentence in this document conflicts with this matrix, this matrix governs.

Tier 3 stewardship assumption (Normative): Any Tier 3 run SHALL set Stw_req(run) = 1 by default because Tier 3 implies external scrutiny and governance-grade assistance posture.

15.2 Tier 1: Heuristic Application (“2-Minute Ripple Check”) (Normative minimum)

Use Tier 1 for low-stakes, reversible decisions where full calculation is disproportionate.

Tier 1 minimum protocol:

• Decision: What must be decided, by when?

• Options: List at least 2 options, including a third-path redesign option where possible.

• Rights screen (RF/NCRC heuristic): Could any option plausibly violate LIFE, BODY, NEED, LBTY, DIGN, PROC, INFO, or ECOL? If yes, escalate to Tier 2+.

• Tail screen (TRC heuristic): Could any option plausibly create catastrophic, irreversible, systemic, or ruin-path downside? If yes, escalate to Tier 2+.

• CSV screen: Could the apparent local gain hollow out, overload, externalize onto, or depend on failure of a larger system, or does the option lack the resources, controls, authority, reversibility, or execution conditions needed to stand? Record CSV_PASS_HEURISTIC, CSV_NOT_MATERIAL, CSV_REDESIGN_REQUIRED, or escalate. An ordinary RippleLogic ranking or selection claim MUST NOT be made without a pass-equivalent CSV result. CSV_PASS_HEURISTIC and CSV_PASS_WITH_CONTROLS_HEURISTIC are human-facing Tier 1 teaching labels, not additional canonical machine tokens. A machine exporter must use the pinned interface and preserve Tier 1 plus heuristic evidence maturity; merely removing a suffix does not establish formal conformance or execution authority. Verified machine interchange requires the applicable registry/schema and replay evidence.

• Scopes touched: Which operational scopes U1 through U7 are materially affected?

• Unioning move: What redesign could reduce harms and increase shared benefit across the affected scopes?

• Choose and record: Compare only options that passed the heuristic qualification screens. If no option passes, redesign, escalate, delay, or refuse rather than forcing a ranking.

Tier 1 recording (recommended): a short note or mini-PCC containing the eight answers and any CSV_NOT_MATERIAL rationale.

Tier-1 Worked Example (informative; shows Tier escalation):

Decision: Accept a new consulting project this month, or decline to protect time for household responsibilities.

Options: (A) Accept as proposed (10 hrs/week for 4 weeks). (B) Decline. (C) Redesign: accept only if scope is reduced to 4 hrs/week and meetings are time-boxed.

Rights screen (heuristic): No plausible LIFE/BODY/NEED/LBTY/DIGN violations. PROC/INFO: contract terms are clear, no coercion. PASS at Tier 1. If any need for deceptive data use or exploitative terms were suspected, escalate to Tier 2.

Tail screen (heuristic): No plausible catastrophic, irreversible, or systemic downside. PASS at Tier 1.

CSV screen: Option A plausibly creates a local income gain by hollowing household stability and personal recovery capacity; record CSV_REDESIGN_REQUIRED. Option B is structurally viable but loses the project benefit; record CSV_PASS_HEURISTIC. Option C includes bounded hours and time-boxed meetings; record CSV_PASS_WITH_CONTROLS_HEURISTIC if the limits are accepted and monitorable.

Scopes touched: U1 Self (Health, Agency, Meaning). U2 Household (Social, Material, Health). U3 Community/Organization impacts minor and reversible.

Unioning move: Option C reduces household harm while capturing some benefit. Compare B and the controlled form of C only after the CSV screen. Choose C if renegotiation succeeds and the controls are real; otherwise choose B if household strain would be material.

Record (mini-PCC): store the eight answers, CSV status, controls, and chosen option so NCAR learning can refine future time-budget decisions.

15.3 Tier 2: Core Calculable (Strict TRC and Proportional CSV Posture) (Normative)

Use Tier 2 for routine but consequential decisions requiring transparent computation and a basic PCC.

Tier 2 minimum obligations:

• Construct impacts on the [-1,+1] scale using the Section 5 pipeline.

• Run RF/NCRC with worst-off subgroup checks for directly affected rights cells, including categorical-prohibition and severe-rights-hazard channels where triggered.

• Execute TRC when catastrophe relevance is plausible: use at least 5 scenarios; include mandatory tail categories and probability floors unless implausible with documented justification; compute CVaR and the corridor check; and record the TRC table in the PCC.

• Complete a proportional, assumption-bounded CSV review for every option before ordinary RLS ranking. Tier 2 CSV MAY use qualitative or proxy evidence where validated structural instruments are unavailable, but it MUST issue one explicit status from the canonical ladder: CSV_PASS, CSV_PASS_WITH_CONTROLS, CSV_NOT_MATERIAL, CSV_REDESIGN_REQUIRED, CSV_ESCALATE, CSV_FAIL, or CSV_EMERGENCY_PROVISIONAL where the emergency protocol applies. A CSV_NOT_MATERIAL result MUST state why no material containment or structural-viability pathway is present. Refusal is a permitted claim or action disposition after CSV_FAIL, unresolved material uncertainty, or failed authority conditions; CSV_REFUSE is not a canonical CSV status token.

• Form the selectable set only from options with adequate RG claim support, RF/NCRC pass, TRC pass, and a pass-equivalent CSV status (CSV_PASS, CSV_PASS_WITH_CONTROLS, or CSV_NOT_MATERIAL).

• Compute RLS only for the selectable set and record the normalized ranking. If no option is selectable, redesign, delay, escalate, or refuse; do not force a score-based choice.

• If the selectable survivors are uncertainty-overlapped or non-decisive, apply only legitimate residual tie-break or authority-selection procedures; do not reopen or rescue a failed qualification level.

• Produce a basic PCC plus 5SPR, including the proportional CSV evidence, status, controls, blind spots, and review trigger.

Tier 2 propagation guidance:

• Default propagation_mode = NONE.

• QUICK propagation is allowed only if KQS policy is satisfied and sensitivity is feasible.

Structural-assurance note (Normative). Proportional CSV is mandatory before ordinary Tier 2 ranking, but its evidence depth is proportional to stakes and measurement maturity. A Tier 2 CSV result based on assumptions, proxies, or qualitative evidence MUST declare those limits. If the principal hazard is plausible hollowing-out, structural degradation, physical/causal inadmissibility, uncontrolled dependency, or other containment-relevant harm that cannot be responsibly bounded at Tier 2, the run MUST escalate to Tier 3, redesign, narrow the claim, or refuse the stronger selection claim. Quantitative UCI is not universally required at Tier 2; explicit structural reasoning and a pass-equivalent CSV status are.

15.4 Tier 3: Standard Auditable (Normative)

Use Tier 3 for high-stakes, contested, or externally scrutinized decisions where auditability and anti-gaming posture are required.

Tier 3 minimum obligations:

• Full PCC (Appendix H), including: impacts, subgroup semantics, scenario library, containment results, RLS, uncertainties, sensitivity, audit flags, signatures.

• NCRC: Subgroup analysis required for rights-covered cells.

• TRC: Required with ≥20 scenarios and mandatory tails plus probability floors (Appendix D).

• CSV / Containment and Structural Viability: Required and binding.

• Sensitivity analysis bundle required:

• Weights perturbation,

• Rights threshold perturbation (±0.05 on θ_r as a sensitivity test),

• Kernel perturbation if QUICK used,

• Scenario probability perturbation,

• Direct saturation β perturbation and, where RF/NCRC is material, rights saturation β_RF perturbation,

• Baseline sensitivity for non-maskable FLOOR_REFERENCE cells when a defensible STATUS_QUO welfare counterfactual exists.

• Kernel: QUICK permitted only if KQS policy permits:

• KQS < 0.40: NONE only,

• 0.40-0.50: QUICK plus mandatory sensitivity,

• ≥0.50: QUICK permitted plus sensitivity.

• FULL propagation is prohibited for Tier 1-3 claims.

15.4A Conformance, empirical readiness, and reference implementation posture (Normative clarification)

Tier 1-3 run-level conformance claims concern whether a particular run satisfies the requirements of this specification. They are distinct from framework-level empirical operational-readiness claims about comparative real-world performance, calibration quality, or superiority over alternative governance methods. Tier 3 run-level conformance means the run satisfies Tier 3 procedural, evidentiary, and audit requirements as declared; it does not by itself imply that every structural indicator family used for UCI or Containment is externally validated, mature across domains, or empirically calibrated beyond the declared measurement pack.

Reference implementation posture (Informative with binding disclosure consequence). This Foundation Paper normatively defines conformance without requiring a published reference implementation. However, project custodians SHOULD publish sibling reference implementation artifacts consisting at minimum of a machine-readable PCC schema, validator rule set, and executable Appendix R fixtures. Until such artifacts are published in a release manifest, framework-level claims of replay-grade operational readiness MUST remain provisional even where run-level Tier 1-3 conformance is possible.

Evidence-generating adoption posture (Normative research guidance). Where lawful, ethical, and operationally feasible, a preregistered sample of Tier 3 runs SHOULD include a shadow comparator, alternative method, or independent parallel review so ordinary use can contribute comparative evidence rather than only conformance records. The sampling fraction, comparator, outcome measures, and publication rule MUST be declared before results are known. A comparator is not required when it would create unacceptable rights, safety, confidentiality, or operational burdens; such exclusions MUST be recorded. This guidance creates no deployment permission and does not turn routine records into validation evidence without a declared study design. For comparative claims, declare the actual comparator rules and match evidence access, relevant rights/risk constraints and review resources. A simplified unconstrained scalar comparator supports only the corresponding ablation claim.

15.4B Option-Set Closure and Challenger Generation (Normative)

A ranking cannot establish superiority over a feasible option that was never generated. Tier 3 and high-stakes Tier 2 runs SHALL create an OptionClosureRecord before unique selection. The OptionClosureRecord MUST identify the option-generation methods and candidate sources used, the search or challenge effort proportionate to stakes, who generated and challenged the alternatives, and why each material option class was included or excluded. Model-generated alternatives remain candidates whose feasibility, rights, risk, and viability require independent qualification.

The record SHALL consider, where feasible: no action or expected continuation; delay; staged or reversible trial; redesign; constitutive mitigation; materially cleaner or safer alternative; and a plausible hybrid/challenger option. Each omitted class requires a reason linked to feasibility, legality, evidence, or decision boundary.

An option set dominated by one favored proposal and deliberately weak comparators, or lacking a plausible no-action/redesign/challenger path without rationale, sets OPTION_SET_THIN. A thin set may support exploratory analysis but MUST NOT support a strong unique-selection claim until reviewed.

Option generation remains proportional. Low-stakes Tier 1 decisions may use a concise record; the rule is not a requirement to invent implausible options.

15.5 NCAR Integration by Tier (Normative)

All tiers SHOULD operate within NCAR.

Reflect cadence defaults:

• Tier 2: Within 6 months or after major outcome data

• Tier 3: Within 3-6 months or after major outcome data

• Emergency/Fallback: Review cadence per declared severity and risk

15.6 Improvement and Future Upgrades (Normative stance)

RippleLogic is corrigible. Any improvement MUST:

• Preserve NCRC/TRC non-compensability structure,

• Be explicit, versioned, and auditable (AIL),

• Be tested under the validation program (Section 17),

• And be introduced via governed update processes (NCAR Reflect plus versioning).

SECTION 16: RELATIONSHIP TO EXISTING FRAMEWORKS (INFORMATIVE)

16.0 Purpose

This section positions RippleLogic relative to existing ethical, governance, and decision frameworks. It clarifies structural differences and interfaces.

