C-16 entry list — what remains before independent hostile review can begin

Superseded. This is the 2026-09-01 list, kept as written. Its denominators (routes, witnessed, blocked, never-executed, refusal codes) were measured at cce8705f and have moved every day since; the current ones are generated in docs/reference/README.md and docs/reference/routes.md, and the walks that replaced this list are C16_REHEARSAL_2026_09_03.md and C16_REHEARSAL_2026_09_04.md. Its §0 warning that docs/reference/ was being held stale is itself stale: the reference has been regenerated.

Status: gate list, not a status board. Owner: lane S11 (C-00, C-16). Measured at cce8705f, 2026-09-01. Companion: docs/evidence/DEBT_OWNERSHIP_LEDGER_2026_09_01.md.

C-16 says reviewers may start only when "no known material gap, unexplained authority, stale claim, unowned economic flow, never-executed intended route, or user-inaccessible capability remains." This is the list of what does remain, by that row's own six categories.

Every item is in exactly one of two states, per docs/MASTER_COMPLETION_CONTRACT.md: implemented with evidence, or ruled out by Ember with a date. Nothing here is deferred, parked, or out of scope. Where an item is neither yet, it says so and names who owns making it one.

This list is short on purpose. It is meant to be true, not complete-looking; a category with no instrument says so rather than reporting zero.

---

0. Read this before the list

Every one of C-16's six categories now has an instrument, and none is finished. Unexplained authority (§5) was the last blank and no longer is: the PRIVILEGE class turned out to answer the opposite question, so a seventh seam-audit class was built for this one — 3 findings, 2 verified benign, 1 open hazard. Unowned economic flow (§6) has its atom half swept — 103 compartment-setting sites, every one owned — with its lamport half still open. Read §6's qualifier before quoting its number: swept clean at the construction sites, correctness not asserted. Unswept ground is not clean ground.

The register that answers three of the four is young and was wrong until this week. docs/reference/routes.md derives route status from tools/gauntlet/*/bindings.json alone and never consults the evidence ledger: it cannot distinguish a route whose chain evidence was folded from one whose campaign has never run. Corroboration lives in dclutch-route-census observe → CENSUS.md. Where the two disagree, CENSUS.md is the evidence and routes.md is the claim. A reviewer who cites a "witnessed" row is citing an assertion.

docs/reference/ is stale at HEAD and is being held deliberately. The convergence owner is holding regeneration until the lanes quiesce, so in-tree reference numbers lag this file. The numbers here are freshly measured; the published ones are not yet.

---

1. Never-executed intended route — 57 of 161, measured

Nobody may close C-16 against this number until the 57 are each either driven or given a written reason with an owner. That is the single largest block of work on this page, and it is not adjudicable by argument — only by campaigns.

1.1 How much of the 57 is the instrument, and how much is real

The instrument hole turned out to be much smaller than the register's own history suggested, and the answer is the useful part: of the 57, 2 fall to the emission change and 55 are genuinely unexecuted.

Measured rather than assumed. The three campaigns that pass and emit nothing were wired to emit (c858747b), and then each was traced to the census route ids it actually drives:

Two other things the tracing settled, both negative and both worth stating so nobody re-derives them hopefully:

• fractional-atomic does not drive the fractional retirement family (claims/fractional_retirement_v3::process, process_begin#Begin, process_coordinate#RetireCoordinate, process_finish#Finish). Its tests reference FractionalExposureActionV2 only — Wrap, WholeUnwrap, TerminalRedeem, TerminalZeroBurn, Transfer — and no FractionalRetirementActionV3 at all. Those four are real gaps.
• It does not drive the native compaction or redemption either (process_compaction, process_redemption#else); it drives the fractional siblings, which are different routes.

So the 8 routes already in blocked-with-a-reason move blocked → witnessed when a runner folds their evidence, 2 more move never → witnessed, and the remaining 55 have no campaign in the tree at all. That is the number C-00 and C-16 close against, and it is protocol work rather than instrument work. The register's own gap was the 10 already repaired at 96ddf38f, not a further reservoir.

1.2 Closed: the campaign was built, run, folded and bound — 939d0806

The prediction held exactly. A fresh six-program SBF set was built (zero stack-frame diagnostics), fractional_compaction was run against it with DCLUTCH_PROGRAM_TEST_EVIDENCE_DIR set, and 47 transactions were emitted, folded and put through dclutch-route-census observe, which admitted 94 observations with zero problems.

