**REVISE**

Verified clean (no defect): no identifier is allocated anywhere — all four roots carry `modelId: null`, `registryId: null`, `allocationState: "unassigned"`; the profile carries `newRuntimeId: false`; no WM-* code is invented for a candidate root. No publication readiness is claimed — `canonicalPublishable: false` and the research-only publication statement appear on all four roots and the profile. No numeric privacy threshold (k, noise, budget) is invented. Compensation Review is correctly rejected as a root with outcomes left on WM-REC-010. I propose no fifth root; the incentive/in-kind gap below is resolvable by ownership assignment or by the unowned register.

Closed defect checklist.

1. **BLOCKING — Assignment lifecycle contradicts its own rules.** `independentLifecycle` opens with `proposed, reviewed`, but CA-07 and CA-08 place proposed terms and unapplied recommendations on the WM-REC-010 decision, not on the assignment. Either the assignment exists only from `authorized` onward, or CA-07/CA-08 are false. Remove the pre-authorization states.

2. **BLOCKING — Enrollment lifecycle flattens two state machines and admits an electionless enrollment.** BE-01 makes election constitutive of identity and BE-04 makes election and coverage separate owned components, yet one linear lifecycle mixes election states (`elected`, `waived`), a pre-election state (`offered`) and coverage states (`active`, `suspended`, `continued`). `offered` is a plan/eligibility fact and pre-empts BP-03. Declare per-component state sets, or drop `offered` and separate coverage states from election states.

3. **BLOCKING — Enrollment→payroll reference is inverted.** `benefit-enrollment.json` references WM-ECO-031 for "optional payroll deduction input only". Payroll reads enrollment; enrollment does not consume payroll. As written it plants a payroll dependency inside an aggregate whose BE-01/BE-05/BE-06 declare independence from payroll. Delete the reference and state the consumption direction in the profile.

4. **BLOCKING — No person/party master is cited.** BE-01 identifies an enrollment "by person" and CA-01 "per worker", but neither root references a party/worker master; Employment is optional (BE-03) or "and/or" (CA-05), so under continuation the person identity has no cited authority. Dependents (BE-08) have no identity master either. Cite the party master or register it as unowned.

5. **BLOCKING — Profile constraints have no stable IDs and two fixtures bind to nothing.** `unsafe-difference` and `payslip-payment` carry `"rules": []`. The eight profile constraints are unnumbered prose, so the two most important negatives — differencing refusal and payslip-is-not-settlement — are untraceable. Give the constraints stable IDs (e.g. `EP-01…EP-08`) and bind both fixtures.

6. **MAJOR — "Submission is not acceptance" is dropped entirely.** No rule at any root states that statutory filing or remittance submission proves nothing about authority acceptance, and no rule-level statement exists that net pay and payslip do not prove settlement (it survives only as unbound profile prose, see 5). Both studies assert it. Add rules.

7. **BLOCKING — An open reconstruction path is left unconstrained.** CB-08 makes compa-ratio, occupancy and position-in-range observations but nothing restricts their disclosure. A published band version plus a subject's compa-ratio yields exact pay; a WM-ORG-004 seat-level transparency range on a single-occupant position discloses the occupant directly. Add a rule binding derived per-person observations and seat-level range publication to the same cohort-floor and suppression discipline as aggregates.

8. **MAJOR — Privacy control set under-specified against its own claim.** The profile asserts refusal of singleton/differencing/join/repeated-query releases but omits every mechanism that would make it checkable: mandatory cohort-floor reference on each projection, complementary suppression across overlapping cohorts, join-key withholding, release-set linkability declaration, uniform response across empty/refused/suppressed, suppression under recorded authority, provenance emission to an access-audit model. The uniform-response control matters most — distinguishable refusal and suppression responses are themselves a differencing oracle, and Claude's scenario ("refusal and suppression are logged identically") was lost in reconciliation. These can be declarative without inventing a threshold.

9. **MAJOR — WM-MAT-008 is a base with no boundary.** It appears in `bases` with no constraint, no rule, no fixture, and Claude's registry-placement caution is not carried into holds. Pay-gap indicators over small cohorts are a disclosure vector and are not bound to the floor. Constrain it or remove it from `bases`.

10. **MAJOR — CA-12 is weaker than CB-10.** CB-10 pins source, direction, time and rounding on conversions; CA-12 says only "explicit derived observations". WM-ECO-004's prohibition on derived inverse rates and its rate-type/determination-time requirements are not restated for assignment components, which are the amounts that actually reach payroll. Align CA-12 to CB-10 or stronger.

