C-16 rehearsal, second walk — the night's delta

Status: rehearsal, not an assurance-entry certificate. Owner: lane C16-REHEARSAL-2. Measured 2026-09-04 at /Users/ember/dev/dclutch (the live tree; not the frozen subtree at /Users/ember/dev/dragons-clutch/dclutch), in the window 9e3c4eeff → 08fe86470 — 236 commits, 42 lane trailers. The tree moved five times while this was written (183b44cb7 → 83238c9d2 → 76617868b → 0b6ca0ed4 → 08fe86470); every measurement names the revision it was taken at, and §11 records the one finding that changed underneath me.

The baseline is C16_REHEARSAL_2026_09_03.md, written yesterday 11:45 EDT. This file is the delta: for each of C-16's six categories and each of that walk's ranked twenty, what moved, by how much, and the commit or chain fact that moved it — and what did not. Nothing is relayed from GOAL.md; every claim below was re-derived from the file, the register or the chain. Where a number changed because the instrument changed rather than the tree, it says so.

0. The four findings that frame the night

(a) The never-executed count really did reach zero, and the honest figure is 40 of 163, not 0. docs/reference/routes.md:41 reports 0 of 163 NEVER-EXECUTED, from 16 of 162 yesterday. Tracked one at a time, yesterday's sixteen went: ten driven (the four Claims fractional-retirement routes by claims-family-programtest; registry/lineage_v1::process by lineage-loopback; registry/process_abort#4 by tier1; trading/direct_begin_retiring_v1 by its own programtest; and all three projected_custody_bootstrap_v1 controller-funding routes, one of them with a devnet witness) and six reclassified into blocked with a written reason and an owner (both Series routes, both Direct setup routes, both split-founding stages). That is real drive plus honest bookkeeping, not laundering — but the category C-16 names is never-executed intended route, and by yesterday's own formula (no-reason + status-report blocks + self-admitted wiring gaps) it is 0 + 34 + 6 = 40 of 163, down from 50 of 162. blocked.json is 50 entries, 50/50 with a reason, 50/50 with an owner, and all 22 cited paths resolve.

(b) The devnet witness channel exists and is real — and it already undercounts by a night. docs/reference/route-witnesses.md is new and generated, and it splits the register by substrate for the first time:

The 26 are backed by four committed JSON documents under docs/evidence/witnesses/, 20 signatures, 22 skipped, 2 not_corroborated entries kept rather than dropped. Re-read from devnet for this review: eight cohort-15 signatures, every one finalized with err = null and every stated slot and compute figure matching to the unit. Two qualifiers the register does not print: 12 of the 26 exist only in cohort-13-founding.json, whose route decomposition is carried across from tier1/bindings.json for the same eight bytes rather than derived from the devnet transaction — the chain corroborates the program and the outer magic, and tier 1 supplies the twelve route names; and at least six more finalized cohort-15 transactions are in no witness file, because COHORT-15D ran after the last witness pass (§0c).

(c) A route executed on a public chain last night and the register still prints it program-test. Read off devnet for this review, with no document as intermediary: 51xXs3Zqsx13PDPiX4mVCEf8TAkvfC…, slot 492,898,053, 92,137 CU, err = null, program 3gBSSjYw… (Trading), outer magic DCLTDBR1 — that is trading/direct_begin_retiring_v1::process_direct_begin_retiring_v1, one of yesterday's sixteen never-executed routes, driven on a public cluster for the first time. docs/reference/routes.md:290 reads executed (direct-begin-retiring-programtest). Its sibling 35P7GLnQRVmSfSjkqrHwtnckHW3ATu…, slot 492,897,913, 23,106 CU, magic DCLTCRQ2 to Core, is core/begin_retiring::process#BeginRetiring, printed local-validator. Neither act carries a signature anywhere in COHORT15_…_2026_09_04.md — §D7 states "core-begin-retiring and direct-begin-retiring then landed" and names no transaction. This is yesterday's row-14 pattern in a new place, one rung higher: not a route the register cannot see, but a route the register sees at the wrong substrate. And the reason it cannot see one of them is named in the tree: docs/evidence/witnesses/cohort-15-discovered.json's one skipped entry reads "DCLTCRQ2 to core resolves to no core route" — the magic LEAN-TAGS-2 gave an owner overnight (c4b7bfa7d, eleven Core routes gained their magic, magic-selected routes 73 → 84) is still the one magic the devnet witness tool drops.