2 never → witnessed — claim_check_compaction_v1::process_open_escrow and claim_check_redemption_v1::process_escrow_close#CloseEscrow, the two §1.1 predicted — and 2 blocked → witnessed, the fractional compaction and redemption routes. Their blocked.json entries were then deleted, per that file's own rule: keep an entry only while it is true, and delete it the moment its route executes.

census observe caught the first draft of the bindings, which is the whole argument for authoring them from observation. Six hostile crank substitutions shared one label; I read the refusal code off the first transaction and wrote it for all six. Five of them raise different codes, and the fold refused to record coverage it could not corroborate. The label now carries the plant — the discriminator the campaign itself varies — and every label was then checked to carry exactly one outcome and one refusal code before a binding was written. An earlier pass had already caught a milder version of the same thing: labels generated from the enclosing helper put executed and refused transactions under one name, which no binding can describe.

One observation closes a loop this campaign opened. The hostile Faithful/CoreMarketBeforeTerminal rewrites the Core Market to Open with its terminal receipt dropped, at its own derived address, so the phase is the sole discriminator — and it refuses Custom(0x5644), FractionalClaimCheckCompactionSbfErrorV1::Phase. That code could not be raised at all when this ledger opened: §1.3 convicted it as a guard declared and never written, S7 landed the guard at fractional_claim_check_v1.rs:1196-1209, and this is the first census evidence of it firing on a real ELF. Declared, convicted, built, and now observed.

What is landed and what is not. programs/dclutch-claims-sbf/program-test/fractional-atomic emits and one of its four targets is bound; tools/gauntlet/claims-fractional-atomic/ carries the runner, programs.json and 17 corroborated bindings. user-position-admission emits and compiles but is not bound — it needs a Trading ELF this lane did not build, and its three routes remain in blocked-with-a-reason rather than being asserted. general-hot stays unwired on the §1.1 finding that it reaches nothing in the 57. The three other fractional-atomic targets still call record() for nothing; blocked.json now says so precisely rather than covering the whole workspace.

Three campaigns exist, pass against real ELFs, and emitted no census evidence until c858747b. Recorded in tools/gauntlet/blocked.json with owners rather than left silent:

Writing bindings for these without the emission would flip routes.md to "witnessed" for transactions census observe could never corroborate. That is the false green this lane exists to remove, so it was declined.

2. User-inaccessible capability — 19 selectors, two of them plain

C-16 forbids these by name. Of roughly 57 top-level selectors, 19 are reachable from neither the CLI nor the SDK. Two are the clause in its plainest form, both verified against the tree:

• DCLTDFS1, DIRECT_FEE_SETTLEMENT_REQUEST_MAGIC_V1 — C-04's permissionless third-party fee completion, a route designed for a stranger to call. Every mention is its own codec, a campaign harness, the local-validator bootstrap, and docs. Nothing in packages/dclutch-sdk, tools/dclutch-cli or apps/dclutch-web. A permissionless act only our own test harness can perform is not permissionless.
• DCLTPCA1, PROJECTED_CUSTODY_ABORT_MAGIC_V1 — "Sole top-level projected-Custody founding-abort instruction" (programs/dclutch-trading-sbf/src/projected_custody_bootstrap_v1.rs:199, dispatched at src/lib.rs:696-697). The way back out of collateral stranded by an expired projection. No client at all; the only exterior is an operator bootstrap. A recovery act with no client is a fund-recovery path a user cannot walk.

Browser reachability is over-counted by 20 routes. Grepping a magic in apps/dclutch-web hits lib/generated/routeCensus.ts — the published census listing, which mentions every route and builds none. Counting those inflates C-12. The figure depends on the definition, so all three are recorded: 14 routes if only the listing is discounted, 15 if every generated module is, 20 if tests are too — which is the honest C-12 number, because a test proves the code can build the transaction, not that a person can.

State: neither implemented nor ruled out. → ledger R-12, owners Direct (C-04), Trading (recovery), SDK/CLI.