16.1 Compared to Utilitarianism / Cost-Benefit Analysis (CBA)

CBA often scalarizes plural values into a single metric (money/utility), enabling rights tradeoffs. RippleLogic blocks this via NCRC (rights as constraints) and TRC (tail risk as constraint), then optimizes welfare only within the admissible set.

16.2 Compared to Deontology (Rule-based ethics)

Pure deontology can lack a complete operational procedure for comparing permitted options under uncertainty. RippleLogic retains non-compensable constraints but adds computable consequence modeling and tail-risk bounding.

16.3 Compared to Rawlsian Justice and Capability Approaches

Rawls provides priority of liberty and fair basic structure; capabilities provide multi-dimensional flourishing. RippleLogic operationalizes multi-dimensional welfare into a computable 7×7 matrix and makes rights floors explicit across unions.

16.4 Compared to MCDA (Multi-Criteria Decision Analysis)

Unconstrained compensatory MCDA models aggregate criteria without the non-compensable constraints used here (Keeney & Raiffa, 1976; Belton & Stewart, 2002). MCDA also includes constrained, lexicographic and non-compensatory methods; qualification before ranking is not unique to RippleLogic. Its comparison claim concerns the particular integration of rights, tail-risk and containment rules, residual RLS, uncertainty refusal and auditable interfaces. Comparative studies must name and implement a credible constrained comparator with matched evidence and resources; a pure weighted sum alone is an ablation, not evidence of superiority over MCDA generally.

16.5 Compared to AI Alignment Toolsets (RLHF, Constitutional AI, risk frameworks)

Many alignment approaches train systems toward proxies (human feedback, constitutional principles) without hard admissibility gates. RippleLogic provides a decision-engine architecture: action-space filtering by NCRC/TRC/CSV, structured welfare scoring (RLS), auditable traces (PCC), and corrigibility via NCAR.

16.6 Interoperability with Governance Standards

RippleLogic is designed to be interoperable with governance regimes emphasizing accountability and risk management (for example, NIST AI RMF) through its PCC record, scenario governance, and explicit risk bounding. It adds formal lexicographic rights and tail-risk operators that many standards leave at a principles level.

16.7 Compared to Commons Governance

RippleLogic is compatible with institutional approaches to governing shared resources and externalities. Where commons governance emphasizes rules-in-use, monitoring, graduated sanctions, and polycentric coordination, RippleLogic contributes a computable, auditable decision cascade that makes rights floors, tail-risk bounds, and cross-union ripple effects explicit in each decision record (Ostrom, 1990).

16.8 RLS Validation and Calibration Status (Informative bridge)

Current status. RLS is a candidate structured residual welfare-scoring specification and audit method, subject to the candidate acceptance checks and disclosed unresolved findings. It does not yet claim empirical validation of the dimensional non-overlap of the 7x7 welfare field, calibrated decisiveness thresholds, or inter-rater reliability of cell-filling across independent analysts. A companion RLS Validation Protocol should test these claims through scored-case datasets, correlation/factor analysis across the 49 cells, inter-rater reliability studies, disagreement heatmaps, scalar-comparator analysis, and revision rules. Until those studies are completed, public claims should say that RLS has an explicit auditable structure with disclosed specification and evidence limits, not that it is empirically proven to produce superior decisions.

SECTION 17: VALIDATION, FALSIFICATION, AND RESEARCH PROGRAM (NORMATIVE FOR CLAIMS)

17.0 Purpose (Normative)

RippleLogic makes testable claims about decision quality, rights protection, tail-risk avoidance, and auditability. This section specifies explicit falsification criteria and a staged validation program. Until such validation is completed, RippleLogic remains a theory-to-practice system with bounded claims: Tier compliance is claimable, real-world performance superiority is not.

This validation program follows a falsification-first posture consistent with scientific corrigibility: components that fail their empirical tests must be revised or abandoned rather than defended by authority (Popper, 1959).

17.0A Layered Falsification Attribution Rule (Normative for validation claims)

A failure must be attributed to the layer it actually falsifies before a broader falsification claim is made. A failed measurement does not by itself falsify the framework; a failed projection does not by itself falsify a rights floor; and a failed gate operator must not be excused as mere input error when all admissible data, projection, and parameter alternatives have been ruled out. A failed preregistered operational prescription remains a failure of that version and claim even when broader causal or operator attribution remains unresolved. Subsequent repaired versions do not retrospectively validate the failed prescription.

Every recorded validation failure SHOULD include both FalsificationClass and FalsificationLayer. Recommended FalsificationLayer values are DATA, PROJECTION, PARAMETER, GATE_OPERATOR, PRIMITIVE, GOVERNANCE, and COMMUNICATION.

Validator guidance. A failure logged without FalsificationLayer SHOULD trigger FALSIFICATION_LAYER_UNATTRIBUTED. A run that invokes PRIMITIVE or GATE_OPERATOR failure without first addressing plausible DATA, PROJECTION, and PARAMETER explanations SHOULD trigger FALSIFICATION_LAYER_SKIPPED and require escalation. Before confirmatory testing, freeze the admissible attribution family, inclusion rules, stopping rule and treatment of unresolved alternatives. A formally bounded family needs a stated proof or exhaustive verification criterion. Keep failed locked tests visible; new alternatives or repairs require a new version/run and do not reopen the original success criterion. Where broader attribution cannot be resolved, report it as unresolved while withdrawing or narrowing the unsupported original performance claim.

Additional v12.0 do-not-collapse rules. Structural viability is not ethical permissibility. Stability is not justice. Permission is not admissibility. Output generation is not an admissible reference. A plan that can stand structurally can still violate rights; a generated answer can still lack a valid reference; and an authorized action can still fail the MathGov cascade.

17.1 Core Empirical Claims (Testable Hypotheses)

17.1A MNA-Layer Empirical Hypotheses (Normative research frontier)

H-MNA1 (model adequacy under stakeholder omission). Multi-agent predictive performance worsens when stakeholder welfare, rights, or enabling-condition variables are omitted from world models in settings where cooperation, conflict, or harm depend materially on them.

H-MNA2 (instability under normative omission). Architectures that systematically ignore stakeholders’ welfare conditions, rights floors, or enabling conditions exhibit higher instability, defection, tail risk, or containment failure in repeated multi-agent environments than otherwise comparable architectures that track them explicitly.

H-MNA3 (cascade advantage over unconstrained scalarization). Rights-first and catastrophe-bounded cascade architectures reduce ruin-like outcomes, rights breaches, or coherence losses relative to unconstrained scalar optimization in comparable decision classes.

Because ripple effects partially track cooperation and network propagation dynamics, validation should also test whether kernel updates improve predictive performance in contexts where cooperation and trust dynamics are known to matter (Axelrod, 1984; Nowak, 2006; Christakis & Fowler, 2009).

H6 (PLSS prominence convergence). For recurring decision classes with standardized guidance, independently trained evaluators applying the same evidence base will produce PLSS prominence vectors with moderate or better convergence, operationalized in pilot testing by a pre-declared inter-rater agreement threshold.

H7 (PLSS floor activation). In a non-trivial fraction of PLSS-assessed decisions, constitutional floor weights assigned to guardrail scopes will contribute materially to final welfare ranking differences, demonstrating that guardrail scope retention is operational rather than merely decorative.

H8 (PLSS escalation fidelity). In pilot validation, plausible ET-trigger conditions will be detected and logged with sufficient sensitivity that PLSS posture is not systematically retained in clearly non-local cases.

17.1B Taxonomy and Implementation Falsification

Claims of improved dimensional separation, irreducibility or practical superiority require preregistered comparisons against plausible merges, splits and simpler alternatives. Report effect-boundary confusion, duplicate-effect coding, omitted outcomes, subgroup visibility, classification agreement, burden, explanation quality and decision reversals separately. Any composite of these criteria requires a justified scale and ex-ante weighting; adding incomparable loss quantities does not prove an optimum. Causal covariance is not an automatic redundancy penalty.

The adversarial fixture suite shall include sign inversions, missing/unknown values, duplicate effects/messages, evidence revisions, kernel direction and double propagation, nonlinear attribution, late or ungrounded controls, resource depletion, repeated recovery, uncertain outcomes, isolated operation, authority/quorum failure, privacy-proof overclaims and source/render drift. Synthetic scenario values and engineering stress-test traces test implementation or reasoning under assumptions; they are not observed societal data or empirical validation of the framework.

Use component-specific evidence labels: defined, implemented within named scope, tested under named fixtures, empirically validated for a domain, and independently validated are distinct. A passing unit test, rendered dashboard, replicated database, cryptographic proof or compiled artifact cannot upgrade a different claim. The exact verification report governs what was tested in this package.

17.2 Falsification Criteria (Normative)

17.2A MNA-Layer Falsifiers (Normative)

F-MNA1. Omission of welfare, rights, or enabling-condition variables does not reduce predictive adequacy in relevant multi-agent domains where those variables were hypothesized to matter materially.

F-MNA2. Architectures ignoring such conditions do not exhibit higher instability, tail risk, rights breach incidence, or containment failure than comparable architectures that track them explicitly.

F-MNA3. Cascade-constrained policies do not outperform unconstrained scalarized policies on declared rights, coherence, or tail-risk metrics in the relevant validation class.

Defect attribution prior to invoking F1-F5 follows the Appendix AE.3 layer matrix: each failure should be assigned to the layer it actually falsifies before any broader empirical falsifier is invoked.

RippleLogic components must be revised (or rejected) if evidence meets any of the following:

17.3 Validation Phases (Normative roadmap)

Phase 1: Formal verification and implementation testing (0-6 months)

• Independent implementation of Tier 2-3 algorithms from spec.

• Unit tests for canonical equations (Appendix B).

• Adversarial tests for masking, subgroup erasure, scenario omission, confidence inflation.

• Produce reference PCCs and reproducibility checks.

Phase 2: Measurement validation (4-15 months)

• Indicator reliability and validity for welfare dimensions and UCI components.

• Cross-population measurement checks where relevant.

• Calibrate magnitude anchors and uncertainty mappings.

Phase 3: Controlled pilots (10-24 months)

• Pilot deployments in organizations or municipalities.

• Compare RippleLogic vs baseline governance processes on: rights incidents, tail losses, stakeholder legitimacy, audit completeness, decision reversal rates.

Phase 4: Field studies and scaling (18-36+ months)

• Longitudinal monitoring of UCI/HOI and realized outcomes.

• Kernel calibration and scenario library refinement.

• Comparative performance across domains.

17.4 Metrics and Targets (Normative defaults)

17.4A Inter-Rater Reliability Commitment (Normative commitment)

IRR single-source rule (Normative).

The target table in this section controls. The RLS Validation Protocol mirrors and operationalizes it; any divergent threshold or statistic in a companion is non-controlling until adopted here. The numeric targets below are retained as provisional research targets. They become a reliability acceptance criterion only after a design-specific mapping is preregistered and its applicability justified; they are not interchangeable validated cutoffs for different statistics.

Before Tier 3 operational-readiness claims are made, the framework SHALL publish or register at least one inter-rater reliability (IRR) study on a representative case set covering: (i) welfare-cell anchoring, including magnitude construction mu_k using both percentile anchoring and threshold anchoring methods, (ii) rights-floor evaluation, including subgroup identification and worst-off impact estimation, (iii) local-scope/PLSS usage, including prominence signal construction and scope classification, and (iv) scenario construction and probability assignment for TRC.

