C-16 rehearsal — an independent hostile walk of the completion matrix

Status: rehearsal, not an assurance-entry certificate. Owner: lane C16-REHEARSAL. Measured 2026-09-03 in the window 78176e644 → 9e3c4eeff on /Users/ember/dev/dclutch (the live tree; not the frozen subtree at /Users/ember/dev/dragons-clutch/dclutch). The tree took roughly forty commits during the walk, so every measurement below names the file, line or JSON key it came from rather than a commit-wide claim.

C-16 admits reviewers only when "no known material gap, unexplained authority, stale claim, unowned economic flow, never-executed intended route, or user-inaccessible capability remains" (docs/MASTER_COMPLETION_CONTRACT.md:101). That condition is not met. This file is what a reviewer would find on the first pass, organised by that row's own six categories, and it supersedes docs/evidence/C16_ENTRY_LIST_2026_09_01.md where the two disagree — that file is two days old and the tree has moved a great deal.

0. The three findings that reframe everything below

(a) The evidence classes are not what the register's vocabulary suggests. docs/reference/routes.md:30 reports 16 of 162 routes NEVER-EXECUTED, down from 57 of 161 on 2026-09-01 (the register's own figure at 3466740e9; the companion doc says 55 — §2.1). That is a real improvement and it is also the wrong number to read as coverage. Sorting the 101 witnessed rows by the substrate their campaign actually used:

The honest figure for C-16's never-executed intended route category is therefore 50 of 162 — the 16 with no stated reason, plus the 28 blocked entries that are status reports rather than blocks, plus the 6 that say in their own text that they are driven and unwired. Thirty-four of the fifty carry an owner and a sentence, which is a materially better position than 2026-09-01; none of them is a block.

Contract item 5 requires "a local validator or devnet transaction drives the route when the route is chain-facing" (docs/MASTER_COMPLETION_CONTRACT.md:52-53). 19 of 162 routes meet it.

(b) 25 routes' sole witness is a campaign that cannot be re-run. tools/gauntlet/run.sh:94 dies on --mode full with "the tier-1 campaign is parked at the retired demo-market boundary", and tools/gauntlet/TIERS.md:27 says the same. Every route whose status column reads only executed (tier1) — 25 of them, including custody/initialize#Initialize, registry/process_activate_role#ActivateRole, core/process_open#Open and trading/projected_custody_bootstrap_v1::process_projected_custody_abort_v1 — is asserted from evidence the tree can no longer reproduce. That fails contract item 9 ("a cold-machine command and machine-readable evidence pack reproduce it") on its own, independently of whether the transactions were real when they ran.

(c) The artifact the register itself names as "the evidence" is not in the tree. docs/reference/routes.md:14-20 tells a reader that bindings are only a claim, that corroboration lives in dclutch-route-census observe → CENSUS.md, and that "where the two disagree, CENSUS.md is the evidence". git ls-files finds no CENSUS.md: it is written to a run directory (tools/gauntlet/run.sh:139, REPORT="$OUT/CENSUS.md") and never committed. A reviewer cannot check a single witnessed row against corroboration without re-running a gauntlet — and for the 25 tier-1 rows, cannot at all.

---

1. The matrix, row by row

class is the strongest evidence that exists today: devnet act (a finalized transaction on a public cluster), validator (solana-test-validator via journey/relayed-vertical), real-ELF (solana-program-test against a built SBF ELF), kernel/fixture, or nothing. Categories are C-16's six: G material gap, A unexplained authority, S stale claim, E unowned economic flow, R never-executed intended route, U user-inaccessible capability.

C-00 — Scope closure

class: n/a (bookkeeping row). Strongest artifact: docs/OMISSION_INDEX.md.

• G All fifteen U- rows in docs/OMISSION_INDEX.md:83-97 are still classified unfinished; not one has moved to implemented-with-evidence or to a dated Ember ruling. C-00 forbids a third state, and fifteen rows are in one.
• S docs/MASTER_COMPLETION_CONTRACT.md:74-81 still routes every crew to "the register's 55 NEVER-EXECUTED routes … C-01 4, C-02 5, C-04 4, C-06 8, C-07 2, C-08 5, C-09 14, C-10 13". The register says 16 (docs/reference/routes.md:30) and the distribution is different. The contract's own work-queue pointer is stale.
• S The same block names docs/evidence/C16_ENTRY_LIST_2026_09_01.md as "the entry list for C-00/C-16"; that file's §1 headline (57/55 unexecuted), §3 (six stale claims), §5 (three authority findings) and §7 (R-8, C-15 open) are each contradicted below.
• R 16 never-executed routes, enumerated in §2.

C-01 — Infrastructure, Registry, release lineage, migration, Rent

class: devnet act. Strongest artifact: docs/evidence/COHORT14_SEALED_FOUNDED_FILLED_2026_09_03.md §3–§4 — seven programs redeployed with fresh identities, each image dumped back and compared before the next deploy started, then a 36-transaction ladder publishing ten record bodies with initialize, succession and activation all re-observed from the cluster rather than from the driver's exit code.

• R core/infrastructure_v2::process_initialize_v2 (the V1→V2 succession ceremony) has never executed. It is blocked with an owner and the contract's decision register ruled on 2026-09-01 that devnet need not run it (docs/MASTER_COMPLETION_CONTRACT.md:188) — but that ruling explicitly left open "whether C-01 wants succession EXECUTED at all before assurance", and nothing has answered it since.
• R registry/lineage_v1::process and registry/process_abort#4 — no campaign. Release lineage is the thing C-01 names as walkable, and its route has never run.
• G Migration and retirement replay from exact releases: no campaign exists. Cohort-13 was closed by reclaiming program rent (COHORT14_…:80-96), not by driving Retire; the doc says retirement is "owned-loopback only". Verified on chain for this review: a census of every 368-byte DCLTCOR3 Market across all three live Core programs — 13 markets — finds none at phase 3 Retired. The lifecycle's terminal state has never been reached on a public chain.
• G Cohort-13's close is the one part of the cohort-14 evidence with no checkable artifact: COHORT14_… §2 states seven close transactions and a balance arc 32.473851850 → 74.556570185 with no signatures and no slots. The poststate is confirmable (all seven ProgramData accounts read AccountNotFound) and the acts are not.
• E "every physical account's rent source/refund has one owner" landed as a per-plan declaration on 2026-09-03 (action-plan byte five, REFUND_SOURCE_CREDIT = 0 / PAYER = 1, commits d190297d, 648fad0a, 5fc108bd, c60f853b per docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3289-3293). Coverage of that declaration across the tree's other lamport-moving sites is measured in §5 and is partial.

C-02 — Compiler-shaped product entrance

class: devnet act. Strongest artifact: four cohort-14 markets founded from compiled descriptors — Direct FgzbVSWV…, DUVcCGfj… (market B), BL8zsFok… (market C), General 8ExdC1Rwb… (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3699-3707, 3785-3795, 3828-3832).

• G / authority-shaped A founding input on a public chain was transcribed from a #[cfg(test)] fixture. COHORT14_SEALED_FOUNDED_FILLED_2026_09_03.md §"WALL ONE" records that the General market's published OpenBatch AccountProfile declares rent_credit = 48 — "the width in account_rules_v3.rs's own #[cfg(test)] fixture, and the whole devnet external_widths block is that fixture transcribed" — while the only RentCredit this protocol produces is 128 bytes, read off that market's own account on chain. Two further transcribed widths are also wrong (activation_cache: 160 vs 1,288 observed; core_market: 320 vs 368). This is the producer-missing pattern reaching a released identity.
• R All five of the routes C-02 owned on 2026-09-01 are still never-executed: trading/generic_founding_stages_v1::{process_generic_found_and_permit_v1, process_generic_market_open_v1} and the three trading/projected_custody_bootstrap_v1::process_controller_funding_* steps (docs/reference/routes.md:283,284,291,292,293). C-02 is the only row whose never-executed set has not shrunk at all.
• U The compiled artifacts an operator finds are not all inspectable in the client — see §6.

C-03 — Curved and structured payoff bases

class: real-ELF, degrees 0 through 3. Strongest artifact: a degree-2 curved Product graph with its own DCLTPGT1 certificate founded against the real Core ELF — programs/dclutch-core-sbf/tests/found_program_test.rs:596-660 builds it and :1652 founds with it.

• S — I began this section believing the opposite, and the tree corrected me. docs/OMISSION_INDEX.md O-013 still says "the unreached degrees are 2 and 3 only", that dclutch-liability-basis-v2-kernel "genuinely has no consumer", and that closing the row "requires a ruling on which is the authority". All three are now false: crates/dclutch-product-payoff-v2-codec/src/spline_admission_v3.rs:98 sets SPLINE_EVALUATOR_RELEASED_V3 = true; runtime_v3.rs:255-278 decodes SPLINE_KIND with the degree on the wire and refuses outside [MINIMUM, MAXIMUM]; the kernel is a path dependency of that codec used by tests/spline_differential_v3.rs; and the authority ruling is executed there. O-013's cited enum lines (:105, :131) have drifted to :202, :305. A reviewer handed O-013 would report a capability gap that closed.
• G — the honest residual. What is missing is not the evaluator but the lifecycle: C-03 asks for degree-2/3 execution "through the live wire, evaluator, price gate, Claims layout, terminal payout and retirement". The founding is real-ELF; no curved market has been founded on any chain, and no curved market has reached terminal payout or retirement anywhere.
• A / producer-missing The DCLTPGT1 certificate in the real-ELF founding test is hand-assembled from literal byte offsets — certificate[0..8].copy_from_slice(b"DCLTPGT1") at found_program_test.rs:644-656. A real producer exists (crates/dclutch-product-runtime-v2-operator/src/spline_basis_v3.rs, reached by the spline_product command at tools/local-validator/bootstrap/successor/src/main.rs:399-400), and the program's own admission test does not use it. The fixture and the producer are two authors of one certificate layout.
• G / on chain — the sharpest finding in this file. The one named integer rounding boundary was applied on the wrong scale on a public chain, and it reached a stranger's paid position. COHORT14_SEALED_FOUNDED_FILLED_2026_09_03.md:2033-2064 fills in the table a prediction asked for before the fact: market C's cuts are 9850, 10250 over 100 — dollars — while the certificate's observation is 10069107908 / 1, the raw Pyth mantissa at exponent −8. On the cuts' scale that is $100.69107908, which falls in cell 1 and pays zero; the chain committed selector 2 and moved 500,000,000 atoms. Participant-2 92RrSCo9… bought 200 claims at index 1 and under the deployed program those claims pay zero; under the cuts' own scale they pay 200. The doc states it plainly: "This is the first time the two scales disagree across a position a stranger paid for." No SVM test ever ran a resolution with cut_denominator != 1 (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3865-3872). Repaired in-tree at 4cd2b9cb5 (StatisticSpecV1.source_scale_exponent, refusal ProviderScale 0x801C) — the repair has not reached a chain, and both market B's and market C's certificates stand as artifacts of the defect.