3. Stale claim — 6 unfixed of 8 verified

Eight contradictions between a current guide and the code were verified with both citations; two are fixed. The six that remain, each with its refuting fact, are listed in the ledger §4 and routed in §10.1. The sharpest:

• README.md:166 and docs/guides/reader.md:67 teach a one-liner that aborts in argparse (five flags are required=True; --seeds defaults to 20 while the route demands exactly 1).
• ARCHITECTURE.md:5-6 — the 2026-08-27 supersession banner, explicitly "the only edit" made to un-stale the file, names DCLTCOR2 as current when the generated ABI says DCLTCOR3. The banner that fixes staleness is itself stale.
• programs/dclutch-claims-sbf/README.md:53 names a producer file that does not exist, inside a deletion-readiness claim — the kind that gets acted on.
• tools/gauntlet/tier2/README.md is wrong about its module, its mode flag and its campaign registry: three claims, none of which exist.

Unresolved by measurement: whether the first market is open on devnet. Six current guides disagree and deployments.ts pins no market address, so the tree cannot settle it. → R-10, routed to S1/S10, answerable rather than rulable.

4. Material gap — 1 dead refusal code, 11 orphan items

Refusal codes: 1 of 297 has zero raise sites, down from 12 at this campaign's first measurement. The survivor is ClaimsSbfError::CustodyRequired = 0x5006, and it is dead because the route that would raise it was never built: claims.conserve / DCLCNS01 has semantics, a tested no_std contract, and no dispatcher, no operator, no client. → R-3, and it is being answered by implementation (1d1c2453 is the first DCLCNS01 constructor and the first Cargo dependency that contract has ever had).

Eleven orphan-material items — material, and no contract row or index entry owns them — are listed in the ledger §3. Four re-verified at HEAD for this file: the whole ClaimCheck escrow/compaction/redemption capability is on chain and never run (4 routes); /local renders a cluster <select> whose selection it ignores, dispositioned "out of scope" with no ruling and no date; tools/devnet-activity resume "remains poll-only and never invokes a child", so an interrupted devnet lifecycle can be observed but not resumed; the founding wizard ships preview placeholder service identities.

Four OMISSION_INDEX.md rows are stale-open — the code moved and the status column did not (U-013, whose status field contradicts its own amendment; U-003; U-006; U-014). A reviewer handed that index would be misled about four rows.

4b. Never-compiled code, and the prose that outlives it

A category contributed by the resolution lane, with its own instrument, and the second half is the one that actually misleads.

Never-compiled code behind an always-false cfg — currently ZERO tree-wide. Verified: every #[cfg(any())] hit in the tree is prose in WAVE.md or docs/ describing the class historically; not one is a live attribute. The instrument is cheap and belongs in any reviewer's kit: one grep for #[cfg(any())] plus an undeclared-feature check, and deletion is verified by ELF byte-identity — if the block never compiled, removing it cannot move a byte. A clean category, and it is recorded here because it is clean: a reviewer should be able to see which ground has been swept.

Live prose citing deleted symbols — five comments across four files. This is the misleading sibling and it is still open. funded::process_funded_transition is cited in the present tense by comments in programs/dclutch-core-sbf/src/{resolution.rs:865,resolution.rs:880,lib.rs:149,tests.rs:306} and tools/local-validator/bootstrap/successor/src/market.rs:12809, as a ladder that "has one call site, under #[cfg(any())]". That function has no definition anywhere in the tree, and neither does the block — both nouns are unfindable. programs/dclutch-resolution-proof-sbf/src/funded.rs:20-35 is the remediation note that names them, not a fifth instance.

One of the five is the sharp one: core-sbf/resolution.rs:880 is a lifting plan that says to "resurrect" a symbol nobody can locate. A plan whose first step cannot be performed reads as tractable work and is not.

This is what turns dead code from untidy into misleading, and it caused a lane to misreport this morning. It is also §8.2's shape one level out: there, a present test was hollowed out while its documentation cited it; here, the code is gone and the prose still points at it. Both fail the same way — the citation outlives the thing cited, and nothing goes red. A reviewer should treat any present-tense reference to a symbol as a claim to check, not as a pointer to follow.

State: not implemented, not ruled out. The comments are correct about what they justify (CoreSbfError::RecoveryWalkUnavailable stands for a live and checkable reason) and wrong about why, which is the worst combination for someone reading them as a map. Owner: Resolution/Core, alongside the recovery ontology ruling in docs/MASTER_COMPLETION_CONTRACT.md:177.

