threads-uqx.9: Nova sign-off — RFC round-trip, Gate-4 fail-closed proof, descriptor-not-authority review

[BunsDev]

Bead: threads-uqx.9
Phase: 5 — Approval semantics over the Phase-2 Ward
Spec: specs/PHASE-5-APPROVAL-SEMANTICS.md §7
Depends on: #8 (uqx.3), #9 (uqx.4), #10 (uqx.5), #11 (uqx.6), #12 (uqx.7)

Scope

Nova design review and sign-off before Val freeze. This bead is a gate, not an implementation bead.

Review checklist

• RFC round-trip: every design decision in specs/PHASE-5-APPROVAL-SEMANTICS.md §6 maps cleanly to a type or predicate in the implementation beads. No decision is orphaned or contradicted.
• Gate-4 fail-closed proof: every ApprovalPath ends in daemon re-materialization. No path allows apply without live revalidation at deadline.
• Descriptor-not-authority check: no Cave or client-side surface is enforced on. Every enforcement point traces to a daemon-owned predicate or audit row.
• Audit completeness: proposal_submitted → window_opened → close(reason) chain is present and no gap exists between open and close. Close event has reason field.
• evidence_replay_hash is present on ProposalClassification and enforced at deadline revalidation.
• min_visible enforced on VetoWindow — pending state was actually reachable before deadline could close.
• Label-variant mapping is a daemon load-time contract, not a Cave convention. Drift fails at load.
• Advisory probes (if present) are in a separate advisory_probes block — never mixed with deterministic evidence in probes. They feed Gate-3 only and are not sole authority for any gated path.

Output

Nova sign-off comment on this issue, or a list of blockers that must be resolved before freeze.