C-04 — Direct

class: devnet act, and the most complete lifecycle the project has. Strongest artifact: cohort-14 market C BL8zsFokbz7aEdo3wjtcNffd5P1D8a9wVxwKq3mcMsMN — founded → activated → admitted → filled by a stranger (4Pr3tdp9…, 1,281,582 CU) → captured inside its window (3uBt7JnQ…, 140,019 CU) → settled (4uxF1vqy…, 154,152 CU, certificate 91XTHXWv…, kind byte = 1, honest) → Terminal (zrdFbSPF…, winner 2) → redeemed (fqcRNCVt…, 350,878 CU) into a 170-byte Token-2022 ImmutableOwner ATA holding 500,000,000 atoms, Hoard drained to 0. Every one of those signatures was re-read from devnet for this review and is finalized with err = null; 21 of 21 sampled signatures across cohorts 13 and 14 confirmed, with every stated slot and CU matching to the unit.

Two sibling markets are the honest qualifiers: market A FgzbVSWV… is filled (1,284,573 CU) and fee-settled and stops there — still phase 1 with its activation deadline slot 492,447,083 passed; market B DUVcCGfj… is resolved, Terminal and redeemed but was never filled. The complete arc exists on exactly one market.

• G / R Registered Direct is still mostly a refusal. programs/dclutch-trading-sbf/src/hot_v3.rs:5854-5883: the two creation actions (RegisterSell, RegisterBuy) now dispatch; the comment at :5855-5861 states the rest — the fills, the terminals, both splits and both merges — "still refuses HERE", and :5881-5883 raises TradingSbfError::UnsupportedContent. C-04 wants all of them.
• S The contract's decision register at docs/MASTER_COMPLETION_CONTRACT.md:189 still says "hot_v3.rs:5372 refuses every Direct-kind Hot action except InlineOrdinary — RegisterSell, RegisterBuy, the fill, …". Both halves are stale: the line number is wrong (5372 is inside authenticate_product_runtime_hinted_boxed_v3) and RegisterSell/RegisterBuy are no longer refused.
• R Three Direct routes have never executed: direct_begin_retiring_v1, direct_replay_setup_v1, direct_token_setup_v1 (docs/reference/routes.md:278,281,282). "close every Direct root" is C-04's own wording and begin_retiring is where it starts.
• U DCLTDFS1 — permissionless third-party fee completion — is exercised by direct-fee-pair-programtest (docs/reference/routes.md:280) and was settled on devnet by an operator script, and no client builds it: see §6. A permissionless act only our harness can perform is not permissionless.

C-05 — General

class: real-ELF only. Nothing General has ever executed on a chain. Strongest artifact: the General-hot suite green after 0948b0224, with the two-slot proof green at slots 1 and 48 producing byte-identical 55-entry account lists at 603,939 CU (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3901-3910).

• G / R OpenBatch has never executed on any chain, so neither has anything downstream of it. The General market 8ExdC1Rwb… is founded and activated on devnet and nothing more (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3793-3795). C-05's whole lifecycle — collect, consider, freeze, materialize, distribute, expire, resume, close — rests on a batch nothing has opened.
• A / G The blocking law is an authority whose address the protocol cannot state: COHORT14_… §"WALL TWO" records that each of the four admitted caller authorities is seeded from sha256(request header ‖ inline bank) while the bank carries CURRENT_SLOT from Clock::get(), so "the address is a function of the executing slot and the account list is fixed at signing"; Trading refuses 0x4001. Repaired in-tree at 3a8ac205d (shadow_digest_v3.rs:107, slot-free seed) and the repair has not reached a chain — tools/cohort15/steps.tsv:00 is the redeploy that would carry it.
• U build_general_hot_instruction_v3 has callers only in programs/dclutch-general-accelerator-sbf/program-test/tests/hot_instruction_v3.rs (landed a517d27cc, 2026-09-02). No operator, SDK, CLI or browser caller exists.
• S docs/evidence/ASPIRATION_LEDGER_2026_08_27.md:1144 (M-40) still states "build_general_hot_instruction_v3 has zero callers" as a present fact.
• G The General market on devnet was founded with a wrong RentCredit width (C-02 above) and its capability seal derives to D9fMTT1wYzxvaKiEdtJRr6wn3bFVmduhr3w74au6L5TG, which is vacant — a permissionless route with a builder only for Direct.

C-06 — Dealer

class: real-ELF only. No Dealer market has ever existed on a chain. Strongest artifact: the 31-action campaign at 31/0 on three consecutive full runs against real ELFs (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3752-3762, commits 3c42f0ece, 40427e0f1, f6199f47e), covering LP Open → hostile Add → honest Add → LP Open

#2 → Add #2 → the selector-9 trade → its delivery → the partial equity Remove → both LP final Removes.

• E / G LivenessVault — the compartment C-11's economics rests on — has never moved an atom anywhere. It is declared at crates/dclutch-custody-contract/src/lib.rs:222-223, its vault address is derived and checked in the Dealer profile at programs/dclutch-trading-sbf/src/dealer/mod.rs:376-380, and the Dealer kernel does build LivenessVault ↔ DealerOwner work-funding legs (crates/dclutch-dealer-codec/src/lib.rs:1712-1723, 1763-1766). But the only real-ELF site sets pending_work_funding: 0 (programs/dclutch-dealer-accelerator-sbf/program-test/tests/accepted.rs:6268), and Plan::push returns early on a zero amount (crates/dclutch-dealer-codec/src/lib.rs:1402-1405). Every real-ELF Dealer transition therefore produces a plan with zero LivenessVault transfers. C-06's "consent-safe policy/epoch evolution" and C-11's "permissionless work … paid from explicitly classified sources" both terminate here.
• G "Any broader venue generalization is implemented or explicitly ruled out" — docs/OMISSION_INDEX.md O-010/O-011 keep the generalization open with no ruling and no date.
• A The Dealer accelerator is not in the seven-role release set and no tier deploys it (tools/gauntlet/blocked.json, rule dealer-accelerator/*), so its whole route family is asserted from ProgramTest only.
• G docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3758-3760 records the campaign's own qualification: "the campaign's ArtifactRelease records hash the ELFs, so every rebuild redraws every Registry-record search depth — ~45,000 of the improvement is the deployment's luck, not engineering." Several Dealer CU margins are therefore draw-dependent, and the tree says so.

C-07 — Series

class: real-ELF, one route. Strongest artifact: tier4-series-occurrence-programtest, which witnesses a single route (docs/reference/routes.md), plus the Template-driven activation on a real ELF recorded in docs/MASTER_COMPLETION_CONTRACT.md:191 (929095f5).

• G A shipped route is unsatisfiable. docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3936-3939: "expire_funding_artifacts_v5 pins a 128-byte V1 request while its effect declares a nonempty borrowed range — the Series expiry route is unsatisfiable as shipped." Expiry is one of the two occurrence paths C-07 names.
• G / producer-missing prepare_funding_artifacts_v5 allocates the Series ticket-state PDA as 64 zero bytes that TicketStateV3::decode always refuses; no route writes the magic (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3346-3349, named as the fourth producer-missing instance; design debt recorded at 333043db). The write authority is granted and never exercised.
• R claims/series_founding_transport_v1::process and core/series_permit_expiry_precommit_v1::process have never executed (docs/reference/routes.md:111,154).
• G "replay safely across more than one occurrence" — no campaign runs two occurrences. Series is loopback-only; nothing Series has been on a chain.

C-08 — Structured / Fractional representation

class: real-ELF. Strongest artifact: the fractional-atomic and claim-check campaigns, whose 47-transaction run was folded through census observe and admitted 94 observations (docs/evidence/C16_ENTRY_LIST_2026_09_01.md §1.2, 939d0806), plus structured-v2-programtest.

• G A shipped account profile nothing can satisfy. docs/MASTER_COMPLETION_CONTRACT.md:192: the profile declares Exact{0} for sixteen coordinates including the Rent sysvar and the System program, "and the same array ships in production". Five widths landed at d4cd3b27; the remaining seven (opaque += {2, 3, 10, 12, 14, 15, 33}) change emitted profile bytes → artifact digest → release identity, so they wait on a release event Ember schedules. The engineering is done and the defect is live.
• R Four fractional-retirement routes have never executed — claims/fractional_retirement_v3::process, process_begin#Begin, process_coordinate#RetireCoordinate, process_finish#Finish (docs/reference/routes.md:92,95,96,103) — plus claims/rational_representation_v2::process_replay_close. "retire without hidden remainder, absent-holder charge or stranded rent" is the row's own terminal clause and its route is unwitnessed.
• G Nothing Structured or Fractional has run on a chain.

C-09 — Objective resolution

class: devnet act. Strongest artifact: the honest resolutions of markets B and C — a capture committed inside the window, a settle strictly after end + max_age, a kind-1 certificate and Terminal, all re-read off chain for this review (91XTHXWv… for C, 6prkttkS… for B; commits 12a9b13a5, 3ba991025, evidence c09452e08). This is the strongest artifact in the matrix.