Instrumented, by the Resolution lane, at bc3c7556 — tools/doc-citations/, whose own docstring names this as "ledger 8.2: the citation outlives the thing cited". One category, one instrument, one owner: it is theirs, and it is recorded here rather than separately so the finding and its reader do not drift into two lanes' private notes.

Its rule is the tractable one: every symbol named in backticks inside a doc comment resolves. The signal is a namespaced path whose leading segment belongs to this workspace and whose final segment is declared nowhere in it; prose, file paths, code fragments and foreign-crate paths are declined out loud, with the declined count printed — because, in its own words, a declined citation is not a passing citation. That is §8.3's rule applied to a reader's own coverage, and it is why the tool can be trusted about the ground it does cover. It reports rather than gates for now, which is the right order: the category is worth watching before it is worth gating.

5. Unexplained authority — instrumented, 3 findings, 1 open

Checked rather than assumed, because a privilege-shaped instrument does exist and it would be easy to mistake for this one.

tools/seam-audit runs a live PRIVILEGE class with a triaged baseline: 70 findings — PRIVILEGE_PIN_UNEXEMPTED 41 (38 hazard-privilege-pin) and TRANSACTION_LEVEL_SIGNER_CENSUS 29 (24 hazard-signer-census), with benign-declared-privilege-census 3, checked-caller-excludes-payer 2, benign-payer-pinned-signer 1, benign-named-coordinates-only 1 and confirmed-defect 1. It is a real gate with negative controls.

It answers a different question, and in the opposite direction. Its own docstring states the subject: "An exact-privilege census is a constraint on the whole transaction, not on your instruction" — privileges merge across a transaction, the fee payer reads is_signer == true in every instruction that names it, so a blanket is_signer refusal or an unexempted is_writable pin makes the frame unsatisfiable for a legitimate builder. Its negative control is 5ca145e8, which did exactly that to three abort routes so "an expired founding can never be unwound".

That is an over-constraint / liveness reader: it finds routes that refuse what they should admit. C-16's unexplained authority is the under-constraint / soundness question — which signer, PDA or cached role authorises an act, and whether any authority is asserted rather than derived from an authenticated record. The PRIVILEGE class never asks whether a signer is the right signer. The two point opposite ways, so its 70 findings do not shrink this category by one.

So the reader was built (9f9f943c, e548df96): seam-audit's seventh class, AUTHORITY, code AUTHORITY_CACHE_UNDERIVED.

The question it asks. Its subject is the Registry-owned activation cache, chosen because a cached role is where authority is likeliest to go unexplained: the authentication happens once, in another program, and everything downstream reads the result. The protocol's settled shape for reading it is written down in dclutch-registry-activation-auth-v1 — privilege frame, cache ownership, address derived from [ACTIVATION_PDA_DOMAIN_V1, release_set_id], hostile decode, deployment check. A function that decodes the cache while doing neither that delegation nor, in its own body, both a derivation and an owner check, is reading a role out of an account whose provenance it never established.

Result: 3 findings, all on-chain.

The honest difference between those two rows is that the Custody chain was read end to end and the Trading one was not. AGENTS.md's rule about absent signals applies to verdicts as much as to measurements: not shown to be wrong is not shown to be right, so the second is recorded as a hazard rather than assumed benign.

What a clean result would assert, and what it would not. Silence means every on-chain cache read either delegates to the shared authenticator or derives and owner-checks the account itself. It does not mean the authority is correct: a function that derives the right address and then reads the wrong role, or applies a role to an act it does not cover, reads as derived and is still wrong. Provenance and correctness are different questions and this reader answers the first — the same distinction §6 draws when it says swept clean at the construction sites, correctness not asserted, and §8.1 draws when it says an instrument reports a property and never a verdict.

Its negative control is synthetic and passes: authenticate_market is silent at HEAD, and deleting its delegation to authenticate_activation_cache_bump_v1 makes the reader name it. A checker that has never caught a defect is decoration; this one is held to the same bar as the other six.

Scope, stated because it bounds the claim. One authority object (the activation cache), programs/ only — operator and codec crates decode the cache to build a transaction, where it is not an authority check at all — and one level of call resolution within a crate, which is what lets it see the Registry's own local authenticator. Signer-derived authority, PDA-owner authority and re-used cross-instruction authentications beyond the cache are not covered. This category is now instrumented, not finished.