The study MUST report the case set, evaluator instructions, adjudication procedure, disagreement classes, and reliability statistics appropriate to the data type used. For each component, freeze the measurement level and unit, case/rater design, primary preregistered reliability statistic and exact variant (including ICC model, unit and agreement/consistency choice where applicable), applicable target, point-estimate or confidence-interval decision rule, prevalence/class distribution, dependence and missingness treatment, and undefined-statistic handling. The companion protocol supplies design guidance, not permission to choose a favorable statistic after observing results. Raw percent agreement cannot substitute for an ICC, kappa or other named criterion. Undefined results are unresolved; they cannot demonstrate readiness. Until this mapping is adopted, reliability-based operational-readiness claims remain unavailable.

Sustained inability to exceed the minimum acceptable threshold on any component after rubric training indicates that the component requires redesign or additional anchoring guidance. Apply that interpretation only to the preregistered estimator/design mapping; do not infer measurement failure by moving an unvalidated numerical cutoff between statistics.

Until such evidence exists, Tier 3 remains architecturally specified but empirically incomplete.

17.5 Study Design Requirements (Normative)

• Pre-registration required for pilots claiming performance improvements.

• For causal or comparative-effect claims, a claim-specific identification plan is REQUIRED: target estimand; intervention and credible comparator/counterfactual; population and horizon; identification assumptions; selection, confounding and interference treatment; measurement; and an explicit identification-status verdict. The design may be experimental or a justified non-experimental design. Pre/post change alone does not identify an incremental effect. Without adequate causal warrant, restrict claims to the supported descriptive, predictive or procedural scope. A comparator remains recommended for other exploratory performance work.

• Blinding recommended for backtests: analyst should not know outcome during the run.

17.5A Projection Pre-Registration

17.5A.5 Freeze-Hash and Unique-Prediction Requirement (Normative for public validation and ProofPack-prep claims)

A validation claim is not falsifiable unless the projection was frozen before outcome evidence was consulted. For Tier 3 public pilots, public validation claims, and ProofPack-prep runs, ProjectionPreRegistration SHOULD include projection_freeze_hash, freeze_timestamp_utc, prediction_scope, predicted_observable_consequence_class, outcome_observation_timestamp, and post_observation_modification.

A material validation claim SHOULD produce exactly one predicted observable consequence class or a declared finite prediction set with pre-specified resolution rule. If the projection produces no prediction, an open-ended prediction, or a non-unique prediction without resolution rule, the claim is exploratory rather than falsifiable and SHOULD be marked NON_UNIQUE_PREDICTION or EXPLORATORY_ONLY.

If post_observation_modification=TRUE for a material validation claim, the run MUST NOT be used as a falsification test for that claim and SHOULD set POST_HOC_PROJECTION_INVALID with severity INVALID. A revised projection requires a new freeze hash and a new run. (Normative for pilots and Tier 3; Recommended otherwise)

Purpose. To preserve falsifiability and prevent post-hoc projection drift, pilot runs and Tier 3 runs SHALL pre-register the projection map from declared inputs to admissibility verdict before decision data is consulted in a way that could influence parameter selection.

17.5A.1 ProjectionPreRegistration object (Normative)

A ProjectionPreRegistration object SHALL be emitted, signed, timestamped, and stored before any cascade computation that contributes to a pilot or Tier 3 decision record. It SHALL contain at minimum: decision boundary, time horizon, and option set; stakeholder discovery record, including LSS and instance-to-scope mapping; rights coverage set C_r and per-right thresholds theta_r, including any non-default values with justification; catastrophe cell set C_cat, scenario set S, scenario probabilities p_s, CVaR confidence alpha, and TRC corridor tau_TRC; Containment trigger conditions and containing scopes; constitutional weight floors and any tier-appropriate non-default weights with justification; SGP v8.8 binding for impacted stakeholders, including target/record id, MPS band and interval, FPP status, validity status, and planned interval-sensitivity points; subgroup uplift gamma_subgroup and any non-default value with justification; kernel mode and kernel quality status where applicable; sensitivity sweep specification; pre-declared falsification, refusal, escalation, and re-run conditions.

17.5A.2 Modification discipline (Normative)

Once emitted, the ProjectionPreRegistration object SHALL NOT be materially modified after observation in any way that affects admissibility, selectability, selection, or conformance claims.

If material modification is required, the current run SHALL enter Refusal under Section 4.9, document the reason in PCC.RefusalRecord, and emit a new ProjectionPreRegistration object before any subsequent run.

Non-material corrections, including typographical corrections, reference updates, or formatting changes that do not alter values or verdict logic, MAY be applied with version increment and documented diff.

17.5A.3 Tier application (Normative)

Tier 3: Projection Pre-Registration is REQUIRED for all runs.

Tier 2: Projection Pre-Registration is REQUIRED for pilots and RECOMMENDED otherwise.

Tier 1: Projection Pre-Registration is RECOMMENDED where stakes are medium or high.

17.5A.4 Storage and audit (Normative)

The ProjectionPreRegistration object SHALL be stored with the PCC and referenced by hash. An independent reviewer SHALL be able to reconstruct the declared projection map from the stored object using only the applicable canon, declared evidence base, and referenced companion artifacts.

17.6 Backtesting Protocol (Normative)

A backtest run MUST:

• Reconstruct the information available at decision time (no hindsight leakage),

• Define an option set consistent with the historical context,

• Execute RippleLogic using only those inputs,

• Record a “Backtest PCC” with full trace,

• Score predictions against realized outcomes using declared metrics.

17.7 Open Science and Responsible Disclosure (Normative intent)

Where feasible, publish:

• Anonymized PCC datasets,

• Scenario libraries and kernels (with evidence notes),

• Failure cases and revisions.

Security note: Where publishing would create exploitation risk, disclosure should be responsible and staged, but internal auditability must be preserved.

SECTION 18: APPLICATIONS AND USE CASES (INFORMATIVE)

18.1 AI Deployment Governance (Tier 3)

Decision context: An organization is deciding whether to deploy an AI system that affects users at scale.

Key obligations:

• NCRC: Protect dignity, information integrity, due process for worst-off subgroups.

• TRC: Model catastrophic tails (infrastructure disruption, mass manipulation, cascading conflict).

• Containment: Avoid organizational gains that degrade Polity/Humanity coherence (legitimacy collapse, epistemic fragmentation).

• PCC: Produce auditable trace; ensure comparability across options.

18.2 Climate and Energy Policy (Tier 3)

Decision context: A polity evaluates energy transition policies that impact households, industries, and biosphere stability.

Key obligations:

• NCRC: Protect basic needs (energy poverty), health, life.

• TRC: Include climate tipping cascade scenarios; enforce corridor.

• Containment: Prevent short-term gains from degrading Biosphere UCI beyond tolerance.

18.3 Organizational Strategy (Tier 2-3)

Decision context: Organization deciding on major restructuring, automation, supply chain change.

Key obligations:

• NCRC: Protect basic needs and dignity for worst-off employees/communities.

• TRC: Required at Tier 2 if catastrophe relevance is plausible.

• Containment: Detect hollowing-out risk even if near-term welfare improves.

18.4 Personal and Household Decisions (Tier 1)

Decision context: Personal choices (job change, relocation, major purchase) where stakes are limited and reversible.

Use Tier 1 heuristic: options, rights screen, tail screen, unions touched, unioning redesign.

Escalate to Tier 2 if any plausible rights risk exists or if the decision touches catastrophe relevance.

SECTION 19: LIMITATIONS AND NON-TARGETS (NORMATIVE BOUNDARIES)

19.1 Epistemic Limitations (Normative acknowledgment)

Input quality dependence: RippleLogic outputs are only as good as the evidence and estimation process. The framework reduces predictable failures but does not guarantee correct forecasts.

Measurement difficulty: Some dimensions (Meaning; aspects of Agency) are harder to measure reliably across cultures. RippleLogic treats such measurement with caution and uncertainty documentation.

Kernel uncertainty and operational status: Ripple propagation via the QUICK kernel mode is architecturally specified and canon-complete for Tier 1-3 implementation. However, the Starter KOPS (Appendix K) carries evidence classes B and E with a global shrink factor of 0.35, and the KQS policy (Section 6.5) requires KQS >= 0.40 for any kernel use. In practice, most early Tier 2-3 runs are expected to operate in NONE propagation mode because domain-specific kernels with sufficient evidence coverage, identifiability, and predictive validation do not yet exist. The NONE mode is a valid and conformant propagation posture, not a workaround. Building empirically grounded kernels with KQS >= 0.50 is a Phase 2-3 validation priority (Section 17.3). Ripple-awareness is already operational in the current release line through the multi-scope welfare matrix (which makes cross-scale consequences visible), through containment (which detects cross-scale degradation), and through UCI/HOI (which monitors structural integrity). Numerical kernel-based propagation remains a design-ready capability awaiting domain-specific calibration. The current release line mitigates kernel uncertainty with KQS policy, sensitivity requirements, and humility fallback to NONE.

Scenario incompleteness: Scenario libraries cannot enumerate all tail risks; mandatory tail categories reduce omission but cannot eliminate deep uncertainty.

19.2 Institutional and Governance Prerequisites

Tier 3 requires trained analysts and governance capacity: subgroup analysis, scenario governance, structural indicators for UCI, and audit review.

HDW governance can be captured if safeguards are weak. RippleLogic mandates anti-capture mechanisms, but real-world institutions must implement them.

19.3 Risks of Compliance Theater

Any framework can be used as a rubber stamp. RippleLogic mitigates via:

• Hard gates (NCRC/TRC/CSV),

• Non-maskable cells and audit flags,

• Challenger requirement in emergency mode,

• Required PCC traceability and sensitivity.

Nonetheless, compliance theater remains a risk; validation and external scrutiny matter.

19.4 Non-Targets (Normative)

RippleLogic is NOT designed to:

• Replace personal moral dialogue in intimate relationships,

• Dictate aesthetic or spiritual preferences,

• Resolve all deep metaphysical disagreements,

• Provide certainty under irreducible uncertainty,

• Function as a rhetorical weapon to end debate.

It is a public decision operating system: a method for auditable, multi-stakeholder, high-consequence decisions.

SECTION 20: CONCLUSION: PROSPEROUS FUTURES FOR INTELLIGENCES

20.1 Prosperity Defined (Normative operational definition)

In RippleLogic terms:

Prosperity = rights-safe (NCRC) + tail-safe (TRC) + containment-safe + net-positive welfare across unions + coherence preserved (UCI/HOI safeguards) + corrigible learning (NCAR)

This definition blocks false prosperity:

• “Growth” that violates rights is not prosperity.

• “Efficiency” that increases catastrophic exposure is not prosperity.

• “Success” that hollows out structural coherence is not prosperity.

20.2 RippleLogic Thesis

Alignment across humans, institutions, and AI requires non-compensable constraints on rights and catastrophic risk, explicit modeling of ripple propagation through layered and intersecting analytical scopes, transparent and auditable decision procedures, and corrigible learning loops. These requirements are motivated by interdependence in complex systems (Meadows, 2008; Newman, 2010), planetary life-support constraints (Steffen et al., 2015; Rockström et al., 2009, 2023), and the asymmetric tail-risk properties of ruin dynamics (Taleb, 2012; Ord, 2020).

20.3 Call to Test, Critique, and Deploy (Normative stance)

RippleLogic v13.0 is a spec-hardened scaffold intended to be tested, falsified where wrong, refined where incomplete, and used proportionally to stakes. The method is designed to move societies toward ethically, sustainably, harmoniously, prosperously, and verifiably coordinated flourishing by making decision structure explicit, auditable, and corrigible.

REFERENCES (APA 7)

Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., & Mané, D. (2016). Concrete problems in AI safety. arXiv. https://doi.org/10.48550/arXiv.1606.06565

Arrow, K. J. (1963). Social choice and individual values (2nd ed.). Yale University Press.