• G Provider breadth is one. docs/OMISSION_INDEX.md U-009 is unfinished; "disclosed fallback paths execute with real provider verification" has one adapter, Pyth.
• G / unruled The recovery ontology remains open (docs/MASTER_COMPLETION_CONTRACT.md:187): RecoveryPolicyV2, RecoveryAttemptV2 and recovery funding are live, green and kernel-complete with no live on-chain route; funded::process_funded_transition has no definition anywhere in the tree; SourceResolutionStateV2 has three transitions and none advances a recovery attempt, "so a market with a recovery policy cannot be terminalized at all". AGENTS.md forbids parallel authority paths, so this cannot sit.
• R core/resolution::authenticate_recovery_policy#(recovery_id,policy) and core/authenticate_no_recovery_entries#None — the recovery ontology's own guards — are blocked as structurally undrivable, which is the same fact stated as coverage.
• S Live prose still cites the deleted funded::process_funded_transition in the present tense in programs/dclutch-core-sbf/src/{resolution.rs:865, resolution.rs:880, lib.rs:149, tests.rs:306} and tools/local-validator/bootstrap/successor/src/market.rs — including a lifting plan whose first step is to "resurrect" a symbol nobody can locate.
• E / product docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3462-3466 records a protocol finding that has not been ruled on: "under the failure selector an oracle outage converts into founder revenue (the founder holds all 500,000,000 failure claims; participant-2's 200 pay zero)". That is an economic outcome of a resolution path, and it executed on devnet.

C-10 — Claims, Custody and terminal lifecycle

class: devnet act. Strongest artifact: three terminal payouts read back off devnet — market C fqcRNCVt… (350,878 CU, ATA 49ivrwyw… 170 B holding 500,000,000, Hoard Cjzv4FZB… at 0), market B 5aPHBEoa… (359,878 CU), and cohort-13 etUrsvhw… (353,233 CU) — plus the ledger census's seven applicable laws holding on market B (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3838-3842).

• E HoardPrincipal → FeeVault is still shape-admissible on the wire. crates/dclutch-custody-contract/src/lib.rs:1994-2029 is a test that asserts it: 64 ordered pairs admitted, None the only refusal, and the named assertion "the census must state that principal-to-fee is shape-admissible here, so that its refusal is looked for in the callers where it lives". No instrument enumerates the callers' rules. AGENTS.md's "Hoard principal is never fees…" is enforced nowhere a reviewer can check exhaustively.
• R / G Retirement has never happened on a chain, and Retired is the row's own endpoint. core/process_instruction#Retire, core/retire_v1::process_checkpoint_prepare#Retire, core/retire_v1::process_checkpoint_suffix, core/retirement_replay_handoff_v1::process and the three aggregate retirement magics were the 2026-09-01 C-10 list; most now carry blocked entries or programtest bindings, and none has a devnet act. Cohort-13 closed by reclaiming program rent, not by retiring its market.
• G claims/market_closure_v1::process is blocked with the reason "No campaign drives it" — a coverage gap, not a structural block.
• E The ledger census's own violations at the market-B payout boundary are recorded and only partly closed: COHORT14_…:1464-1492 lists VIOLATED L1/L4/L7/L8, adjudicates L1 as "a BINDING GAP and this is the finding", L4 as structural, L8 as the lane's own declaration, and states "L7's 3,693,136 lamports are NOT located." :1659-1696 then locates that residue exactly (3,749,136 − 56,000) and market C's post-payout census reaches "all seven applicable laws HOLD". So L1's binding gap and L4's phase-blindness are the residue: two conservation laws whose statements the tree says are wrong, not two facts it checked.
• G programs/dclutch-claims-sbf/src/… retirement receipt applied resource predicates to an identity slot, so "a stranger's one lamport blocks retirement forever" (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3934-3936); repaired at HEAD (63476c7b2) and never executed on a chain.

C-11 — Liveness and sustainable economics

class: real-ELF for the paid-work half; nothing for the policy half. Strongest artifact: seven live permissionless-work routes, each funding from present capital — enumerated in §5.4.

• I expected this row to be empty and it is not. My first sweep concluded "no route pays a stranger for permissionless work"; that is false. Seven do, and every one funds from rent already leaving an account or from a prepaid bounty. AGENTS.md's "Hoard principal is never … work funding" holds at every one of the seven, and crates/dclutch-claims-svm/src/claim_check_v1.rs:125-128 says so in its own words: "Nothing new is taken from the Hoard."
• E One standing self-declared violation, open at HEAD: docs/design/FUNDED_CRANK_V1.md:111 — "Ruling, and the tree violates it in one place today" — the reward floor must be Rent-sysvar-derived, and COMPACTION_CRANK_REWARD_LAMPORTS_V1 = 200_000 (crates/dclutch-claims-svm/src/claim_check_v1.rs:129) is a bare constant that two live routes read. The doc cites :108; the line has drifted.
• E LivenessVault still never moves (see C-06): zero transfers on any substrate. The Dealer kernel's work-funding legs are the row's modelled economics and they have never executed.
• E Of the three primitives the row names — "opener shortfall, upkeep vault and donation treatment" — one exists. upkeep, maintenance_vault, endowment, insurance and replenish have zero occurrences across programs/ and crates/; no enum carries a Treasury, Insurance, RentReserve or Upkeep variant; docs/design/UPKEEP_VAULT_V0.md is marked SKETCH, "Nothing here is chartered". opener.*shortfall is likewise zero — and the opener ships as a creditor, not a loss-bearer: crates/dclutch-claims-svm/src/claim_check_v1.rs:458,469 carry opener and opener_outlay, and claim_check_conservation_v1.rs:116's opener_debt_after carries debt forward and never writes it off. Donation exists only as classification: unclassified_donation (crates/dclutch-direct-codec/src/close_maker_v1.rs:276, conservation-checked at :296-299) and the admit_donations policy switch (crates/dclutch-capability-contract/src/funding.rs:2037). The payee ruling is open (UPKEEP_VAULT_V0.md:46).
• G docs/MASTER_COMPLETION_CONTRACT.md:186 records "Sustainable economics … open; Ember owns each economic choice". A docket was published for Ember on 2026-09-03 (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3944-3950, item D1, "five knobs at provable defaults"). Silence is never a ruling — the contract says so at :180 — so this row cannot close and no lane may implement past it.

C-12 — Stranger-operable product

class: devnet act (browser), real-ELF/none (CLI). Strongest artifact: the market page rendering market B's honest resolution and ATA payout derived from chain records, with the live redemption test 4/4 green (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3706-3712, 3846-3856).

• U The CLI cannot submit anything. tools/dclutch-cli/src/ticket.rs:22 states it in its own words: "AUTHORING IS NOT SUBMITTING, and this binary still submits nothing." Its whole dispatch is five verbs — market, capability, fractional-retirement-next, general, ticket (tools/dclutch-cli/src/main.rs:127-131) — over show/decode/plan/ author/verify/post. C-12 asks for "creation, discovery, maker/taker trade, liquidity, Series, resolution, portfolio, redemption and recovery" across "Static web, Wallet Standard, SDK and CLI".
• U apps/dclutch-web/lib/generated/capabilitySurfaceV1.ts:9-10 reports its own limit: "245 surveyed modules, 27 routes … 12 of those modules cannot start without a file produced outside this browser." Twelve acts a stranger cannot begin.
• U The 19-selector client-unreachable figure and its two plainest cases (DCLTDFS1, DCLTPCA1) are re-measured in §6.
• S / U Two shipped fixtures the browser and SDK both carry are stale against the chain. apps/dclutch-web/fixtures/public-cut.devnet.json (byte-identical copy at packages/dclutch-sdk/fixtures/) pins "market": "DUVcCGfjXzp1…" — market B, which is Terminal on chain — and its "activity" block is {found:null, trade:null, resolve:null, redeem:null} while all four of those acts have finalized signatures. apps/dclutch-web/fixtures/market-registry.devnet.json has 12 entries of which 7 point at markets whose Core program is closed (six under HezRkcMc…, and EQnYCUMk… under cohort-12's G4Wz4fj4…, whose ProgramData accounts I read as AccountNotFound). EQnYCUMk… is Open with no terminal receipt and is now unresolvable forever. Only those seven stale entries carry editorial titles; the five live markets have title: null. By contrast packages/dclutch-sdk/lib/deployments.ts:108-158 is current and internally consistent, and apps/dclutch-web/lib/deployments.ts:2 re-exports it rather than keeping a second table — the pins are fine, the fixtures are not.
• G "recovery of an interrupted wallet operation" — tools/devnet-activity resume "remains poll-only and never invokes a child" (docs/evidence/C16_ENTRY_LIST_2026_09_01.md §4), so an interrupted devnet lifecycle can be observed and not resumed.

C-13 — Operator and cold-machine operation

class: devnet act, with a hole under it. Strongest artifact: tools/cohort14/steps.tsv + check-steps.py — a nineteen-row runbook with a verifier per row, replayed end to end by cohort-14, and tools/cohort15/ as a four-row delta.

• G The gauntlet's own top-level runner refuses its full mode. tools/gauntlet/run.sh:94. C-13 says "Runbooks contain only commands actually replayed by their campaigns"; run.sh --mode full is documented, accepted, and dies.
• G 25 routes' only evidence comes from that parked producer (§0b).
• G tools/cohort15/README.md:63-68 records a runbook step whose omission is invisible until money has moved: RECORDED_PRODUCT_GRAPH_CORE_ELF_SHA256_V1 is empty, and a founding against a Core whose digest is in neither list refuses fail-closed at the first founding, after the deploy is paid for. Cohort-14 hit exactly this (075098e5f).
• G Three host-tool defects were found by cohort-13 while running: activate.sh never passed --execute and "a preflight printed 'planned' and exited zero"; settle-fee.sh had never parsed; build-sim-config.py named the wrong plan (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3364-3370). This is the "distrust silent success" class in the operator layer and there is no gate for it.
• U Recovery of an interrupted operator lifecycle: see C-12.

C-14 — Reproducible release readiness

class: devnet act. The strongest row in the matrix. Strongest artifact: COHORT14_SEALED_FOUNDED_FILLED_2026_09_03.md §1–§3 — CANDIDATE_EXIT=0, sbf_build_diagnostics_total=0, seven ELFs reproduced byte-identically from a second detached worktree, every live image dumped back and compared, a projected 42.2453 SOL cost matching the measurement to five decimal places, and the Market account's own byte 208 carrying the release-set digest.