11. **MAJOR — Temporal set incomplete.** CA-09 and BE-07 enumerate effective, decision, payroll-period, payment-value and remittance-due times but omit communication date (distinct from decision date in both studies) and any knowledge/transaction time. Without bitemporality, CA-02's append-only successor cannot distinguish a retroactive correction of an erroneous record from a genuine retroactive amendment — they produce identical histories. Add the missing axes and a correction-versus-amendment rule.

12. **MAJOR — FTE mastership and coverage-FTE independence unstated.** CA-04 requires every component to pin FTE or working-time normalization but no rule places that mastership on WM-ORG-004 capacity / WM-ORG-005 working-time pattern, so the assignment reads as mastering it. Separately, Grok's point that coverage FTE is independent of pay-comparison FTE has no counterpart in the BE rule set, which contains no FTE rule at all.

13. **MAJOR — CA-03 is hedged, and in-kind/equity terms lost their owner.** "reusable incentive eligibility **may require** a separate plan boundary" is not decidable and cannot be fixture-tested. Revision 2 also narrowed owned components to base/allowance/differential/target-variable, dropping Claude's in-kind benefit and equity grant reference; `unownedScopeRegister` lists "equity-plan administration" but not the in-kind or equity *term*, so those terms now have no owner and no register entry. Decide the boundary or register the gap — a fifth root is not warranted on this evidence.

14. **MAJOR — The WM-ECO-031 scope conflict is asserted away rather than held.** Claude records that WM-ECO-031's scope statement claims compensation-term ownership while its boundary notes and out-of-scope treat terms as external, and calls it an unresolved overlap to be narrowed *before* the assignment root is registered. The profile states the desired outcome as a constraint but records no open blocker. Add it to `holds` as an unresolved mastership overlap.

15. **MAJOR — Holds omit three known provenance defects.** Missing: single-provider waivers and absence-of-external-review on WM-ECO-031, WM-ORG-005 and WM-ECO-002; the frozen relation ledger containing no WM-ECO-031 edges, leaving the parent signal to WM-ORG-005 and all proposed edges unsettled; and Grok's blocker that reuse-target texts were absent from its packet, so amount-pin and settlement fitness of the reuse targets are assumed, not verified. The generic "every cited base remains a non-canonical draft or reservation" does not cover any of these.

16. **MAJOR — Unowned register incomplete.** Absent from `unownedScopeRegister`: the band↔grade-scheme-version binding (CB-07 asserts axis separation and `excludes` names grade scheme, but the citation target — the EM-PEO-08 grade-scheme candidate — is neither referenced nor registered), market/survey benchmark data, access audit (WM-XCT-004), ownership (WM-XCT-001), consent (WM-XCT-002) and sensitivity classification (WM-XCT-020) — the last three being prerequisites for the dependent and pay data these roots hold.

17. **MINOR — Root `excludes` lists omit derived and aggregate artifacts.** "Aggregates are never root attributes" and "position-in-range is an observation" live only in profile prose and CB-08; no root's `excludes` names aggregate disclosure or derived observation. Add to all four for boundary symmetry.

18. **MINOR — Artifact and ID hygiene.** `fixtures.json` uses `contour` where the other four use `contourId`, and lacks both `candidateRevision: 2` and any non-publishable marker, so it cannot be bound to the revision it tests. Fixture IDs mix a numbered namespace (`band-01`) with renameable slugs (`off-band`, `unsafe-difference`), and fixture prefixes (`band/assignment/plan/enrollment`) do not match rule prefixes (`CB/CA/BP/BE`). Rule IDs are not contour-qualified, so `CA-01` is not stable against collision with another contour. Qualify as `EM-PEO-09.CA-01` or equivalent.

19. **MINOR — Normative text is duplicated with no precedence, and one lifecycle term collides.** `identityTest.stableIdentity` and `versionIdentity` restate rules `-01` and `-02` verbatim in all four files with no statement of which is authoritative; they will drift. Separately, the band lifecycle state `published` collides with the registry-publication vocabulary this candidate must never assert — rename to `promulgated` or `in-force`.

20. **MINOR — Rule→fixture binding is nominal.** All 49 rules have a 1:1 fixture (CB 12, CA 13, BP 12, BE 12 — complete, no gaps or duplicate IDs), but every semantic case restates its rule as input and expects only "Rule X is normatively asserted." Nothing discriminates: a model violating the rule passes identically. Only 6 of the 8 acceptance/positive/negative cases carry bindings (see 5). Pair each rule with at least one discriminating counterexample.

This list is closed at 20 items; defects 1–5 and 7 must clear before the candidate is fit for registry consideration, and none of them is fixable by allocating an identifier.