# SURPRISE_REGISTER_OWNERSHIP_PROTOCOL

**Owner:** Claim-Typing Engine (S5). **Writers:** S3 Orchestrator, S7 Fitness Adjudicator, S8 Adversarial Pass Engine. **Renderer:** S4 Epistemic Output Layer. **Reader (gate):** S6 Warrant & Saturation Governor. **Library:** Public RAM (`ram/references/shared-ram/`).

This protocol governs the cross-cutting Surprise Register. Schema is defined canonically in Phase 5 `CROSS_CUTTING_ARTIFACTS.md` Section 1; this file governs ownership and write discipline.

---

## Ownership Invariants

1. **S5 is the SOLE owner.** S5 instantiates the register at run start, binds `register_id` to `run_id`, and publishes the write handle to the three writers.
2. **Owner is not a writer.** S5 does NOT write entries mid-run. Owner-as-writer is a category collision. S5 only writes the manifest at instantiation and closes the register at run end.
3. **Writers are closed set:** {S3, S7, S8}. Any write attempt from a non-writer component is a classified refusal; the RAM state manager wrapper caches and escalates it.
4. **Render authority belongs to S4.** S4 cannot write new entries; it can only render existing ones. Render placement is at the TOP of the output artifact, never as a footnote.
5. **S6 has read-only gate access.** S6 reads the contradiction count and anomaly rate for warrant computation; S6 never writes.

## Write Contract (canonical; mirrors Phase 5 schema)

Every write is a single atomic append-line to `register.jsonl`. Writers must acquire the S5-published write token; writes without token are refused and logged.

Each entry carries:
- `entry_id` (uuid); `run_id`; `register_id`; `claim_id` (or null for meta-anomaly).
- `entry_kind`: one of `anomaly`, `contradiction`, `meta-anomaly`, `charter-amendment-request`. NEVER `tiebreaker-vote` or `confidence-delta` -- those are architecturally prohibited record kinds.
- `writer_component`: S3 | S7 | S8 | S5 (S5 only for manifest-class writes).
- `write_timestamp_utc`; `source_refs[]`; `description` (<= 1000 chars); `provenance` (query_ids + rationale).
- `expansion_directive`: sub-inquiry | expand-corpus | defer-to-operator | informational.
- `downstream_effect` (optional back-references).
- `rendered_in_output`: false (flipped to true by S4 at render).

## The Inquiry-Expansion Rule (HARD)

**Surprises EXPAND inquiry. They do NOT adjudicate.** The register is a trigger for sub-inquiries, corpus expansion, or operator deferral -- it is NEVER a tiebreaker input for fitness scoring, retrieval ranking, stopping decisions, or confidence computation (Maxwell 2013; Schwenk 1990; Phase 3 R1.4).

Enforcement:
- Fitness Adjudicator MUST NOT read the register to break a scoring tie.
- Warrant Governor MAY read contradiction counts as a saturation signal (expansion direction only), NEVER as a closing vote.
- Adversarial Pass MAY read contradictions to seed next-pass queries (expansion), NEVER to discount its own inverted findings.
- Output Layer renders the register as an inquiry-state artifact, not as a confidence adjustment.

Any code path that reads register contents to adjust a numeric output is a category violation and must be refused at review time.

## Lifecycle

1. **S5 instantiation (Phase 6 of S5 operating logic):** create empty `register.jsonl`; write `manifest.json` with `{run_id, charter_hash, claim_decomposition_ref}`; publish write handle.
2. **Writers append** atomically throughout the run (one anomaly/contradiction per write).
3. **S4 render** at assembly time; entries flipped to `rendered_in_output: true`.
4. **Register closes** when S4 emits; post-close writes are REFUSED.

## Degraded-Mode Behavior

- Register file unreachable at S4 render time: S4 emits `register-unavailable` stamp, flags run as degraded, writes an incident to the RAM Search Ledger. Run does NOT auto-close silently.
- Writer cannot acquire write token: writer HALTS and escalates to S3 orchestrator. No silent drop of anomalies.
- Two run-ids collide on a register handle: HALT; this is an orchestration-layer bug.

## Zero-Overlap Enforcement

Path root locked under `state/ram/surprise-register/`. Evaluator has ZERO read and ZERO write authority. Evaluator consumes the RENDERED output via the bridge, never the underlying register state.

## Re-Entry (Evaluator Reopen)

On reopen, the Surprise Register PERSISTS across versioned decomposition artifacts. A new decomposition version does NOT reset the register. Only S5's explicit close-out (stale register, end-of-run) clears it.