• G / S A published record pins an artifact this tree can no longer build. Same doc, §5: the General accelerator was deployed from 324528a4; a build at cohort-14's own revision produces 4bdbfc88… rather than the deployed 61b2d73d…, because fd6cd0603 edited programs/dclutch-general-accelerator-sbf/src/lib.rs after the deploy. The doc states this as debt: "the tree can no longer rebuild the artifact those certificates pin without checking out 324528a4."
• A The accelerator's semantic release id is operator-stated, not checked: checked_semantic_release_preimage_v1 refuses any role outside the seven, so the id is derived under a label no role uses. The doc says it plainly — "it is still not a check" — and names the fix (SourceSemanticRoleV1::GeneralAccelerator). An unexplained authority in a released identity.
• G sbomVerify has two unresolvable workspaces (general-hot; dclutch-cli's lock apart from its manifest) per docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3873-3875; partially addressed by the two most recent commits on the branch.
• G Mainnet remains unruled (docs/MASTER_COMPLETION_CONTRACT.md:184).

C-15 — Privacy/FHE/MPC horizon disposition

class: closed by ruling, and three authority documents do not know it.

• RULED OUT by Ember, dated 2026-09-01, commit 5a371810 ("ruling: C-15 is not this Clutch, and O-019 is what keeps the door open"), quoted verbatim at docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:2067-2095. By the contract's own two terminal states this row is closed.
• S docs/MASTER_COMPLETION_CONTRACT.md:185 still reads "Privacy horizon | … | open; do not infer from the old horizon park".
• S docs/ledger/LETTER_TO_CLAUDE_2026_09_01.md:850-851 still reads "C-15 requires one explicit Ember ruling: whether the accepted final public project includes the original FHE/MPC/specialized batch/energy ambition."
• S docs/evidence/C16_ENTRY_LIST_2026_09_01.md §7 still lists R-8 as an open Ember ruling blocking C-15.
• Correctly open, deliberately: docs/OMISSION_INDEX.md O-019 stays a hard invariant, because the ruling makes it load-bearing rather than moot. Its closure condition already anticipates this exact case.

C-16 — Assurance-entry audit

class: this file. Not met. Six categories, all non-empty; counts in §8.

---

2. The never-executed route list as of today — 16, each dispositioned

Read against docs/reference/routes.md (last written d72c97a7d, unchanged through the whole review window) and tools/gauntlet/blocked.json (last written 4879a54f7). campaign away = a driver could reach it with work and no protocol change; blocked with owner = something structural stops it and the reason is named; dead — delete = nothing in the accepted project wants it.

Zero are dead, and eleven of the sixteen already have a campaign that exists and passes. For those eleven what is missing is census evidence-emission and a bindings.json row — bookkeeping, not protocol work. That reverses the 2026-09-01 framing, which called the residue "protocol work rather than instrument work" (docs/evidence/UNWITNESSED_ROUTES_BY_ROW_2026_09_01.md:8-12).

Row 14 is the whole of §0(a) in one line: a route that has executed on a public chain three cohorts running reads as never-executed, because the register has no channel through which a devnet transaction can reach it.

2.1 The drop from 57 to 16 is real drive, not laundering

I expected laundering and measured the opposite. Full status transition matrix between the 2026-09-01 register (3466740e9) and today's (d72c97a7d):

41 routes left NEVER-EXECUTED; 36 of them — 88% — moved by being driven, in fourteen binding commits over two days. blocked.json itself went 49 → 43 entries (5 added, 11 deleted), so the file's delete-on-execution rule is being exercised. One of the fourteen commits (3ddee4c2c, "the journey submitted a welded-shut instruction and bound it as executed") is a self-caught false binding being retracted, which is the behaviour the register exists to produce. The three that moved into blocked are each defensible: two are structural and argued (core/infrastructure_v2::process_initialize_v2; core/resolution::authenticate_recovery_policy#…, owner ember), and the third (trading/outer::process_capability_lifecycle#else) is a repointing of a pre-existing block whose census name changed.

The baseline itself was misreported: UNWITNESSED_ROUTES_BY_ROW_2026_09_01.md:12 says 55 and lists 55 rows, while routes.md at that same commit said 57. The doc was written against a register that was not regenerated.

2.2 What is being laundered, on a different axis

Nine routes were born directly into blocked and never appeared in the never-executed count at all — five claims/process_core_effect* child rows absorbed by a trailing-glob rule at 4879a54f7, two dealer-accelerator/set_return_data#*, one series-shadow/entrypoint::…#accepted, and resolution/core_effect::process_close#Retired. The census learned to walk let-bound guards on 2026-09-02, and every row it discovered landed pre-excused. That is the mechanism by which blocked route-rows grew 35 → 45 while the JSON shrank 49 → 43. It does not touch the 36-versus-3 number, and it means the denominator is doing work the numerator does not show.

2.3 blocked.json audited against its own rule

Rule: "keep an entry only while it is true, and delete it the moment its route executes."

The six whose routes now execute: resolution/process_verify#VerifyFundReady, resolution/provider_instruction_v3::process_provider_resolution_v3, resolution/process_submit#magic and core/execute_provider_v3::process#ExecuteProvider (all executed (journey)), core/begin_retiring::process#BeginRetiring (journey + a claims programtest), and trading/hot_v3::process_hot_execution_v3 (five campaigns, against a reason that opens "No gauntlet campaign drives this route yet").

They are invisible in the register, and that is a defect in the generator rather than in the file: tools/genref/generate.mjs:231 returns witnessed before it consults blockedRuleFor at :233, so a route that is both bound and blocked renders as witnessed and its stale entry never surfaces. They are findable only by joining the two files directly.

Also worth naming: trading/direct_close_maker_v1's reason says it "has the same gauntlet gap as begin-retiring above it". The entry above it is the Core begin_retiring — one of the six now falsified — while the Direct begin-retiring the sentence actually describes has no entry at all and sits at row 9 of the sixteen.

2.4 Only eight of forty-three blocks are structural

The JSON's preamble anticipates and defends this: "'No tier drives it yet' is a real and admissible reason; it is deliberately NOT phrased as 'blocked' when nothing structural prevents it, so that a missing test never launders itself into an external blocker." routes.md erases exactly that distinction at render time, printing "blocked by rule …" for all of them under a legend that reads "blocked — the route cannot be driven yet." Two entries say so in their own text (rent/process_close_v2#Close: "it is not a structural blocker either"; registry/hot_continuation_v2::process: "remains honestly NEVER-EXECUTED"). The honest count for C-16's never-executed intended route category is therefore 16 + 28 + 6 = 50 of 162, of which 34 carry an owner and a sentence.

2.5 The corroboration layer does not exist in this tree

docs/reference/routes.md:18-20 tells every reader: "Corroboration … is a separate pipeline, dclutch-route-census observe, and its output is CENSUS.md. Where the two disagree, CENSUS.md is the evidence and this page is the claim." So does docs/evidence/C16_ENTRY_LIST_2026_09_01.md:37.

git ls-files | grep CENSUS.md → 0. git log --all --name-only -- '**/CENSUS.md' → 0 lines. No untracked copy exists either. It is a run artifact under $WORK/out (tools/gauntlet/run.sh:139, README.md:41-48), as is ledger.json, the "append-only chain-corroborated execution observations".

The consequence is exact and it is the positive-control problem in its purest form: "CENSUS.md corroborates everything" and "CENSUS.md was never generated" are indistinguishable from inside the repository. The corroborated count is not stale by N days; it is unmeasurable.

What can be measured in-tree, as a weak proxy:

That last row is the sharpest available statement about corroboration: exactly one campaign of twenty-three writes a machine-derived provenance string into its binding notes; the other twenty-two write authored prose. tools/gauntlet/DESIGN.md:60 admits solana-program-test "only as a labeled fast lane" and tools/gauntlet/README.md:88-95 draws the evidence boundary at local-validator — yet 53% of the witnessed register never reaches even that boundary, and nothing in the register's rendering says which rows those are.

---

3. Every authority the tree cannot explain

C-16's unexplained authority is the under-constraint question: which signer, PDA or cached role authorises an act, and whether any authority is asserted rather than derived from an authenticated record. It is the opposite question from seam-audit's PRIVILEGE class, which finds routes that refuse what they should admit.

3.1 The one open hazard from 2026-09-01 is closed, and the entry list is stale

docs/evidence/C16_ENTRY_LIST_2026_09_01.md §5 filed trading-sbf/hot_v3.rs selected_role_programs_v3 as hazard-cache-provenance-unverified, open, owner Trading. It was closed at d211cd728, 2026-09-01 11:39 — hours after the row was filed. programs/dclutch-trading-sbf/src/hot_v3.rs:12673 now calls require_activation_cache_account_v3 before the read, and that function (:1904-1953) checks owner == registry, the three privilege bits, the exact width, and then reproduces the address from [ACTIVATION_PDA_DOMAIN_V1, release_set, bump] via create_program_address with a find_program_address fallback, refusing on key mismatch at :1948-1950. The branch carries a comment naming the defect it fixed: "AUTHENTICATE, THEN READ — here, not upstream." tools/seam-audit/EXCEPTIONS.md:1006-1035 already records the closure. The tree's own register is current on this one and the C-16 gate document is not.

3.2 The instrument's baseline is stale and its gate is RED

tools/seam-audit/seam_audit.py is Python and runs read-only in seconds. Run for this review:

• AUTHORITY reports 3 findings, all untriaged, and the full gate exits 1 with drift 3 NEW, 2 GONE against tools/seam-audit/baseline.json (measured_commit e6b7bf1af).
• The two baseline entries — authenticate_realm, authenticate_premarket_realm, both tagged benign-cache-authenticated-by-admission-token — no longer fire at all, because 9b5de611e (2026-09-02, "the activation cache was decoded three times per invocation") moved the decode into thin _from_cache wrappers and nobody re-ran --write. Every AUTHORITY entry in EXCEPTIONS.md:978 describes functions that no longer trigger.