Artzner, P., Delbaen, F., Eber, J.-M., & Heath, D. (1999). Coherent measures of risk. Mathematical Finance, 9(3), 203–228. https://doi.org/10.1111/1467-9965.00068

Axelrod, R. (1984). The evolution of cooperation. Basic Books.

Barabási, A.-L., & Albert, R. (1999). Emergence of scaling in random networks. Science, 286(5439), 509–512. https://doi.org/10.1126/science.286.5439.509

Becker, G. S. (1981). A treatise on the family. Harvard University Press.

Belton, V., & Stewart, T. J. (2002). Multiple criteria decision analysis: An integrated approach. Kluwer Academic Publishers.

Bostrom, N. (2014). Superintelligence: Paths, dangers, strategies. Oxford University Press.

Bowlby, J. (1988). A secure base: Parent-child attachment and healthy human development. Basic Books.

Christakis, N. A., & Fowler, J. H. (2009). Connected: The surprising power of our social networks and how they shape our lives. Little, Brown and Company.

Council of Europe. (1950). Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights). https://www.echr.coe.int/the-convention

Dunbar, R. I. M. (1992). Neocortex size as a constraint on group size in primates. Journal of Human Evolution, 22(6), 469–493. https://doi.org/10.1016/0047-2484(92)90081-J

Dunbar, R. I. M. (1993). Coevolution of neocortical size, group size and language in humans. Behavioral and Brain Sciences, 16(4), 681–735. https://doi.org/10.1017/S0140525X00032325

Edmondson, A. (1999). Psychological safety and learning behavior in work teams. Administrative Science Quarterly, 44(2), 350–383. https://doi.org/10.2307/2666999

Estes, J. A., Terborgh, J., Brashares, J. S., Power, M. E., Berger, J., Bond, W. J., Carpenter, S. R., Essington, T. E., Holt, R. D., Jackson, J. B. C., Marquis, R. J., Oksanen, L., Oksanen, T., Paine, R. T., Pikitch, E. K., Ripple, W. J., Sandin, S. A., Scheffer, M., Schoener, T. W., … Wardle, D. A. (2011). Trophic downgrading of planet Earth. Science, 333(6040), 301–306. https://doi.org/10.1126/science.1205106

Floridi, L. (2013). The ethics of information. Oxford University Press.

Goodhart, C. A. E. (1984). Problems of monetary management: The UK experience. In C. A. E. Goodhart (Ed.), Monetary theory and practice: The UK experience (pp. 91–121). Macmillan.

Hammond, J. S., Keeney, R. L., & Raiffa, H. (1998). Smart choices: A practical guide to making better decisions. Harvard Business School Press.

Integrated Food Security Phase Classification (IPC) Global Partners. (n.d.). Integrated Food Security Phase Classification (IPC) framework and tools. Retrieved February 19, 2026, from https://www.ipcinfo.org/

Intergovernmental Panel on Climate Change. (2023). Climate change 2023: Synthesis report. https://doi.org/10.59327/IPCC/AR6-9789291691647

International Labour Organization. (1998). ILO Declaration on Fundamental Principles and Rights at Work and its Follow-up. Retrieved February 19, 2026, from https://www.ilo.org/ilo-declaration-fundamental-principles-and-rights-work/about-declaration/text-declaration-and-its-follow

International Labour Organization. (2012). ILO indicators of forced labour (Special Action Programme to Combat Forced Labour). https://www.ilo.org/publications/ilo-indicators-forced-labour

Kahneman, D., & Tversky, A. (1979). Prospect theory: An analysis of decision under risk. Econometrica, 47(2), 263–291. https://doi.org/10.2307/1914185

Keeney, R. L., & Raiffa, H. (1976). Decisions with multiple objectives: Preferences and value tradeoffs. Wiley.

Lenton, T. M., Held, H., Kriegler, E., Hall, J. W., Lucht, W., Rahmstorf, S., & Schellnhuber, H. J. (2008). Tipping elements in the Earth’s climate system. Proceedings of the National Academy of Sciences, 105(6), 1786–1793. https://doi.org/10.1073/pnas.0705414105

Manheim, D., & Garrabrant, S. (2018). Categorizing variants of Goodhart’s law. arXiv. https://doi.org/10.48550/arXiv.1803.04585

March, J. G., & Simon, H. A. (1958). Organizations. Wiley.

Max-Neef, M. A. (1991). Human scale development: Conception, application and further reflections. Apex Press.

McGaughran, J. (2026). Sentience Gradient Protocol (SGP) v8.8 [Specification]. MathGov Institute for Ethical Systems Design. Historical lineage: SGP v8.5 [Specification]; SGP v8.4 [Specification]; Sentience Gradient Protocol (SGP) v7.0 [Specification]; v6.0 [Specification]; v5.6 [Specification]; v5.5 [Specification]; v5.3 [Specification]; v5.2.1 [Specification]; v5.2 [Specification]; and v4.7.2 [Historical predecessor specification].

Meadows, D. H. (2008). Thinking in systems: A primer. Chelsea Green Publishing.

National Institute of Standards and Technology. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1). https://doi.org/10.6028/NIST.AI.100-1

Newman, M. E. J. (2010). Networks: An introduction. Oxford University Press.

North, D. C. (1990). Institutions, institutional change and economic performance. Cambridge University Press.

Nowak, M. A. (2006). Five rules for the evolution of cooperation. Science, 314(5805), 1560–1563. https://doi.org/10.1126/science.1133755

Nussbaum, M. C. (2011). Creating capabilities: The human development approach. Harvard University Press.

Odum, E. P. (1971). Fundamentals of ecology (3rd ed.). W. B. Saunders.

Ord, T. (2020). The precipice: Existential risk and the future of humanity. Hachette Books.

Ostrom, E. (1990). Governing the commons: The evolution of institutions for collective action. Cambridge University Press.

Popper, K. (1959). The logic of scientific discovery. Hutchinson.

Putnam, R. D. (2000). Bowling alone: The collapse and revival of American community. Simon & Schuster.

Rawls, J. (1971). A theory of justice. Harvard University Press.

Reporters Without Borders. (n.d.). World Press Freedom Index. Retrieved February 19, 2026, from https://rsf.org/en/index

Rockafellar, R. T., & Uryasev, S. (2000). Optimization of conditional value-at-risk. Journal of Risk, 2(3), 21–41. https://doi.org/10.21314/JOR.2000.038

Rockström, J., Gupta, J., Qin, D., Lade, S. J., Abrams, J. F., Andersen, L. S., Armstrong McKay, D. I., Bai, X., Bala, G., Bunn, S. E., Ciobanu, D., DeClerck, F., Ebi, K., Gifford, L., Gordon, C., Hasan, S., Kanie, N., Lenton, T. M., Loriani, S., … Zhang, X. (2023). Safe and just Earth system boundaries. Nature, 619(7968), 102–111. https://doi.org/10.1038/s41586-023-06083-8

Rockström, J., Steffen, W., Noone, K., Persson, Å., Chapin, F. S., Lambin, E. F., Lenton, T. M., Scheffer, M., Folke, C., Schellnhuber, H. J., Nykvist, B., de Wit, C. A., Hughes, T., van der Leeuw, S., Rodhe, H., Sörlin, S., Snyder, P. K., Costanza, R., Svedin, U., … Foley, J. A. (2009). A safe operating space for humanity. Nature, 461(7263), 472–475. https://doi.org/10.1038/461472a

Russell, S. (2019). Human compatible: Artificial intelligence and the problem of control. Viking.

Ryan, R. M., & Deci, E. L. (2000). Self-determination theory and the facilitation of intrinsic motivation, social development, and well-being. American Psychologist, 55(1), 68–78. https://doi.org/10.1037/0003-066X.55.1.68

Sen, A. (1999). Development as freedom. Knopf.

Sen, A. (2009). The idea of justice. Harvard University Press.

Simon, H. A. (1962). The architecture of complexity. Proceedings of the American Philosophical Society, 106(6), 467–482.

Steffen, W., Richardson, K., Rockström, J., Cornell, S. E., Fetzer, I., Bennett, E. M., Biggs, R., Carpenter, S. R., de Vries, W., de Wit, C. A., Folke, C., Gerten, D., Heinke, J., Mace, G. M., Persson, L. M., Ramanathan, V., Reyers, B., & Sörlin, S. (2015). Planetary boundaries: Guiding human development on a changing planet. Science, 347(6223), 1259855. https://doi.org/10.1126/science.1259855

Taleb, N. N. (2012). Antifragile: Things that gain from disorder. Random House.

United Nations. (1966). International Covenant on Civil and Political Rights. United Nations Treaty Collection. Retrieved February 19, 2026, from https://treaties.un.org/Pages/ViewDetails.aspx?src=TREATY&mtdsg_no=IV-4&chapter=4&clang=\en

United Nations. (1984). Convention against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment. United Nations Treaty Collection. Retrieved February 19, 2026, from https://treaties.un.org/Pages/ViewDetails.aspx?src=TREATY&mtdsg_no=IV-9&chapter=4&clang=\en

United Nations Human Settlements Programme (UN-Habitat). (2003). The challenge of slums: Global report on human settlements 2003. Earthscan. Retrieved February 19, 2026, from https://unhabitat.org/the-challenge-of-slums-global-report-on-human-settlements-2003

United Nations Office on Genocide Prevention and the Responsibility to Protect. (2014). Framework of Analysis for Atrocity Crimes. Retrieved February 19, 2026, from https://www.un.org/en/genocideprevention/publications.shtml

Üstün, T. B., Kostanjsek, N., Chatterji, S., & Rehm, J. (Eds.). (2010). Measuring health and disability: Manual for WHO Disability Assessment Schedule (WHODAS 2.0). World Health Organization. https://iris.who.int/handle/10665/43974

Weber, M. (1978). Economy and society (G. Roth & C. Wittich, Eds.). University of California Press. (Original work published 1922)

World Health Organization. (2001). International classification of functioning, disability and health (ICF). Retrieved February 19, 2026, from https://www.who.int/standards/classifications/international-classification-of-functioning-disability-and-health

World Justice Project. (n.d.). Rule of Law Index. Retrieved February 19, 2026, from https://worldjusticeproject.org/rule-of-law-index/

APPENDICES

APPENDIX A: SYMBOLS AND NOTATION (v12.0)

Appendix A is normative for symbol meanings and domains. Use the Notation scope rule in Section 0.4 (the specification contract hosted in Appendix AC) when symbols share a glyph; indices, field paths and owning equations distinguish them. Appendix origin stamps record lineage, not expiry of carried-forward provisions.

Terminology note (Normative). u indexes Union Scopes (short: Scopes). “Union(s)” remains an allowed legacy alias. This does not change meanings in v9.0 and earlier, it clarifies the canonical term in v9.0.

RealityGroundingRecord / RCR: A PCC-linked record identifying a run’s decision-relevant reality surface, material reality claims, evidence traces, declared unknowns, RealityGroundingStatus, vehicle/content/effect notes where social or institutional constructs are material, surface/territory limitations, and falsification or monitoring triggers. This is the canonical record. The older label RealitySurfaceRecord is deprecated and may be used only as a legacy full-text alias for the surface-description portion of RCR; RSR MUST NOT be used for RealitySurfaceRecord. To avoid acronym collision with ReferenceStructureRecord, use RCR for RealityGroundingRecord and RefStructRecord for ReferenceStructureRecord where abbreviations are needed.