6. Unowned economic flow — atom half instrumented and swept; lamport half open

Atom half: swept, and clean at the construction sites. The conservation lane built the instrument in dclutch-custody-contract: all 81 ordered compartment pairs exercised through CustodyRequestV1::validate, plus a census of every site that sets a compartment — 54 source-side and 49 destination-side, every one owned by a pinned literal, a closed match with a catch-all Err, a direction accessor with literal arms, an in-contract pass-through, or the wire decoder, where the owner is the authenticated calling program.

**Carry this qualifier with the number, because it is the whole of what the instrument claims: *swept clean at the construction sites, correctness not asserted.* A site that pins a wrong-but-literal pair reads as owned** and still violates C-10. Ownership and correctness are different questions, and this instrument answers only the first. A hostile reviewer should read "every compartment set has a named owner", never "every compartment set is right".

The finding underneath it is the one to carry forward: HoardPrincipal → FeeVault is shape-admissible on the wire — the movement C-10 forbids — because every compartment rule lives in a calling program and the contract itself never enforced one. Deliberate, but undocumented and unmeasured until 2026-09-01. Nothing pins that pair; both FeeVault-funding sites take TradingPrincipal, so the hole is admissibility, not a live leak.

Lamport half: open, and in flight. Rent beneficiaries, funding releases, closes and crank rewards are a separate unit, now being built. Until it lands this category is half-swept, and AGENTS.md's invariant ("Hoard principal is never fees, rent, bounty, insurance, work funding, reserve, or treasury capital") is enforced for atoms at construction and unmeasured for lamports. C-11's economics remain separately open and Ember owns each choice.

---

7. Ember rulings still open

Each blocks a category above. One line each; full statements in the ledger §10.

---

8. What a hostile reviewer should distrust, and why

These are the epistemics, not the findings. They are here because a reviewer who does not know them will repeat the errors this campaign made.

8.1 A dead code has at least three causes, and the census names none of them

One instance of each appeared in this campaign:

The census reports absence; it never reports cause. A census whose output is treated as a verdict produces exactly the third row. Every "dead" finding needs a second method before it becomes an accusation.

8.2 The shape to look for: a present test, hollowed out

The sharpest instance anyone found this campaign is not a missing test. crates/dclutch-svm-harness's resolution_successor campaign had primary_instruction and funded_caller_instruction replaced by panic! stubs at 2026-08-26 00:19 (d1325c7f); the #[ignore] landed 47 minutes later (583e5bfa). The body was unreachable for six days while the README went on quoting its ten-row compute table as evidence. Found and remediated by the resolution lane (svm-harness/README.md:97-109, docs/ledger/WAVE_2026-08-26_to_2026-09-02.md:2329-2342).

Not a missing test, but a present one hollowed out while its own documentation kept citing it. A reviewer should assume this shape exists elsewhere and look for it directly: green suites whose bodies do not run, and prose that cites them.

8.3 The instruments were wrong four times, and each was found by re-deriving

Every number in this file comes from tooling that was wrong at least once: prefix shadowing in an rg -F alternation (would have reported 30 dead refusal codes instead of 12); leftmost-match truncation on crate::Enum::Variant; a filename scan that missed *-bindings.json (reported two bound campaigns as unbound); and a census-inventory check that reported "no ELF dispatches two of them" for all ten magic collisions, because the inventory records those as Predicate selectors rather than Magic — a false negative on the exact question being asked.

The rule that caught all four: an absent signal is evidence only when something present proves the channel works. Every claim of absence in this file was checked by a second method that shares none of the first's assumptions, and the route register's own control is that a route known to execute (claims/founding_v5::process) reads witnessed through the same path.

8.4 The instrument catches its own author

a19d93b1 moved a wire discriminant (RecordActionV1::Begin, 1 → 5) and left tier 1's bindings pointing at the old route id — the identical defect this campaign convicted in fdfbe0dd two days earlier, committed by the lane that convicted it, four commits later. It was caught within the hour by the stale-binding-ref check added for the first instance, and repaired in cce8705f.

Recorded because it is the strongest available argument for the check: the author who had just written the finding still made the mistake. A reviewer should assume the same of every convention in this tree that is enforced by attention rather than by a gate.