3.3 One of today's three findings is instrument noise

programs/dclutch-custody-sbf/src/lib.rs:787 authenticate_market is flagged and decodes nothing. Inside its brace-matched span (787-834) the matched type name appears twice: at :790 as a parameter type and at :798 inside a // comment. The decode the rule meant to catch is at :962, in a different function (authenticate_registry_continuation, 930-1018) which derives and owner-checks and is correctly cleared. Root cause: _AUTHORITY_CACHE_READ (tools/seam-audit/seam_rules.py:1223) is a regex over raw function text and seam_rules.py strips no comments. It over-reports rather than under-reports, but the class's own count cannot be read at face value.

3.4 The two real findings are benign by sibling ordering, not by their bodies

custody-sbf/src/lib.rs:1055 authenticate_calling_release_from_cache and :1078 authenticate_realm_from_cache each borrow and decode the activation cache with no owner check and no derivation of their own. At all seven call sites, authenticate_market_from_cache runs first on the same frame vector — programs/dclutch-custody-sbf/src/dealer_reservation_v1.rs:352/353/355, :1217/1218/1219, and :656, :871, :1373 — and that function (lib.rs:1031-1051) delegates to authenticate_activation_cache_identity_v1 (crates/dclutch-registry-activation-auth-v1/src/lib.rs:304-343), which owner-checks, width-checks, compares the release-set id, reproduces the address under ACTIVATION_PDA_DOMAIN_V1 and refuses on key mismatch at :340.

Not exploitable at HEAD. But the provenance is established by a sibling call, not by the reader — deleting or reordering one line silently makes both readers underived, and nothing in either body would notice. That is exactly the instrument's declared blind spot: its one level of call resolution resolves callees, not siblings. The one that actually spends the cache as authority is authenticate_calling_release (lib.rs:894-927), which at :916-922 requires release.program() == caller_program.key and release.programdata() == caller_programdata.key — "is my caller the blessed program for its role", read out of an account its own body never authenticates.

The same shape appears once more, cross-instruction: custody-sbf/src/lib.rs:2216-2221 read_replay is a bare borrow-and-decode of CustodyReplayV1, an account written by an earlier instruction, with no owner check and no derivation; its provenance comes from authenticate_replay_identity (lib.rs:1309-1347) called one line earlier at the call sites.

3.5 The out-of-scope ground: 121 unadjudicated candidates, 0 confirmed defects

Sweeping the ground the instrument declares out of scope, over programs/*/src/**/*.rs with comments and string literals stripped (the defect §3.3 found), 3,601 brace-matched functions, plus one hop of delegation:

All seven adjudicated signer candidates are privilege-shape checks, not authority reads — registry-sbf/src/record_v1.rs:960-973 require_privilege, :999-1009 require_system_wallet, claims-sbf/src/lib.rs:1024-1035 (which refuses a signer), claims-sbf/src/fractional_claim_check_v1.rs:1023-1038, general-accelerator-sbf/src/lib.rs:751-796. Positive controls that the query does clear: core-sbf/src/generic_founding_v1.rs:831 authenticate_generic_caller, trading-sbf/src/series/accounts.rs:153,190, custody-sbf/src/lib.rs:1885, and custody-sbf/src/lib.rs:930-1018 for the PDA channel.

A methodological catch, recorded because it nearly produced four false accusations: the first regex missed the deref spelling != *caller.key and reported all four positive controls as unbound. Fixing it cut the signer residue 65 → 41 → 28. An unfixed version of that query would have convicted four correct authenticators.

121 candidates remain unadjudicated and this is the honest state of the category. The dominant explanation is the sibling-ordering structure proved in §3.4, but that was verified on three sites, not on 121. The densest clusters each wanting an owner: resolution-proof-sbf/src/relay_transport_v1.rs (7 functions at :540, :674, :751, :812, :895, :1310, :1996), resolution-proof-sbf/src/core_effect.rs (8), and trading-sbf/src/execution_strategy_v2.rs:656-858 (five consecutive authenticate_* functions lacking both an owner check and a derivation). Nobody has done cross-instruction dataflow at all: whether the writer of a persisted account in a prior transaction was authenticated is not a single-function question, and neither the instrument nor this sweep answers it.

3.6 Authorities that are stated rather than checked

Three, each named by the tree itself:

• The accelerator's semantic release id is operator-stated. COHORT14_SEALED_FOUNDED_FILLED_2026_09_03.md §5: checked_semantic_release_preimage_v1 refuses any role outside the seven, so 932bc2ca… is derived under a label no role uses. The doc says "it is still not a check". It is pinned inside a released identity on a public chain, and the fix it names — SourceSemanticRoleV1::GeneralAccelerator — is cited four times in live prose and does not exist (§4.6).
• A ruling made this session broadens what a callee may assume. docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3628-3630: "a callee invoked by a PDA-signed CPI from Trading takes the facts the signer's seeds pin as established — the release set, the role activation, the sealed records — verifying only the signer's derivation." It is dated, reversible and recorded, and it is a deliberate reduction in independent authentication worth a reviewer's attention rather than a defect.
• The registry record-abort recipient check is circular. programs/dclutch-registry-sbf/src/record_v1.rs:664 pays accounts[3], and the check at :611 compares against staging.cleanup_recipient() — derived from the observation the frame built from that same account at :592. See §5.2 row 9.

3.7 The producer-missing pattern

A schema field, account or record whose only writers are literals or fixtures: the reader, the schema and the refusal were all built and the producer never was, so only the failure path is exercised.

The tree has a detector, it is Rust, it is build-gated, and it may be disconnected in the one crate CI compiles it in. reader_booleans_without_a_computing_producer_v1 (tools/local-validator/bootstrap/successor/src/campaign.rs:6773, register at :6752, gate at :6884, red control at :6908) resolves its inputs through env!("CARGO_MANIFEST_DIR") at :6872 and :6886. campaign.rs is #[path]-linked into tools/gauntlet/journey/src/main.rs:42, where that macro expands to tools/gauntlet/journey — whose src/ contains no campaign.rs, so .expect("campaign schema source") cannot resolve there. The same hazard applies to historical_boundary_reads (market.rs:17237, linked at journey/src/main.rs:54). tools/ci/run.sh:1078-1084 says the successor host tests "are simply not wired yet". The one detector this category has is an absent signal with no positive control — read statically; settling it needs a build.

The roster the tree numbers for itself: six instances, one open. 1st AlreadyCurrent (fixed 28ff0823), 2nd PERMANENT_DEVNET_UPGRADE_TARGETS_V1 (8e1f9850), 3rd recovered_finalized_founding (00793136), 4th the Series ticket state — OPEN, 5th the Claims-role Custody replay producer (31d09aed2), plus the browser redemption path (measured, not repaired). Three further doc-named gaps are each closed by the module that names them (crates/dclutch-operator/src/capability_seal_v1.rs:1-19, crates/dclutch-general-adapter-contract/src/collection_v1.rs:1431-1439, bootstrap/successor/src/sponsored_push.rs:2198-2212).

The open one, verified at HEAD, with the fixture standing in for the producer:

This is what makes core/series_permit_expiry_precommit_v1::process undrivable (§2 row 6) and it is C-07's central defect.

Four further candidates the tree has not named, found by censusing every 8-byte magic's copy_from_slice against its type's non-decode constructors, classifying test versus non-test by path and by brace-matched #[cfg(test)] mod span (77 magic→impl pairs, 1,146 types):

The fourth is also route #16-adjacent: claims/rational_representation_v2::process_replay_close was on the C-08 never-executed list on 2026-09-01. A route with no producer for its own request is not a coverage gap.

Blind spot of that census, stated because it matters: it counts an off-chain operator constructor as a producer, so it misses the Series ticket state itself (crates/dclutch-operator/src/series_lifecycle_v3.rs:569 constructs a TicketStateV3). The sharper question — whether an on-chain route writes the bytes — is not what the query asks, so expect both false positives and false negatives of exactly the Series kind.

---

4. Stale claims in the top-level and user-facing documents

47 confirmed stale, 11 verified now-fixed, 14 could not be settled by reading. Every row below was checked against the code or artifact it describes; nothing is relayed from the 2026-09-01 list without re-verification. The category is much worse than that list's "6 unfixed of 8", and the reason is structural rather than sloppy: the tree moved faster than its prose for three days, and the documents that moved least are the ones a stranger reads first.

4.1 The landing page contradicts itself by 170 lines

README.md is the worst single artifact in this category.

A stranger who reads the top of that page and stops is told the protocol has never resolved or traded on a chain. A stranger who reads to line 203 is told it has done both. Both passages are in the file a reviewer is handed first.

4.2 Eleven guide passages say "not live yet" about markets that are live

Ground truth: apps/dclutch-web/fixtures/og-card-facts.devnet.json:5-25 — three "Open", one "Terminal".

• docs/guides/operator.md:10 "the first open market is not live yet"
• docs/guides/operator.md:56-59 "it has not opened a market on devnet yet … must be remeasured before it is installed" (it was measured: docs/operators/found-a-market.md:225, founding-dcltgmf3 1,069,561)
• docs/guides/trencher.md:18-19 "nothing has traded on that market yet"
• docs/guides/trencher.md:123-125 "A winning-position payout has not completed end to end from a user's wallet on devnet yet."
• docs/guides/trencher.md:130-131 "When the first market opens …"
• docs/guides/client-developers.md:174-175 "Payout is not open. There is no devnet Market that can use this route"
• docs/guides/client-developers.md:236 "does not mean a devnet payout is currently available"
• docs/guides/reader.md:36-38 trading/transfer/payout "run in test harnesses … software evidence, not devnet executions"
• docs/guides/reader.md:44-46 "Still to come: the first public trade … then its resolution and wallet payout"
• five sites saying "one market … is open for trading" (docs/guides/README.md:25-26, reader.md:23, trencher.md:15-16, trencher.md:121-122, docs/operators/README.md:62)
• docs/guides/reader.md:22 and docs/guides/operator.md:9: "Seven protocol programs are deployed at permanent addresses". deployments.ts:99-100 says "These ids are not permanent and nothing here should say they are", and apps/dclutch-web/components/BountyWalk.test.tsx:25-31 asserts the phrase is absent from the web copy — the browser was fixed on 2026-09-02 and the two guides were not.