RealityGroundingStatus: The declared status of a decision claim’s contact with the relevant reality surface. Allowed values: GROUNDED, ESTIMATED, ASSUMPTION_BOUND, DECLARED_UNKNOWN, OUT_OF_SCOPE_WITH_RATIONALE, INSUFFICIENT_GROUNDING. Legacy aliases EVIDENCE_BACKED -> GROUNDED and INSUFFICIENT_CONTACT -> INSUFFICIENT_GROUNDING are retained for backward compatibility. At Tier 2 it is operator-declared with review status explicitly recorded; at Tier 3 it must follow the declared reviewer regime; at Tier 4 it must be independently re-derivable from EvidenceTrace and hash-pinned supporting artifacts.

A.1 Sets and Indices

A.2 Core Sets

A.3 Union Stack (Canonical)

Canonical Union Scopes: U1 Self; U2 Household; U3 Community; U4 Organization; U5 Polity; U6 Humanity / Global Coordination; U7 Biosphere. These are the row coordinates of the 7×7 welfare matrix. See Section 2.3 for definitions and Section 4.7 / Appendix AD for cell-level interpretation.

A.3A Scope × Dimension Reference Table (Non-Normative, clarity payload)

The table below reproduces the 7×7 Scope×Dimension reference grid for quick reading and cross-platform stability. The canonical grid definition is presented in Section 4.7.

A.4 Welfare Dimensions (Canonical)

A.5 Impact Objects

A.6 Impact Instance Attributes

A.7 Operators and Functions

Symbol

Definition

(x)⁺

max(x, 0)

clip(x, a, b)

max(a, min(x, b))

sat_β(x)

tanh(β × x)

τ(t)

min(1, ln(1 + max(t, t_min)) / ln(1 + T_ref)) Defaults: T_ref = 25 years, t_min = 0.083 years Cap ensures τ(t) ≤ 1 for all t; floor ensures τ > 0 for all t > 0

φ(u, d)

7(u − 1) + d (flattening map for kernel indexing)

Contain(u, G_c)

Decision-specific set of scopes or systems declared to contain, sustain, govern, or enable union scope u in directed containment/dependency graph G_c. Scope order alone does not establish containment.

T_ref

Governance reference time horizon for temporal weighting. Default: 25 years. MUST NOT be set < 10 years without charter-level justification.

A.8 Kernel and Propagation

Stream note (Normative). Kernel propagation applies per stream x∈{base, welfare} as specified in Appendix B. In Appendix A, the symbols I_dir, Ĩ_prop, and I_prop may be used as shorthand for their stream-specific forms I_dir,x, Ĩ_prop,x, and I_prop,x. Admissibility computation uses the Base stream (h_k:=1); RLS uses the Welfare stream with the governed welfare-inclusion hypothesis set carried through robust sensitivity analysis.

A.9 Rights and Constraints

A.10 Scoring and Uncertainty

A.11 Structural Metrics

A.12 Audit Artifacts

A.13 Scenario and TRC Objects

A.14 SGP v8.8 Integration

End Appendix A.

APPENDIX B: CANONICAL EQUATIONS (TIER 1-3 EXECUTABLE)

Appendix B is normative and is the canonical equation pack for Tier 1-3 implementations. All equations are reproduced explicitly for standalone executability.

B.1 Temporal Weighting

Defaults: T_ref = 25 years; t_min = 0.083 years (≈1 month).

τ(t) = min(1, ln(1 + max(t, t_min)) / ln(1 + T_ref))

This function has three properties by construction:

(a) Logarithmic growth ensures that short-term effects receive proportionally less weight than long-term effects, without the exponential discounting that aggressively devalues future generations.

(b) The min(1, ·) cap ensures that no effect receives more temporal weight than the governance reference horizon. At T_ref, τ = 1.00. Beyond T_ref, τ remains 1.00 (capped).

(c) The max(t, t_min) floor ensures that τ(t) > 0 for all positive t, preventing very short-term effects from being zeroed out.

Illustrative values (with defaults T_ref = 25, t_min = 0.083):

At 100 years: τ = 1.00 (capped)

At 50 years: τ = 1.00 (capped)

At 25 years: τ = 1.00

At 10 years: τ ≈ 0.74

At 5 years: τ ≈ 0.55

At 1 year: τ ≈ 0.21

At t_min (≈1 month): τ ≈ 0.025

Historical change note (v7.5.0; carried forward unchanged in v9.0): This replaces the uncapped function τ(t) = ln(1+t)/ln(1+T_ref) from v7.4.5, which produced τ(50) ≈ 1.21. The capped version is normatively preferred. See Section 5.3 for design rationale.

B.2 Direct Impact Aggregation (Pre-Saturation; stream-separated)

B.2A Base stream (admissibility; h_k:=1):

Ĩ_dir_base(u,d,a) = Σ_{k ∈ K(u,d,a)} [r_k × τ(t_k) × ℓ_k × c_k × e_k × (1) × μ_k]

B.2A Gate-critical confidence guard. In the Base stream used by RF/NCRC, TRC, and CSV, c_k represents evidence support but cannot by itself excuse unresolved severe adverse gate-critical impacts. Apply GateAdverseBound(k) from Section 5.2: use the most adverse admissible harm endpoint and least favourable gate-supporting endpoint; if only c_k is available, set c_gate,k:=1 for adverse gate computation and retain c_gate,k:=c_k for beneficial safety claims. If the bound is not reproducible and the gate could change, return UNKNOWN, ESCALATE, NARROW, or REFUSE rather than PASS.

B.2B Welfare stream (RLS; welfare-inclusion hypotheses):

Ĩ_dir_welfare(u,d,a;h) = Σ_{k ∈ K(u,d,a)} [r_k × τ(t_k) × ℓ_k × c_k × e_k × h_{k,welfare} × μ_k]

Here h_{k,welfare}^{(j)} is selected from the governed welfare-inclusion hypothesis set only for a declared sensitivity evaluation j; the Base stream (B.2A) fixes h_k:=1.0 for all instances. MPS bands or intervals MUST NOT be substituted directly for h_k. A representative display may be shown only if all decision-material hypothesis results are also reported.

Where K(u,d,a) is the set of impact instances asserted for cell (u,d) under option a.

B.3 Direct Saturation (per stream)

For x ∈ {base, welfare}:

I_dir_x(u,d,a) = tanh(β × Ĩ_dir_x(u,d,a))

Default: β = 2.

B.4 Missing Data (Ignorance Penalty Phantom Instance)

If cell (u,d) is required-active but K(u,d,a) = ∅, add phantom instance with:

B.5 Flattening Map (Kernel Indexing)

Vectorize I_dir into a 49-vector by:

i = φ(u,d) = 7(u − 1) + d

B.6 Propagation Modes (Tier 1-3: NONE and QUICK only)

NONE:

For x ∈ {base, welfare}: I_prop_x := I_dir_x

QUICK:

For stream x ∈ {base, welfare}: Ĩ_prop_x = I_dir_x + K × I_dir_x

Then apply post-propagation saturation (B.7).

B.7 Post-Propagation Saturation (per stream)

For x ∈ {base, welfare}:

I_prop_x(u,d,a) = tanh(β_prop × Ĩ_prop_x(u,d,a))

Default: β_prop = 1.

Applicability rule. B.7 applies only when a propagation kernel is used (QUICK or a later governed kernel). Under NONE, I_prop_x := I_dir_x; no second post-propagation saturation is applied.

B.8 Worst-Off Subgroup Impact (Rights)

I_rights(u,d,a,r) = min_{g ∈ G_RF(u,d,a,r)} I_RF(u,d,a|g,r)

B.9 NCRC Violation Depth and Rights Admissibility

For each right r, define three independent violation channels using Section 7.4 inputs:

The severe-hazard activation predicate, h_sev,k,r, eta_r, event-class screening and scoped tolerance rho_{k,r} follow Section 7.4.3. A shorthand rho_r does not replace the event-, population- and authority-specific tolerance record. Missing activation or tolerance evidence remains unresolved under the reviewed-empty-set convention.

v_r^floor(a) = max_{(u,d) in C_r} (theta_r - I_rights(u,d,a))^+

v_r^cat(a) = max_{k in K_r(a)} z_{k,r}

v_r^risk(a) = max_{k in K_r(a): SevereRightsHazardActive(k,r)} (p_{k,r}^U - rho_{k,r})^+

where (x)^+ = max(x,0), z_{k,r} is the categorical-prohibition indicator, h_{sev,k,r} is intrinsic rights severity, p_{k,r}^U is the conservative upper event-probability bound, and rho_r is the governed rights-risk tolerance. The risk-check index includes both individual constraints and required aggregate event-family probability records under Section 7.4.4. Each uses its scoped rho_{k,r}; aggregation does not add a welfare impact or dilute a categorical prohibition.

If any required severe-hazard field is missing, the right receives NCRC_UNKNOWN; missing data MUST NOT be converted to zero.

NCRC(a) = TRUE if and only if, for every protected right r, v_r^floor(a)=0, v_r^cat(a)=0, v_r^risk(a)=0, and no material rights field is unresolved.

For Emergency Mode comparison, use the ordered compound tuple q_r(a) = (v_r^cat(a), v_r^risk(a), v_r^floor(a)) within the canonical right-priority order. A lower welfare score or shorter duration cannot rescue a non-zero categorical, severe-risk, or floor component.

B.10 TRC Loss (Tier 1-3 Bounded-Impact Mode)

Let C_cat be catastrophe cells and ω catastrophe weights.

Normative stream binding (Design A): TRC MUST be computed from the Base stream (I_prop_base). TRC MUST NOT use Welfare-stream (sentience-weighted) impacts.

For scenario s:

L(a,s) = Σ_{c ∈ C_cat} ω_c × (−I_prop_base,c(a|s))⁺

TRC uses CVaR (Appendix D for discrete computation) and corridor threshold τ_TRC:

TRC(a) = TRUE if and only if CVaR_α[L(a)] ≤ τ_TRC, every active class-specific cap or tolerance under Section 8.4A is satisfied, no unresolved material C3 or C4 field remains, and all mandatory scenario-family requirements are satisfied or governed exceptions are recorded.

B.11 Containment Mode A (Binding)

Containment Mode A is one required structural subtest inside the broader CSV resolver; it is not the whole CSV Gate.

Define positively moving union scopes:

S_u(a) = sum_d v_d^cont * I_prop_base(u,d,a)

Containment trigger weights use the containment-specific vector v_d^cont (default uniform 1/7). HDW welfare weights MUST NOT be used for containment trigger detection.

U_pos(a) = {u : S_u(a) >= theta_pos}

Let G_c be the decision-specific directed containment/dependency graph. Increasing union-scope order is not sufficient evidence of containment. For each u in U_pos(a), let Contain(u,G_c) be the set of declared scopes or systems whose integrity materially contains, sustains, governs, or enables the benefit. Where UCI is an applicable instrument:

M_u(a) = min_{u' in Contain(u,G_c)} DeltaUCI_{u'}(a)

If Contain(u,G_c) is empty for a triggered scope, the containing-system map is incomplete. The run MUST record CONTAINMENT_MAP_INCOMPLETE and escalate or leave the CSV subcondition unresolved; the minimum over an empty set MUST NOT pass vacuously.

and the UCI subpredicate passes only when M_u(a) >= tau_c for every triggered scope.

The complete CSV status is resolved from all material subconditions:

CSV_status(a) = Resolve(containment_integrity, structural_viability, source_coupling, physical_causal_admissibility, dependency_and_lock_in, reversibility, monitoring, controls, authority_and_legitimacy, evidence_sufficiency)

CSV_PASS or CSV_PASS_WITH_CONTROLS requires every material subcondition to be PASS, PASS_WITH_CONTROLS, or a documented NOT_MATERIAL disposition. Any material FAIL, unresolved gate-critical UNKNOWN, missing required profile, or structurally non-viable condition prevents ordinary selectability.