4.3 A documented operator command that cannot run

docs/guides/devnet-release-capture.md:11-22 teaches devnet-permanent-substrate-capture-v1 and states "You do not supply program addresses. The command owns the fixed decision-0012 table of seven permanent Program/ProgramData pairs." tools/local-validator/bootstrap/successor/src/release_capture.rs:86-88: "Decision 0012, amended 2026-09-02: the seven roles are a caller-declared AUTHENTICATED input, not a fixed table." :498-503 requires all seven --expected-<role>-program flags and :552-556 errors "{flag} is required". The command as documented dies on --expected-registry-program is required. Its sibling docs/guides/devnet-permanent-id-upgrade.md:47-50 documents the amendment and still links to the stale guide at :41-42.

Adjacent, and the same shape: README.md:167-173 and docs/guides/reader.md:68-74 teach a run.py one-liner. The five required=True flags the 2026-09-01 list named have been added — and the invocation still aborts, because --seeds defaults to 20 (tools/release/private-validator-lifecycle/run.py:7199) and :7213-7215 raises "the founding/participant development probe requires exactly one named seed". The correct nine-flag form exists only at docs/operators/found-a-market.md:117-126.

4.4 The contract's own decision register

Five of the seven decision-register rows carry a stale citation. That register is the tree's mechanism for asking Ember a question, and a question whose premise has moved is worse than no question.

4.5 docs/OMISSION_INDEX.md — the four "stale-open" rows are worse than reported

The 2026-09-01 list named U-013, U-003, U-006 and U-014. All four re-checked, plus four more:

• U-013 (:95) contradicts itself inside one cell: status "the physical Market/Claims layout slice is unfinished" beside its own amendment "the layout half of this row is SATISFIED". Its "The wire language is unchanged — BasisKindV3::decode refuses tag 3" is false (spline_admission_v3.rs:98, runtime_v3.rs:258-278). Its citation correction says STATE_BYTES = 360 "with zero reserved bytes and no require_zero" — crates/dclutch-market-core-codec/src/generated.rs:3 is 368, :58 has a reserved offset at 367 and :599 a require_zero.
• U-003 (:85) says a General Hot bundle in programs/dclutch-trading-sbf/program-test "does not exist". It does: …/general-hot/tests/open_batch.rs, 1,270 lines, Hot frame at :13-19, capability seal at :20. Its second clause ("refuses at 0x5182") is also dead.
• U-006 (:88) says dclutch-product-compiler::compile is "itself with zero callers" — live callers at crates/dclutch-product-runtime-v2-operator/src/authoring.rs:30,310,326, graded_basis_v3.rs:8 and crates/dclutch-partition-quality-wasm/src/lib.rs:27. Its RecoveryPolicyV1 line number and three Source-record citations have all drifted. The row's headline ("unfinished convergence") still holds.
• O-013 (:53) — §1 C-03.
• P-006 (:72) says "CloseSeal has zero occurrences in any .rs or .lean" — there are 39 across eight files, eighteen of them in programs/dclutch-trading-sbf/src/hot_v3/seal.rs.
• P-007 (:73) "932 hand-authored lines" → 1,201; "14 such guards" → 20.
• P-008 (:74) quotes a live comment that has zero occurrences tree-wide outside that line, and calls its route row NEVER-EXECUTED when docs/reference/routes.md:134 reads blocked by rule.

Eight of fifteen U-/O-/P- rows a reviewer would be handed carry a claim the code refutes. That index is C-00's own scope instrument.

4.6 The instrument for this category is red, and gates nothing

tools/doc-citations/ exists precisely for the "citation outlives the thing cited" class, and it runs read-only in about ten seconds. Run at 9e3c4eeff for this review:

doc citations: 1156 files
  /// and //!   15239 spans   judged 1322 (1298 resolve, 24 do not)
  ordinary //    3856 spans   judged  192 ( 186 resolve,  6 do not)
30 citations name a symbol declared nowhere in this tree

--check --baseline tools/doc-citations/baseline.json exits 1 with "26 NEW dangling citation(s) since the baseline", and every line number in that 14-entry baseline has drifted. Two of the thirty are load-bearing:

• funded::process_funded_transition, six live citations — programs/dclutch-core-sbf/src/{lib.rs:144, resolution.rs:888, resolution.rs:905, tests.rs:305}, programs/dclutch-resolution-proof-sbf/src/funded.rs:27 and tools/local-validator/bootstrap/successor/src/market.rs:13648. One of them is a lifting plan whose first step is to resurrect a symbol nobody can locate. (Every line number the 2026-09-01 list gave for these has drifted by 5 to 800 lines, which is itself the category.)
• SourceSemanticRoleV1::GeneralAccelerator, four citations at bootstrap/successor/src/plan.rs:191,1751,2641,2822 — the enum variant the cohort-14 evidence names as the fix for its operator-stated release id (§1 C-14). The prose cites the remedy as if it were built.

rg 'doc-citations|doc_citations' tools/ci/run.sh tools/gauntlet/run.sh .github returns nothing. The instrument is wired into no tier. A red tripwire nobody is watching is the same as no tripwire, and this is the category where that costs the most.

4.7 Component and gate documents

• docs/ledger/WAVE_2026-08-26_to_2026-09-02.md:3 "Updated: 2026-08-26 (cycle 1 launch)" — the file's own log runs to :7095 "## 2026-09-02". :13-15 "Devnet deploy-and-recycle is deferred … explicit named authorization required before any deploy" against docs/ledger/WAVE_2026-08-26_to_2026-09-02.md:1954 and docs/MASTER_COMPLETION_CONTRACT.md:153. :29 "Cycle 1 — Stabilize + Unblock (ACTIVE)"; :50-53 "the local bootstrap campaign … has never completed through Open". ARCHITECTURE.md:9 sends readers to WAVE.md "for current architecture."
• ARCHITECTURE.md:4,6 — the 2026-08-27 supersession banner, explicitly the only edit made to un-stale the file, names DCLTCOR2 while packages/dclutch-sdk/lib/generated/coreFound.ts:54 is DCLTCOR3 and :4 is CORE_VERSION = 3. Still true, one day after the 2026-09-01 list said so.
• tools/ci/README.md:29,32-33 — cheap/all tier lists both wrong (tools/ci/run.sh:2352-2355), SUITE_RUNNERS has 15 rows not 4 (run.sh:1394-1409), and six dispatched tiers have no row at all (tier_fmt, tier_runbooks, tier_frameguard, tier_locks, tier_sbfcontracts, tier_sbom). run.sh:2344-2347 names this exact defect in its own comment.
• tools/gauntlet/tier2/README.md — its whole ## Layout block (:58-65) describes five files; ls tools/gauntlet/tier2/ returns README.md only. Plus a nonexistent module path (:76,83), a --mode fast the runner refuses (:79 vs run.sh:84), a CAMPAIGNS list in a campaign.sh that does not exist (:87), and an env var referenced by one campaign of the three it names (:71,75).
• tools/gauntlet/tier4/README.md:57 names programs/dclutch-series-sbf — no such directory.
• programs/dclutch-claims-sbf/README.md:51-55 names programs/dclutch-trading-sbf/src/dealer/physical.rs inside a deletion-readiness claim; the file is absent, and the claim is wrong in the other direction too — one producer of ClaimsPlanV1 remains (crates/dclutch-general-adapter-contract/src/child_packets.rs), not three.
• programs/dclutch-core-sbf/README.md:118,122-129,270 — "Accounts 0 through 30 are the exact Found31 frame" while FOUND_ACCOUNT_COUNT_V3 = 37 (coreFound.ts:11), the whole Series suffix table off by six against series_consume.rs:191-196, and a "258-outcome Found31" test whose real name is real_found37_…. The same README says "exactly 37" at :46.
• packages/dclutch-sdk/README.md:38,40 documents LIVE_DEVNET_OPERATOR_PRESET_V1 (no such symbol; the real API is the function liveDevnetOperatorPresetV1() at lib/operatorSurface.ts:224) and a two-arg acquireOperatorSurfaceV1 call that does not typecheck against :370-373.
• tools/dclutch-cli/README.md:13 pins installer v0.1.0-devnet.2 against Cargo.toml:3 0.1.0-devnet.3 — load-bearing, because ticket author is taught at :36 and shipped in devnet.3.
• docs/guides/client-developers.md:61-62 "current 360-byte DCLTCOR3 … exact historical 352-byte DCLTCOR2" — coreFound.ts:6 is 368, and packages/dclutch-sdk/lib/marketDiscovery.ts:95 now carries two historical generations, [(2,352),(3,360)], so the 360-byte DCLTCOR3 this guide calls current is itself historical.
• docs/reference/refusals.md:9 and docs/reference/README.md:17-18 promise "Every error code the protocol can return, with its meaning" — ClaimsSbfError::CustodyRequired = 0x5006 (programs/dclutch-claims-sbf/src/lib.rs:223) has zero raise sites and crates/dclutch-operator/src/claims_conservation_v1.rs:7 says "the route that would dispatch DCLCNS01 still does not exist."
• docs/INTENT.md:419-420 quotes a live web string that does not exist tree-wide (the live copy is apps/dclutch-web/components/trade/TicketBoard.tsx:245), and :216-217 says the Hoard-principal clause is "Live as README.md:10 and docs/guides/trader.md:32" — neither address mentions fees, bounties, rent or operating costs, which is the half INTENT itself calls hardest to notice.
• apps/dclutch-web ships no README at any level. For the C-12 row, the app that carries the only live trade-submission path has no document a stranger can open.

4.8 The eleven that are now fixed

Recorded because a reviewer should be able to see which ground has been swept: the svm-harness CU table now carries "THAT CAMPAIGN HAS NO INSTRUCTION BUILDERS, AND THE TABLE ABOVE IS HISTORICAL" (README.md:93-110) with the #[ignore] and both panic! stubs enumerated — the sharpest 2026-09-01 finding, closed; docs/reference/ has been regenerated (12 programs, 162 routes, 341 codes at docs/reference/README.md:26-28), so the entry list's "docs/reference/ is stale at HEAD and is being held deliberately" is now itself the stale note; tools/release/README.md:612-622's two claims; the founding wizard's placeholder service identities and /local's ignored cluster <select> (both greps return nothing at HEAD); README.md:60-62 on the TypeScript CLI's refusing buy/sell; docs/OMISSION_INDEX.md:71 (P-005); and the flag/verb/env-var tables in two-clients.md, trader.md, trencher.md, docs/operators/found-a-market.md and author-a-ticket.md, each re-verified against both CLIs. AGENTS.md, SECURITY.md, COMPOST.md and PROJECT_METHOD.md are clean.

4.9 The gate document is the stalest document

docs/evidence/C16_ENTRY_LIST_2026_09_01.md — the file docs/MASTER_COMPLETION_CONTRACT.md:80-81 names as "the entry list for C-00/C-16" — has four wrong denominators at its head: :52-55 "routes 161 / witnessed 73 / blocked 33 / never executed 55" against 162/101/45/16, and :219 "1 of 297" refusal codes against 341. Its §0 warns that docs/reference/ is stale; docs/reference/ was regenerated and the warning was not. A reviewer handed the gate document starts from four wrong numbers and one inverted caveat. This file supersedes it.

---

5. Economic flows without an owner

The 2026-09-01 measurement swept the atom half (81 ordered compartment pairs through CustodyRequestV1::validate, 103 compartment-setting sites, all owned) and left the lamport half open. This is that half, plus the state of the one finding the atom half carried forward.

5.1 HoardPrincipal → FeeVault: narrowed to one route, open at both boundaries

Still shape-admissible where it was:

• crates/dclutch-custody-contract/src/lib.rs:716 CustodyRequestV1::validate — the Transfer arm (:775-807) refuses only a None side, the External conjuncts about vault context and owner, and an aliased source == destination. No pair rule. The in-tree census asserting exactly this is lib.rs:1994 the_transfer_wire_permits_every_pair_but_none_and_owns_no_compartment_rule, which names principal-to-fee explicitly at :2009-2013.
• programs/dclutch-custody-sbf/src/lib.rs:367 decodes the request from caller-supplied bytes; its only compartment logic is External/non-External (:1551, 1570, 1573, 2018, 2035). No pair rule.

What is new since 2026-09-01 — one on-chain refusal, on one route. programs/dclutch-trading-sbf/src/dealer/v3_trade_artifacts.rs:1489-1527 classify_scenario_custody is a closed six-arm match with _ => None, enforced at :1144-1145 inside validate_scenario_custody_bank_v4 (:1123, no cfg gate, reached from project_dealer_scenario_hot_registers_v4 :1008 → v3_admitted.rs:182). Hoard→Fee is not among the six, so it is refused on-chain for the Dealer scenario-trade route and nowhere else.

Two other pair pins look live and are dead in the deployed SBF — the exact shape AGENTS.md warns about: v3_trade_artifacts.rs:809-810 validate_scenario_custody_shape is #[cfg(not(target_os = "solana"))]; dealer/v3_hot_artifact.rs:816 validate_template is uncfg'd but its only caller (:549-550) is #[cfg(not(target_os = "solana"))].

The 2026-09-01 statement of fact is stale. It said "both FeeVault-funding sites take TradingPrincipal". There are three on-chain FeeVault-funding sites and one takes External:

And the composer's ownership is by omission: TransferKindV3 (v3_composer.rs:634-641) has six variants and no HoardToFee. That is a constructor that cannot build the pair, not a rule that refuses it — a distinction that survives only as long as nobody adds a seventh variant.

5.2 The lamport half: 80 sites, 68 owned, 12 unowned

Mechanism-disjoint census at HEAD: 92 try_borrow_mut_lamports / lamports.borrow_mut calls collapsing to 48 logical sites (38 owned / 10 not); 19 &transfer( CPI sites (18/1 — twelve inbound all owned, seven outbound 6/1); 5 SPL close_account rent destinations (4/1); 8 create_account CPIs, all payer→derived-PDA, all owned.

Seven of the twelve (1, 2, 5, 9, 10, 11, 12) are doctrine-sanctioned permissionless payees per docs/design/FUNDED_CRANK_V1.md §6. Four or five are not: rows 3, 4, 6 and the 7/8 pair.

Row 3 is the sharpest finding in this section. A cranker that supplies its own pubkey at the opener slot collects plan.opener_repayment() while the escrow's book records the real opener's debt as discharged. The escrow stores the opener's identity and the payout path never reads it back. Row 6 is the same route's fractional twin, and the tree already says so in a comment at fractional_claim_check_v1.rs:1311-1313 — a known gap that has an owner in prose and none in code.

Two "owned" verdicts that are structurally fragile, recorded because a reviewer should not read them as settled: custody-sbf/src/lib.rs:1385 (InitializeReplay excess sweep) is checked against the request (:1364), not persisted state, since persistence begins there — its only authority is the caller PDA's signature over the request digest. And pre_market_funding_v1.rs:575 / projected_custody_bootstrap_v1.rs:2490 inherit their rent-credit binding from a preceding Core ProjectFound CPI (core-sbf/src/found.rs:828-848); normalize_vacant_pda_lamports_v1 (:2467) is a generic helper that becomes unowned at any new call site lacking that CPI.

5.3 The rent declaration is real and reaches 1 of 80 sites

Byte five landed and is exactly what docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3289-3293 describes: crates/dclutch-account-profile-contract/src/lifecycle_v3.rs:138-139 (REFUND_SOURCE_CREDIT = 0 / REFUND_SOURCE_PAYER = 1), decoded at :2195, enum at :498-511, with kernel rules for create-beneficiary selection (:3395-3397), funding-admission equality (:3405-3416), close (closing_refund_identity, :3507-3532) and Authenticate-arm canonicality (:2235). All four named commits are ancestors of HEAD.

And it has one on-chain reader, not two. The only one is programs/dclutch-trading-sbf/src/hot_v3.rs:10358-10366 closing_refund_identity_admitted_v3, consumed at :10409. The second reader 5fc108bd's own message names — direct::lifecycle, "Direct requires Credit at both plan readers" — lived in programs/dclutch-trading-sbf/src/direct/lifecycle.rs, deleted at 4d13fe2af the same day as part of the 6,572-line never-dispatched plan layer whose removal left the ELF byte-identical. So half the declaration was landed into code with zero on-chain effect and is now gone. validate_registered_record_close_lifecycle_v3, still cited in the live doc comment at lifecycle_v3.rs:3505, does not exist in the tree — a §4.6 citation the doc-citations baseline has not caught because it is a bare identifier rather than a namespaced path.

The gap, measured three ways. REFUND_SOURCE / RefundSource / refund_source / SOURCE_CREDIT is absent from all 26 other program files carrying a lamport flow — zero hits across the whole of programs/dclutch-claims-sbf/src/, all ten resolution/registry/core/custody files, and the other eight trading files. Every other owned site pins a full 32-byte pubkey against persisted state; no site outside hot_v3 reads a refund-source discriminant. The Payer arm is also weaker than it reads: LifecycleRefundSourceV3::Payer => plan.beneficiary != [0; 32] is an existence check, and lamports land in the authenticated RentCredit either way — it asserts provenance, not a destination.

5.4 Seven live permissionless-work routes, all funded from present capital

The tree does pay strangers, which contradicts programs/dclutch-registry-sbf/src/record_v1.rs:548-550's claim to be "the only route in the tree that pays a lamport bounty to its own caller".

All seven fund from capital that is present — rent already leaving an account, or a bounty prepaid at founding. None draws on Hoard principal or on future revenue. For C-11's own invariant that is the good news of this section.

Contract-only, never on chain: FundingLedgerEntryClosePlanV2::crank_reward (crates/dclutch-capability-contract/src/funding.rs:1919-1927, no program references it) and the WorkEscrowClosePlanV1 cranker leg (crates/dclutch-general-adapter-contract/src/escrow_v1.rs:662-755, only consumer is a harness test). Zero-valued and awaiting a ruling: DIRECT_CLOSE_MAKER_CLOSER_REWARD_V1 = 0 (crates/dclutch-direct-codec/src/close_maker_v1.rs:61).

---

6. Capabilities a stranger cannot reach from the site, SDK or CLI

The 2026-09-01 figures (19 client-unreachable, "honest C-12" of 20) were an instrument artifact and the real numbers are far worse. That measurement grepped the magic as an ASCII string. In TypeScript the magics are written as hex byte arrays and never as strings: packages/dclutch-sdk/lib/generated/directInlineV3.ts:270 — export const HOT_EXECUTION_MAGIC_V3 = Uint8Array.from([0x44,0x43,0x4c,0x54,0x48,0x4f,0x54,0x33]); — while the literal "DCLTHOT3" appears only in lib/generated/routeCensus.ts:473. So a string grep says the SDK cannot build a hot execution, which is plainly false; and almost every "reachable" it scored was a routeCensus.ts row. Its third rung — "excluding all lib/generated/*" — deletes exactly the codec modules a browser builds through. And a fourth mechanism leaves no magic in TS at all: DCLTPUA1 is reached from apps/dclutch-web/components/JoinPanel.tsx → lib/userPositionAdmissionV1.ts → lib/generated/userPositionAdmissionWasm/ ← crates/dclutch-user-position-admission-wasm, and every literal grep scores it unreachable.

Re-measured with ASCII and 0x..-list and decimal-list patterns, an import-graph walk (@/*→./* per apps/dclutch-web/tsconfig.json), and a hand check of all seven client WASM modules.