CSV_NOT_MATERIAL remains a documented pass-equivalent disposition only when the PCC demonstrates that no CSV subcondition is material to the declared claim boundary. UCI is therefore one possible required subpredicate, not an if-and-only-if definition of CSV.

B.12 RippleLogic Score (RLS)

q(u,d) = w_u × v_d × m(u,d) × κ(u,d)

Q = Σ_u Σ_d q(u,d)

RLS(a) = [Σ_u Σ_d q(u,d) × I_prop_welfare(u,d,a)] / Q, for Q > 0

If Q = 0, RLS is undefined. Return RLS_NO_ACTIVE_MASS, repair the mask/weight declaration, narrow the claim, or refuse deterministic ranking; zero MUST NOT be imputed.

Default: κ(u,d) = 1, m(u,d) = 1 unless masked.

B.12A κ governance note (Normative). Non-default κ(u,d) values are allowed only within the bounded governance interval declared in Section 10.1 and MUST preserve sign, rights-floor protection, catastrophe visibility, and replayability. Validator checks SHALL reject any κ(u,d) that acts as a hidden mask, hidden union-floor rewrite, or undisclosed prominence override.

B.13 RLS Uncertainty (Optional; Tier 3 Required)

Definition of σ(u,d,a) (normative minimum): PCC MUST declare one of the following cell-level uncertainty proxies and apply it consistently across options:

When Method B is used for a unique-selection claim, the transformation-consistent uncertainty requirement in Section 10.3.2 controls. A reproducible legacy support-proxy calculation is not by itself a calibrated final-impact uncertainty warrant.

Method A (interval half-width): If the PCC records a confidence interval [L,U] for the cell impact I(u,d,a), set σ(u,d,a) = (U − L)/2.

Method B (confidence-derived contribution-mass rule): If the PCC records impact instances with confidences c_k ∈[0.1,1] and selects Method B, derive c(u,d,a) using Section 10.3.2. Let A_cell(u,d,a) = min(1, Σ_k |x_k|), where x_k is the pre-confidence contribution after reach, temporal, likelihood, adjustment, and permitted sentience terms and before saturation. Then: σ(u,d,a) = (1 − c(u,d,a)) · A_cell(u,d,a)

Phantom uncertainty (Normative). For a governed phantom under Section 5.7, the confidence used in the point estimate remains 1, but the Method B uncertainty confidence is 0; hence its support proxy is sigma = A_cell. This does not turn a missing observation into an observed zero or waive the Section 10.3.2 transformation-consistency and dependence requirements for a unique-selection claim.

Method C (calibrated table): Use a pre-registered mapping from qualitative uncertainty labels (for example, LOW/MED/HIGH) to σ values, stored in the ProofPack or PCC appendix.

σ values MUST be clipped to [0,1]. Unless a stricter governed method is declared, σ(u,d,a) is interpreted as the pre-κ cell-level uncertainty input and SHALL be aggregated into σ_RLS using the same w_u, v_d, m(u,d), and κ(u,d) posture used for RLS.

σ_RLS(a) = √[Σ_u Σ_d (q(u,d) × σ(u,d,a))²] / Q, for Q > 0

This is the independent-cell approximation. Tier 3 and decision-material Tier 2 runs MUST declare dependence clusters and compute the perfect-correlation or covariance-aware stress specified by the Dependence-cluster uncertainty rule in Section 10.3. If ranking or decisiveness changes, set RLS_DEPENDENCE_SENSITIVE and treat the result as non-decisive until governed resolution. The declared cell uncertainty MUST also include material measurement or elicitation resolution; exact zero is allowed only for exact deterministic inputs.

Risk-adjusted score (optional):

RLS_adj(a) = RLS(a) − λ × σ_RLS(a)

By default, RLS_adj is diagnostic only and MUST NOT replace RLS for ranking or decisiveness unless the run declares ex ante that risk-adjusted ranking is the governing ranking basis. If such a declaration is made, the same declared basis MUST be used consistently for ranking, Gap, and decisiveness across all compared options in the run.

B.14 Discrimination Gap (Decisive vs Non-Decisive)

Gap(a,b) = abs(RLS(a) - RLS(b)) / sqrt(sigma_RLS(a)^2 + sigma_RLS(b)^2 + epsilon)

SignedGap(a,b) = (Score(a) - Score(b)) / sqrt(sigma_RLS(a)^2 + sigma_RLS(b)^2 + epsilon). Score is the ex-ante governing basis in Section 10.4: ordinary RLS by default, or the expressly declared risk-adjusted basis. The absolute Gap reports separation magnitude; only the signed leader-versus-every-rival comparison establishes the required direction.

Default: delta = 2, epsilon = 1e-6.

A lead is decisive only when the Section 10.4 signed leader comparison exceeds delta against every other selectable option under every required variant, the same leader survives, and the Section 10.4B robustness record is complete. Any failed comparison or material sensitivity blocks a unique decisive claim. Demonstration-only or unvalidated uncertainty cannot support ALLOW_FRAMEWORK_SELECTION or SELECTED_DECISIVE. Otherwise retain unresolved contenders and REFUSE_DETERMINISTIC_SELECTION; any governed tie-break preference and separate AuthoritySelectionRecord follow Section 11.5. A sole survivor has no pairwise Gap.

B.14A Selection-Integrity Equations and Predicates (Normative)

Event-probability residual welfare: for scenario-conditioned outcome X_ud(a,s), I_ud(a)=Σ_s p_s·tanh(β·X_ud(a,s)). Expected-frequency/exposure and already-expected effects follow Section 5.2B.

Scenario-order binding. Under NONE, the scenario-specific direct saturated value is also its propagated value. Under QUICK, construct and saturate each scenario's direct Base/Welfare field, apply B.6 and B.7 within that scenario, and then probability-average the final Welfare impacts for RLS. TRC retains each scenario's loss distribution for CVaR rather than collapsing it into that welfare average. Do not exchange nonlinear saturation with averaging.

Rights non-dilution: v_floor(a)=max(v_floor^cell(a), max_j,r v_j,r^token(a)). NCRC passes only when floor, categorical, and severe-hazard channels are all zero and no required field is unresolved.

Comparison-mask symmetry: m_run(u,d) is common across compared options. An unjustified option-specific mask makes comparative RLS invalid.

Robust selection predicate: UniqueSelect(a*)=TRUE only if a* is decisively separated from every other selectable option under Section 10.4 in every completed required variant, every registered module is PASS_NO_REVERSAL or NOT_TRIGGERED_WITH_RATIONALE, and no upstream gate or authority rule blocks selection.

Normative underdetermination predicate: if the evidence surface is sufficiently closed and two legitimate ex-ante weight constitutions select different options, return NORMATIVE_UNDERDETERMINED rather than expanding σ_RLS.

B.15 UCI Computation

Let A_u be the set of UCI components applicable to Union Scope u. Then:

UCI_u = [Σ_{j ∈ A_u} α_j X_{u,j}] / [Σ_{j ∈ A_u} α_j]

Default: α_H = α_F = α_R = α_E = 0.25 before applicable-component renormalization. NA components are excluded from A_u; UNKNOWN components are not scored and make UCI unavailable for the affected claim. For Self (U1), Equity is ordinarily NA unless a governed within-self equity instrument is material. For Biosphere (U7), Equity is ordinarily NA unless a governed ecological-distribution or ecological-justice instrument exists. No neutral or perfect value may be inserted for NA or UNKNOWN. If A_u is empty, UCI_u is UNAVAILABLE; the denominator is not evaluated and no value may be imputed.

B.16 ΔUCI Computation

ΔUCI_u(a) = UCI_u(a) − UCI_u(baseline)

B.17 HOI Computation

HOI_t = EMA_λ(ΔRLS_t / s_RLS)_t − EMA_λ(ΔUCI_t / s_UCI)_t

Scale rule (Normative). s_RLS and s_UCI MUST be positive, preregistered reference scales derived from a declared reference range or robust dispersion estimate and held fixed for the review window. If either scale is unavailable or unstable, HOI is UNAVAILABLE; raw unstandardized changes MUST NOT be subtracted.

Default half-life: 3 periods.

End Appendix B.

APPENDIX C: RIGHTS / NCRC CANON PACK (TIER 1-3)

Appendix C is normative.

C.1 Rights Thresholds (Canonical)

Normative interpretation rule: Thresholds θ_r are admissibility floors, not weights. They do not represent “how important” a right is; they represent the minimum allowable protection level.

Threshold-scale clarification (Normative). θ_r is defined on the post-saturation rights-impact scale I_rights. For an unsaturated single-stream comparison, the corresponding pre-saturation aggregate is atanh(θ_r) / β_RF. With the canonical β_RF = 2, tanh(β_RF x) bounds values to (−1,+1) but is expansive in magnitude near zero and compressive only near the bounds; it is not a small-signal attenuator. Threshold calibration and sensitivity review MUST state the scale used.

C.2 Rights Coverage Sets C_r (Authoritative)

Rights-routing clarification for D6 and D7 (Normative). Appendix C.2 defines the cells directly covered by each canonical right. A D6 Meaning or D7 Environment entry does not acquire rights-floor status merely because it is rights-relevant. When the underlying effect instantiates a protected interest — for example freedom of thought, conscience, religion, or nonbelief; coercion or discrimination; dignity; information access; health; basic needs or habitability; due process; or protected life-support conditions — the run MUST construct and evidence the corresponding rights-floor instance in the applicable canonical covered dimension(s), or declare a governed rights-coverage extension under Section 12.8. It MUST NOT leave a materially protected effect only as compensable D6/D7 welfare. Ordinary purpose, identity, place attachment, environmental amenity, or ecological condition is not automatically a rights violation.

C.3 Emergency Mode Rights Priority (Canonical)

When Emergency Mode is invoked (A_NCRC = ∅), rights are ordered lexicographically:

[LIFE, BODY, ECOL, LBTY, NEED, DIGN, PROC, INFO]

This ordering MUST be used exactly for lexicographic minimization of the violation depth vector.

C.4 NCRC Violation Depth Definition (Canonical)

For every right r, record the compound violation tuple:

q_r(a) = (v_r^cat(a), v_r^risk(a), v_r^floor(a))

with:

• v_r^floor(a) = max_{(u,d) in C_r} (theta_r - I_rights(u,d,a))^+;

• v_r^cat(a) = max_{k in K_r(a)} z_{k,r};

• v_r^risk(a) = max_{k in K_r(a): SevereRightsHazardActive(k,r)} (p_{k,r}^U - rho_{k,r})^+.

A missing required severe-hazard probability, tolerance, categorical-status field, or gate-critical evidence disposition produces NCRC_UNKNOWN, not zero. Apply the scoped tolerance and aggregate event-family probability requirements of Section 7.4.4 before the severe-risk maximum; unresolved material dependence or exposure boundaries cannot receive an implied pass.

C.5 NCRC Predicate (Canonical)

NCRC(a) = TRUE if and only if, for every right r, all three components of q_r(a) equal zero and no material rights evidence field is unresolved.

The NCRC passing set is A_NCRC = {a in O : NCRC(a)=TRUE}. Any categorical prohibition, severe-hazard exceedance, floor violation, or required unresolved field blocks an ordinary NCRC pass.

C.6 Subgroup Conservative Bound (Canonical)

When subgroup disaggregation is infeasible for a rights-covered cell:

Let γ_subgroup = 1.5 (default conservatism factor).

• If I_RF_base(u,d,a,r) < 0: set I_rights(u,d,a,r) = max(-1, γ_subgroup × I_RF_base(u,d,a,r))

• Else: set I_rights(u,d,a,r) = I_RF_base(u,d,a,r)

This bound applies only for NCRC checking, not for RLS scoring.

Emergency comparison tie rule (Normative). The saturated I_rights value remains controlling for ordinary admissibility. If two or more Emergency Mode options tie on v_r^floor because the conservative clamp maps them to −1, the run MUST use the unclamped conservative value γ_subgroup × I_RF_base as a secondary ordering key for that right, with more negative values treated as worse and the trace recorded in the PCC. This secondary key does not convert any failing option into an ordinary NCRC pass.

If I_RF_base cannot be constructed from reviewed rights-floor instances, the cell is NCRC_UNKNOWN; the run MUST collect evidence, narrow, escalate, or refuse rather than reuse a temporally or confidence-attenuated welfare value as a rights pass.

C.7 Emergency Mode Documentation Requirements (Canonical)

When Emergency Mode is invoked, the PCC MUST include:

• Emergency declaration and trigger conditions;

• the complete q_r(a) = (v_r^cat, v_r^risk, v_r^floor) tuple for each option and each right;

• the lexicographic comparison trace using the Section C.3 right-priority order and component order categorical -> severe risk -> floor depth;

• all NCRC_UNKNOWN fields and the conservative disposition used;

• independent challenger attestation, or CHALLENGE_DEFERRED_EMERGENCY;

• mitigation/remediation plan with timeline;

• monitoring, appeal, remedy, exit, review cadence, and return-to-normal triggers.

Emergency Mode does not convert a rights-violating option into an ordinary NCRC pass. It documents a governed provisional response under necessity.

End Appendix C.

APPENDIX D: TRC AND SCENARIO GOVERNANCE CANON PACK (TIER 1-3)

Appendix D is normative.

D.1 Base Catastrophe Cell Set

C_cat_base = {(6, Health), (6, Environment), (7, Environment)}

These correspond to:

• (6, Health): Humanity / Global Coordination-Health, representing global-scale health viability

• (6, Environment): Humanity / Global Coordination-Environment, representing civilization-scale habitability conditions

• (7, Environment): Biosphere-Environment, representing Earth-system integrity

D.1A Default Governance-Lock-In Extension Profile (Normative)

Trigger condition: This profile MUST be activated when any of the following is plausibly in scope for the decision: surveillance normalization; emergency-power persistence beyond justified sunset; due-process suspension or durable recourse collapse; information-ecosystem capture; irreversible dependency lock-in on critical infrastructure or governance functions; or concentrated arbitrary control without meaningful exit, review, or contestability.

Default governance-lock catastrophe cell set:

C_cat_lock_default = {(5, Agency), (5, Knowledge), (6, Agency), (6, Knowledge)}

Default weighting rule when active:

If no stricter governed profile is declared:

Evaluate C_cat_base and C_cat_lock_default as separate active catastrophe profiles. Normalize weights within each profile, compute profile-specific loss and CVaR, and require every active profile to satisfy its governed corridor. A combined union summary may be reported only as non-controlling information and cannot rescue a failed profile.

Interpretation:

(5, Agency): polity-scale loss of contestability, due process, or civic agency

(5, Knowledge): polity-scale degradation of information integrity and epistemic access

(6, Agency): civilization-scale agency loss, lock-in, or durable corrigibility collapse

(6, Knowledge): civilization-scale information capture, knowledge bottlenecking, or durable epistemic enclosure

Symmetry rule: The same active catastrophe set and weights MUST be applied across all compared options in the run.

PCC rule: The PCC MUST record whether the governance-lock profile was inactive, active by default trigger, or replaced by a stricter governed profile.

D.2 Mandatory Tail Scenario Categories (Canonical)

The scenario set MUST include the following tail categories unless explicitly justified as not plausible. Governance / lock-in catastrophe is a mandatory tail category if and only if the governance-lock-in extension profile in D.1A is active; otherwise it is recommended but not mandatory. When that profile is active, the scenario set MUST include at least one governance-lock-in tail category with category probability floor p_floor ≥ 0.02.

• Pandemic/biological disruption: Disease outbreak with significant mortality/morbidity

• Climate tipping cascade: Triggering of climate tipping points with cascading effects

• Financial system collapse: Systemic failure of financial infrastructure

• Major conflict escalation: Armed conflict with regional or global implications

• Critical infrastructure failure: Failure of essential services (power, water, communications)

Governance / lock-in catastrophe: Surveillance normalization, durable recourse collapse, information-ecosystem capture, irreversible dependency lock-in, or concentrated arbitrary control over critical governance or infrastructure functions

D.3 Probability Floor (Canonical)

Minimum category probability floor: p_floor ≥ 0.02

Meaning: The sum of probabilities of scenarios in each mandatory category must be ≥ 0.02 unless explicitly justified as implausible for the specific decision context per Section 8.3.2.

D.4 Scenario Set Size Requirements (Canonical)

D.5 Scenario Definition Template (Normative Minimum Fields)

Each scenario record in PCC MUST include:

D.6 Loss Construction (Bounded-Impact Mode, Tier 1-3 Canon)

Normative stream binding (Design A): TRC MUST be computed from the Base stream (I_prop_base). TRC MUST NOT use Welfare-stream (sentience-weighted) impacts.

For each scenario s:

L(a,s) = Σ_{c ∈ C_cat} ω_c × (−I_prop_base,c(a|s))⁺

with Σ_{c ∈ C_cat} ω_c = 1.

Default catastrophe weights: Uniform over C_cat unless otherwise governed.

Any non-default ω_c vector MUST be declared ex ante, normalized within the active profile, justified, applied symmetrically, and accompanied by the uniform-weight counterfactual when the run is Tier 3 or decision-material/high-stakes Tier 2. Non-default weighting MUST NOT weaken the base-profile non-dilution rule or hide a material catastrophe cell.

Reference semantics: apply the Section 8.4 TRC loss-reference rule. Scenario losses are residual safe-corridor-relative Base-stream losses for the declared exposure domain; a diagnostic incremental comparison against continuation is not a replacement gating loss.

D.7 Discrete CVaR Algorithm (Canonical; Tier 1-3)

Inputs: losses L(a, s1), …, L(a, sn); probabilities p1, …, pn; tail level α.

1. Let b_tail := 1 − α.

2. Sort scenarios by loss descending: L_(1) ≥ L_(2) ≥ ⋯ ≥ L_(n), carrying the aligned probabilities p_(i).

3. Let k* be the smallest index such that Σ_{i=1}^{k*} p_(i) ≥ b_tail.

4. Define P_{k*−1} := Σ_{i=1}^{k*−1} p_(i) (and P_0 := 0).

5. Define m_boundary := b_tail − P_{k*−1}.

6. Compute:

CVaR_α[L(a)] = (1/b_tail) · ( Σ_{i=1}^{k*−1} p_(i) L_(i) + m_boundary · L_(k*) ).

Audit: PCC includes the sorted table, k*, P_{k*−1}, m_boundary, and CVaR_α.

(Here L_(i) is shorthand for L(a, s_(i)).)

D.8 TRC Corridor Check (Canonical)

TRC(a) = TRUE if and only if CVaR_α[L(a)] ≤ τ_TRC, every active class-specific cap or tolerance under Section 8.4A is satisfied, no unresolved material C3 or C4 field remains, and all mandatory scenario-family requirements are satisfied or governed exceptions are recorded.

D.9 Default TRC Parameters by Context (Canonical Defaults)

D.10 Tier 2 Strict TRC Rule (Canonical)

If catastrophe relevance is plausible (per Section 8.1.1), Tier 2 MUST:

• Compute TRC using this appendix

• Use ≥5 scenarios minimum

• Include mandatory tail categories with p_floor ≥ 0.02 per category unless explicitly implausible with documented justification per Section 8.3.2

• Record the full scenario table and CVaR computation in PCC

D.11 Tail Emergency Mode Reference Procedure (Canonical)

If A_NCRC is non-empty but no option passes TRC, the ordinary admissible/selectable set is empty. Implementations MUST NOT rank the failed options through ordinary RLS and MUST NOT automatically select the least-CVaR option.

Default disposition: TRC_ALL_FAIL -> redesign, delay, no-action comparison, escalation, or refusal.

A provisional action may be considered only through the Tail Emergency Mode requirements in Section 8.8. The PCC MUST demonstrate necessity, failed or unavailable safer alternatives, explicit no-action/delay comparison, independent challenge, an absolute maximum exposure bound, minimized scope and duration, monitoring and shutoff, mitigation, remedy/redress, higher approval, expiry, and return-to-normal criteria.

Only candidates satisfying every Section 8.8 prerequisite may enter the emergency candidate set. Within that set, minimum CVaR may identify the least-tail-risk provisional action. Record TAIL_EMERGENCY_MODE_INVOKED and return TAIL_EMERGENCY_PROVISIONAL_ACTION.

This state is not TRC_PASS, ordinary admissibility, ordinary selectability, alignment, or proof of safety. Ordinary RLS is prohibited. If no candidate satisfies the absolute exposure boundary or the governance prerequisites, the result is TAIL_EMERGENCY_REFUSED or escalation under the governing charter or public-law emergency authority.

End Appendix D.

APPENDIX E: UCI OPERATIONALIZATION PACK (TIER 1-3)

Appendix E is normative for the UCI interface and Tier 3 constraints; indicator families are canonical guidance unless a deployment supplies validated instruments.

Operational maturity note (Normative clarification). Tier-3 conformance requires declared structural indicator families and structural independence; it does not imply universal calibration. Deployments SHOULD publish a provisional indicator companion pack when using local instruments, including sources, normalization rule, and basic reliability notes.

E.1 UCI Component Definitions (Canonical)

E.2 UCI Formula (Canonical)

Let A_u be the set of applicable UCI components for Union Scope u. The canonical formula is:

UCI_u = [Σ_{j ∈ A_u} α_j X_{u,j}] / [Σ_{j ∈ A_u} α_j]

Default: α_H = α_F = α_R = α_E = 0.25 before applicable-component renormalization. NA components are excluded; UNKNOWN components are not scored and make UCI unavailable for the affected claim. For Self (U1), Equity is ordinarily NA unless a governed within-self equity instrument is declared. For Biosphere (U7), Equity is ordinarily NA unless a governed ecological-distribution or ecological-justice instrument exists. No perfect, neutral, or identity value is inserted.

E.3 Structural Independence Rule (Tier 3 Binding)

UCI MUST be computed from structural/process indicators distinct from welfare indicators used for RLS.