6.1 The denominator was also wrong

Reading each programs/*/src/lib.rs process_instruction and its inlined continuations, extracting every magic-comparison arm and every is_*(instruction_data) predicate and resolving each predicate to its constant:

78 top-level arms / 77 distinct 8-byte magics — claims 21, trading 24, core 10, resolution-proof 10, custody 6, registry 3, dealer-accelerator 3, rent 1. (DCLTRIX1 serves two constants: crates/dclutch-record-contract/src/lib.rs:67 and crates/dclutch-relay-contract/src/instruction.rs:20.) Plus ~17 non-magic top-level arms the magic census cannot see — Core's Action enum (crates/dclutch-market-core-codec/src/generated.rs:676, no magic), Custody's five OperationV1 operations, Registry's ActivateRole/Reauthenticate, Trading's outer::process_capability_lifecycle fallthrough, Claims' shape fallthrough at claims-sbf/src/lib.rs:675, Rent's fallthrough. One of those — Core Found — is browser-reachable, so a magic-only universe undercounts both numerator and denominator.

6.2 The counts

The prior audit missed a second pure listing — apps/dclutch-web/scripts/explorer-coverage.exempt.json mentions routes and builds none, exactly like routeCensus.ts.

The two definitions worth defending:

• LOOSE — any non-listing client mention across CLI + SDK + web, builder or reader: 20 of 78 reachable, 58 unreachable.
• STRICT — a client encoder or WASM codec actually constructs the bytes: 13 of 78, 65 unreachable, plus the non-magic Core Found.

The thirteen: DCFRRQ03 DCLTHOT3 DCLTGMF3 DCLTGFQ1 DCLTPCB2 DCLTPUA1 DCLTSQ03 DCRRPRQ2 DCRRLC02 DCLCCR01 DCLSDP03 DCLRNCI2 DCLCUSR1, via lib/founding/{genericMarketFounding,ladder}.ts, lib/walletTerminalPayoutV3.ts, lib/rationalTerminalHotV3.ts, lib/rationalRetireReceiptV4.ts, lib/claimsCustodyReplay.ts, lib/generated/coreFound.ts, lib/directInlineV3.ts, components/JoinPanel.tsx. Three of them (DCLSDP03, DCLCUSR1, DCLRNCI2) are built as a child or suffix payload inside another instruction rather than submitted standalone.

CLI: 2 of 78. tools/dclutch-cli/src/main.rs:127-131 dispatches five subcommands; market and capability decode only, ticket is off-chain (crates/dclutch-direct-ticket), and the binary states its own limit at tools/dclutch-cli/src/ticket.rs:22: "AUTHORING IS NOT SUBMITTING, and this binary still submits nothing." Only fractional-retirement-next → DCFRRQ03 and general plan → DCLTHOT3 reach a route at all. 76 of 78 arms are CLI-unreachable, against a C-12 row that asks for creation, discovery, maker/taker trade, liquidity, Series, resolution, portfolio, redemption and recovery across "Static web, Wallet Standard, SDK and CLI".

6.3 Delta since 2026-09-01

Newly reachable: none. Zero selectors gained a client builder. One became legible: DCLCRH01 (RETIREMENT_REPLAY_HANDOFF_REQUEST_MAGIC_V1) now appears in apps/dclutch-web/lib/marketActivity.ts and its SDK twin — a pure reader. Decoding an act is not performing one. Newly unreachable: none. 118 commits landed on the SDK and web app in that window, all census regeneration, readers, pulse/OG/market pages; the client's building surface did not grow. The CLI took 5 commits, all lockfiles and one rename.

6.4 The two plainest cases, unchanged

DCLTDFS1 / DIRECT_FEE_SETTLEMENT_REQUEST_MAGIC_V1 — declared crates/dclutch-direct-codec/src/fee_settlement_v1.rs:35, encoded :154, predicate :324, dispatched programs/dclutch-trading-sbf/src/lib.rs:883. The browser mentions it once, in a comment that says the opposite of reachability (apps/dclutch-web/lib/marketActivity.ts:41-44: "no generated table can turn a settlement instruction into a name, and this module does not invent one"), and otherwise only in the two listings. Zero in tools/dclutch-cli. No builder in either mirror. Its only exterior is tools/local-validator/bootstrap/successor/src/direct_fee_settlement.rs, whose own doc at :115 says it is "the only caller of the DCLTDFS1 route outside a program test". A permissionless third-party fee completion whose only caller is a Dragon-operated bootstrap is not permissionless — and completion item 7 forbids exactly a route that requires a Dragon-operated service.

DCLTPCA1 / PROJECTED_CUSTODY_ABORT_MAGIC_V1 — declared programs/dclutch-trading-sbf/src/projected_custody_bootstrap_v1.rs:201 ("Sole top-level projected-Custody founding-abort instruction", :200), dispatched programs/dclutch-trading-sbf/src/lib.rs:960. A name-token scan for projected_custody_abort / projectedCustodyAbort across all three client surfaces returns 0, 0, 0. Its only exteriors are bootstrap/successor/src/market.rs:7934 — which re-declares the magic locally, const PROJECTED_CUSTODY_ABORT_MAGIC_V1: [u8; 8] = *b"DCLTPCA1";, with the comment "restated here because a localhost host…" — plus source_abort_exterior.rs, journey/src/journey.rs, tier1/, and one svm-harness test. And §0(b) compounds it: this route's only register witness is tier1, which tools/gauntlet/run.sh:94 refuses to run. A fund-recovery path with no client, whose only evidence comes from a campaign the tree can no longer reproduce.

6.5 Twenty-six capabilities whose only exterior is our own harness

Completion item 7 requires that a caller "can acquire its inputs without inventing authority or requiring a Dragon-operated service". Of the 58 loose-unreachable arms, 26 have an operator-tool caller and no client:

• tools/local-validator/bootstrap/successor/ only — DCLTCFQ1 (controller funding prepare), DCLTCF1A, DCLTCF2A (cleanup steps), DCLTGFP1 (found-and-permit), DCLTGMO1 (generic market open), DCLTDBR1 (Direct begin-retiring), DCLTDMC1 (Direct close-maker), DCLTSEL1 (the capability seal write — the browser only reads the seal account, at apps/dclutch-web/lib/directHotChain.ts:858), DCLTIIN2 (the V1→V2 succession).
• local-validator + gauntlet — DCLTDFS1, DCLTPCA1, DCLRFCQ1.
• tools/gauntlet/ only — the claim-check family DCLTCCO1/DCLTCCC1/DCLTCCR1/DCLTFCC1/DCLTFCR1, DCLCUDQ2, DCLRGCI1, DCLRFAQ1, DCLTDRS1, DCLTDRV1/DCLTDCM1, DCLTPAB3, DCLTCRQ1, DCLTCEF1.

Five of those nine bootstrap-only routes are also members of §2's never-executed sixteen, which is not a coincidence: a capability with no client tends to have no campaign either, because the same missing builder blocks both.

The remaining ~31 arms have no caller under tools/ at all — only program-test campaigns or nothing: DCFREQ02 DCLMCQ01 DCLABP02 DCLSPT01 DCLSFTR1 DCLFDR05 DCLPPR02 DCRRCL01 DCLSUPE1 DCLTSFX1 DCLTCSR1 DCLTPFQ2 DCLPCQ01 DCLTCRS1 DCLTCRB1 DCLTCAC1 DCLTCSX1 DCLTDCP1 DCLTDPG1 DCLTDEV1 DCLTDRB1 DCLTDCL1 DCLTDTS1 DCLRPAQ1 DCLRPFQ2 DCLTPRQ3 DCLTPSB3 DCLTPRL3 DCLTSPI1 DCLMLP03 DCLDST03. Read that as an upper bound on absence, not a proof: the tools/ grep matches the magic's name or value, and an operator caller that goes through a codec function leaves neither. DCLTPUA1 proves the miss — it scores 0/0/0 under tools/ while bootstrap/successor/src/user_position_admission.rs exists.

6.6 What the browser itself says it cannot start

apps/dclutch-web/lib/generated/capabilitySurfaceV1.ts:9-10, generated from the browser's own import graph: "245 surveyed modules, 27 routes, 27 generated authorities, 3 published runbooks. 12 of those modules cannot start without a file produced outside this browser." Twelve acts a stranger cannot begin, said by the surface itself. Alongside it, docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3842 records the upstream gap: "the 27 capability acts declare only 9 of 162 routes."

---

7. The twenty items whose closure would most move the matrix

Ranked by how much of the matrix each unblocks, not by effort. Where a repair already exists in the tree and is waiting on a deploy, that is said.

Just below the line, and named so they are not lost: re-found the General market with observed widths (a devnet founding took a #[cfg(test)] fixture's rent_credit = 48 as an input, COHORT14_… "WALL ONE"); add SourceSemanticRoleV1::GeneralAccelerator so the accelerator's release id is checked rather than operator-stated; refresh apps/dclutch-web/fixtures/{public-cut,market-registry}.devnet.json, which pin a Terminal market as featured and seven markets on closed programs; adjudicate the 121 unadjudicated authority candidates in §3.5 and the four new producer-missing candidates in §3.7; drive registry/lineage_v1 on a two-cohort local campaign, since the devnet-disposability ruling means devnet can never reach it; and write a README for apps/dclutch-web, the surface carrying the only live trade-submission path.

---

8. Counts, by C-16's own six categories

What a reviewer should distrust in this file

• Every number here came from an instrument, and three of the four biggest instruments were wrong when I started. The route register undercounted never-executed by conflating status reports with blocks; the capability grep searched ASCII for hex; the authority checker matched a comment. Each was caught by re-deriving with a method sharing none of the first's assumptions. Assume the same of anything here I did not re-derive.
• Three of my own conclusions were refuted mid-review and are recorded rather than quietly fixed: I wrote that no degree-2 payoff had executed anywhere (a real-ELF founding test does); that no route pays a stranger for permissionless work (seven do); and I expected the 55→16 route drop to be laundering (88% of it was real drive). A reader should weight my remaining negative claims accordingly.
• The unadjudicated surfaces are the honest frontier, not a clean result: 121 authority candidates, 4 new producer-missing candidates, 14 stale claims that need a chain read or a build to settle, and ~31 selectors whose "no operator caller" is an upper bound on absence rather than a proof of it.
• C-16 is not met. Every one of its six categories is non-empty, and two of them — never-executed routes and user-inaccessible capabilities — are larger than the last measurement could see, because the instruments improved rather than because the tree got worse.