At Tier 3:

• Deriving UCI from welfare-cell impacts is PROHIBITED

• If structural indicators are unavailable, UCI is treated as unavailable (see E.7)

E.4 Indicator Families by Union (Canonical Guidance)

U₁ Self:

• Cohesion: Psychological integration, goal coherence, self-trust, internal conflict resolution

• Flow: Task execution reliability, attention stability, cognitive throughput proxies

• Resilience: Stress recovery, adaptive coping, flexibility under change

• Equity: ordinarily NA unless a governed within-self equity instrument is declared; if applicable but unmeasured, UNKNOWN

U₂ Household:

• Cohesion: Relationship quality, conflict resolution, trust among members

• Flow: Resource pooling efficiency, coordination routines, decision-making speed

• Resilience: Emergency preparedness, support redundancy, recovery from shocks

• Equity: Fair burden-sharing, voice parity, caregiving distribution fairness

U₃ Community:

• Cohesion: Social capital, trust indices, network density, belonging measures

• Flow: Collective action capacity, coordination lag, information spread fidelity

• Resilience: Mutual aid redundancy, disaster response capacity, recovery history

• Equity: Inclusion of marginalized groups, access parity, procedural fairness in local governance

U₄ Organization:

• Cohesion: Culture trust indices, turnover stability, safety culture, shared purpose

• Flow: Process throughput, coordination efficiency, error rates, execution reliability

• Resilience: Redundancy, continuity planning, incident response maturity

• Equity: Pay fairness, promotion parity, grievance procedures, representation

U₅ Polity:

• Cohesion: Institutional trust, social cohesion indices, legitimacy measures

• Flow: Governance effectiveness, service delivery reliability, coordination speed

• Resilience: Crisis response capacity, redundancy of critical systems

• Equity: Rule of law parity, civil rights access parity, representation integrity

U₆ Humanity / Global Coordination:

• Cohesion: Cross-polity cooperation capacity, treaty adherence norms

• Flow: Global coordination throughput, information-sharing integrity

• Resilience: Global response capacity to pandemics/climate/conflict

• Equity: Burden-sharing fairness, inclusion of vulnerable polities/populations

U₇ Biosphere:

• Cohesion: Ecosystem connectivity, biodiversity integrity, trophic network stability

• Flow: Nutrient cycling integrity, carbon sequestration capacity, hydrological cycle stability

• Resilience: Recovery capacity, redundancy of functional species, anti-fragility markers

• Equity: Use distributional ecosystem-integrity or ecological-justice indicators when a governed instrument exists. If U7 Equity is genuinely inapplicable to the declared structural question, record E7 = NA, exclude it from the UCI aggregation, and renormalize the remaining applicable components. If U7 Equity is applicable but not adequately measured, record E7 = UNKNOWN; do not insert 1.0 or another neutral value. Material UNKNOWN status makes UCI unavailable for the affected claim and requires evidence collection, claim narrowing, redesign, escalation, or refusal of an unqualified CSV pass.

E.5 ΔUCI Computation (Canonical)

ΔUCI_u(a) = UCI_u(a) − UCI_u(baseline)

E.6 Prospective UCI Estimation (Tier 3) (Normative Constraints)

Tier 3 requires prospective (ex ante) estimation of UCI changes from structural indicators, not from welfare impacts. The PCC must:

• Identify structural indicators used

• Specify baseline values

• Specify predicted changes under each option

• Specify normalization to [0,1] for each component

• Compute UCI_u and ΔUCI_u using E.2 and E.5

E.7 UCI Unavailability Rule (Tier 3) (Normative)

If structural indicators are unavailable such that UCI cannot be computed without violating E.3:

• UCI MUST be treated as unavailable for tie-break purposes

• If RLS lead is non-decisive, decision MUST escalate for more data/higher tier OR record a judgment call with label JUDGMENT_CALL_UCI_UNAVAILABLE and a monitoring plan

• Any welfare-derived UCI proxy MUST NOT be used to claim Tier 3 compliance

E.7A UCI/HOI Dual-Use Reporting Interface (Normative for Tier 3)

Purpose. UCI and HOI may serve as structural evidence in two distinct authority roles. Tier 3 implementations MUST record which role is being used.

Required fields: structural_indicator_id; indicator_family; containing_scope_affected; evidence_status; measurement_readiness_level; containment_relevance; containment_threshold_declared; containment_disposition; residual_tiebreak_relevance; duplicate_use_note; reviewer_disposition; audit_flag_if_any.

Rule. If containment_relevance is REQUIRED or THRESHOLD_CROSSED, the indicator SHALL be evaluated inside CSV before RLS. If the same indicator is later cited in residual tie-break, the PCC MUST state that gate-level containment disposition was already resolved and that residual use is limited to non-decisive structural preference, monitoring, or hollowing documentation.

Prohibited use. An implementation SHALL NOT move a gate-relevant structural indicator to residual tie-break in order to avoid containment failure, evidence unavailability, or escalation.

E.8 Minimal Measurement Protocol (Canonical Guidance)

For each UCI component, the PCC SHOULD document: indicator(s) used; data source; normalization method; expected directionality; uncertainty or reliability notes; and review cadence.

• Indicator(s) used

• Data source

• Normalization method

• Expected directionality

• Uncertainty or reliability notes

• Review cadence

E.8A Provisional UCI Measurement Protocol for Tier 3 pilots (Canonical Guidance)

When a deployment claims Tier 3 run-level conformance and uses UCI operationally, each UCI component SHOULD be built from one to three structurally independent indicators per relevant scope, normalized to [0,1] under a declared rule, and aggregated by a declared within-component operator (default arithmetic mean unless another operator is justified).

Staleness and failure handling. If a required structural indicator is stale, contested, or unavailable such that structural independence cannot be preserved, the affected UCI component SHALL be treated as unavailable and the run SHALL follow the unavailability rule in E.7 rather than substituting welfare-derived proxies.

Status note (Normative clarification). Tier 3 run-level conformance claims are distinct from framework-level empirical operational-readiness claims. The current release line specifies how provisional UCI constructions are to be documented and constrained, but it does not claim that universally validated UCI instruments already exist.

E.8B Tier 3 Starter Indicator Pack (Canonical Guidance)

The following starter indicators MAY be used as provisional structural indicator families when no validated domain-specific pack exists. They do not constitute final empirical calibration, but they provide a minimum auditable starter surface.

U3 Community

Cohesion: local trust survey or equivalent community-trust instrument

Flow: coordination-response latency or meeting-to-action completion rate

Resilience: mutual-aid activation readiness or recovery-from-disruption measure

Equity: access-to-participation parity or grievance-resolution parity

U4 Organization

Cohesion: psychological-safety / trust instrument or equivalent (e.g., Edmondson, 1999)

Flow: process throughput or median handoff completion time

Resilience: incident recovery time or continuity readiness metric

Equity: promotion / burden / grievance parity indicator

U5 Polity

Cohesion: institutional trust or legitimacy measure

Flow: service-delivery or review-cycle timeliness measure

Resilience: emergency response readiness or continuity-of-governance measure

Equity: appeal access parity or due-process access parity measure

Minimum handling rules

Normalization to [0,1] MUST be declared in the PCC.

Data older than 12 months MUST be marked stale unless a stricter domain rule is declared.

If more than one required indicator family for a used scope is missing or stale, the affected UCI component SHALL be treated as unavailable.

A worked example using this starter pack SHOULD be included in any Tier 3 deployment companion pack.

E.9 Measurement Guidance Expansion (Canonical Guidance)

For publication and Tier 3 preparation, each deployment SHOULD maintain a short UCI measurement note per component and scope covering: operational definition, indicator family chosen, normalization rule, expected update cadence, minimum acceptable data quality, independence check, and failure handling when indicators are missing or stale. Where validated instruments do not yet exist, the PCC MUST label the construction as provisional and MUST NOT present the resulting UCI value as empirically calibrated. This guidance is intended to standardize measurement practice without pretending that UCI instruments are already universally validated.

End Appendix E.

APPENDIX F: FAILURE MODES AND ANTI-GAMING CONTROLS (v12.0)

Appendix F is normative for identified gaming vectors and required mitigations. Informative note. This appendix is carried forward substantively unchanged from the v9.0 line unless otherwise stated.

F.1 Identified Gaming Vectors (Canonical)

F.2 Structural Anti-Gaming Features (Canonical)

Non-Compensatory Architecture:

• NCRC cannot be overridden by welfare gains

• TRC cannot be overridden by expected value

• Containment cannot be bypassed by RLS optimization

Transparency Requirements:

• All parameters recorded in PCC

• Registry hashing prevents silent modification (Tier 3+)

• Public rationale (5SPR) required

Audit Infrastructure:

• Random audit lottery (recommended 5% of PCCs at Tier 3)

• Red-team protocols for high-stakes decisions

• Configuration drift detection

Learning Accountability:

• NCAR loop tracks prediction accuracy

• Systematic errors trigger parameter review

• Historical PCCs preserved for accountability

F.3 Audit Flag Taxonomy (Informative pointer; non-authoritative)

The human-readable audit requirements are in Section 14.3A, including its typed completion table; Appendix H.3 specifies registry ownership and binding. H.3 intentionally contains no hand-maintained duplicate table. Use the exact manifest-pinned machine registry when available for a registry-conformant implementation; this informative pointer does not retire a controlling token or establish external registry parity.

F.4 Red-Team and Audit Lottery (Tier 3 Recommended)

Deployments SHOULD adopt:

• Random audit lottery: for example, 5% of PCCs selected for independent review

• Red-team scenario additions: Adversarial scenario injection for TRC testing

• Kernel perturbation stress tests: Systematic edge perturbation

F.5 Boundary and Threshold Gaming (Normative anti-gaming clarification)

RippleLogic does not assume adversaries will only game welfare scores. Because NCRC, TRC, CSV, and PLSS create hard feasibility and escalation conditions, adversarial pressure may shift toward subgroup definitions, rights-threshold placement, scenario-library construction, probability assignment, containment-scope framing, PLSS local-scope declarations, evidence-sufficiency claims, and maturity classifications.

PCC reviewers SHALL inspect these boundary surfaces for gerrymandering, selective omission, motivated uncertainty, threshold laundering, scope narrowing, and evidence laundering. Where any of these surfaces is material to a gate verdict, escalation, or refusal decision, the run SHALL disclose the contested boundary choice, the evidentiary basis, reviewer disagreement if any, and the sensitivity of the verdict to plausible alternative boundary definitions.

Goodhart pressure is not eliminated by RippleLogic; it is relocated and exposed. The system becomes stronger only when boundary definitions, threshold settings, probability libraries, stakeholder maps, and evidence sufficiency judgments are inspectable, contestable, and preserved in the PCC or companion audit record.

End Appendix F.

APPENDIX G: SGP v8.8 INTEGRATION BINDING (NORMATIVE INTERFACE)

Appendix G is normative for the RippleLogic-to-SGP interface.

G.0 Interim Precautionary Trigger

If credible SGP, taxon/class, stakeholder, or artificial-system evidence identifies a plausible moral patient before formal rights-coverage expansion is complete, the run MUST record PRECAUTIONARY_PROTECTION_REVIEW. Absence of an existing C_r mapping MUST NOT be treated as permission for harmful treatment.

G.1 Version and Artifact Pin

SGP Version Pin: RippleLogic Canon v13.0 pins Sentience Gradient Protocol v8.8.

ProofPack dependency rule: a replayable package MUST bundle or hash-pin the exact governing SGP source and any relied-upon MPS/FPP/GPR/SPR/ICP/RMCP record. This package supplies SGP_v8.8.docx and its local reading mirrors. SGP-aware test claims remain restricted to explicitly supplied interfaces and fixtures; the documents and scoped tests do not establish Tier-4 ProofPack or external repository conformance.

Legacy rule: v7.x SG_norm, SG_patient_norm, SG_measured_norm, A/B/C pillar values, and Plateau/CMIU fields are retained only as version-pinned historical records. They MUST NOT be translated into v8.8 outputs without re-evaluation. v8.0 MPS/FPP/GPR/SPR/ICP records remain structurally compatible only where the target boundary and evidence record remain valid; RMCP and P100 require an explicit v8.8 evaluation.

G.2 Interface-Visible Outputs

A valid SGP v8.8 record may expose:

• MPS evidence-family levels V, I, T, F, and S, including NE fields;

• MPS status MPS-NE or evidence band MPS-0 through MPS-4;

• MPS evidence band/interval, record validity, process confidence, and governed welfare-inclusion hypothesis set;

• protection posture and typed protection bundle;

• FPP(E) in {0,1};

• GPR(E,r,t) for a named process or institution;

• SPR(E,r,t) for a named consequential role;