(d) The browser ships a closed cohort. Again. packages/dclutch-sdk/lib/deployments.ts:88-127 pins DEVNET_DEPLOYMENT_V1 to cohort-14, re-exported by apps/dclutch-web/lib/deployments.ts. Cohort-15 was deployed at 22:45 EDT and cohort-14 was closed in the same lane. Read off devnet for this review: all seven of cohort-14's ProgramData accounts are AccountNotFound — registry 9TZNB3Au…, rent 9RYt8ePJ…, custody GHD79BJh…, resolution AXnQbjYT…, claims DkkGjSpV…, trading FMgGM3TH…, core CC39Q4Rs…. The pinned activationCache F66BhQey… still exists and is owned by the closed cohort-14 registry. The live cohort-15 Core is 7hGerMC6Wj742FVTyiF9PhRnGSBzbee7TMZ6sUytsmFr, which appears in eight files and in neither deployment table. The commit that fixed this exact defect one cohort ago is 0f1d75b27, "deployments: the browser shipped a closed cohort, and could not decode any cache the Registry now writes." Yesterday this file was the one client surface I certified as current (C16_REHEARSAL_2026_09_03.md §1 C-12: "the pins are fine, the fixtures are not"). Today the pins are not fine either, and nothing in the tree goes red when a cohort lands.

---

1. The matrix, row by row: evidence class yesterday → today

class is the strongest evidence that exists today: devnet act, validator, real-ELF, kernel/fixture, nothing.

---

2. blocked.json re-audited, and what the honest never-executed figure is

Yesterday: 43 entries, 43/43 with a reason, 43/43 with an owner, all 14 cited paths resolving, 6 reasons falsified, and only 8 of 43 blocks structural. Today: 50 entries, 50/50 reason, 50/50 owner, all 22 cited paths resolve. Re-classified by the same taxonomy:

The two new falsified entries are exactly the two devnet-class rows of §0(b): trading/hot_v3::process_capability_seal_v1 and trading/user_position_admission_v1::process_user_position_admission_v1.

The honest never-executed figure, by yesterday's own formula (no stated reason + status-report blocks + self-admitted wiring gaps): 0 + 34 + 6 = 40 of 163, from 50 of 162. Every one of the forty carries an owner and a sentence, which was true of 34 of the fifty yesterday. One owner field is worth reading: entries 47 and 48, the two split-founding stages, name owner = whoever owns tier 1's shape (unclaimed as of 2026-09-04) — an honestly-written absence rather than a name, and the same two routes yesterday called "blocked with owner — and the owner is unassigned".

---

3. Stale claims: 47 → 58, and one of yesterday's was fixed

Every claim in yesterday's §4 was re-read against the file it describes at HEAD. 58 confirmed stale, 1 verified fixed, 7 new, 0 merely drifted.

The one fix in 234 commits is docs/MASTER_COMPLETION_CONTRACT.md:185, which now reads "RULED OUT 2026-09-01 by ember" and cites 5a371810 and docs/decisions/0018-…md. The DECISIONS lane did it.

Four are worse rather than merely unrepaired. docs/MASTER_COMPLETION_CONTRACT.md:74-77 still sends every crew to "the register's 55 NEVER-EXECUTED routes" with a per-row breakdown; the register says 0 of 163, so the tree's own work queue now points at a set that is empty. docs/OMISSION_INDEX.md:72 (P-006) says CloseSeal has "zero occurrences in any .rs or .lean" — 39 yesterday, 55 today across eight files including a program-test and an operator caller. :73 (P-007) says "932 hand-authored lines / 14 such guards" — 1,201 and 21. And the entry list's denominators moved again underneath it: 161/73/33/55 and "1 of 297" against 163 / 111 / 52 / 0 and 1 of 350.

C-00's own test — U- rows moved out of unfinished: 0 of 15. Not one has become implemented-with-evidence or a dated Ember ruling. The contract forbids a third state and fifteen rows are in one, unchanged for four days.

A correction owed to yesterday's walk. It refuted docs/OMISSION_INDEX.md:88 (U-006)'s "dclutch-product-compiler::compile, itself with zero callers" by naming five live callers. Those callers import dclutch_product_compiler::partition_quality::…, a different symbol. pub fn compile at crates/dclutch-product-compiler/src/lib.rs:338 has zero call sites tree-wide. U-006 is stale on its citations (RecoveryPolicyV1 is at crates/dclutch-source-contract/src/lib.rs:2126, not :1857), not on that clause. Yesterday's category-4 count was one too high for the right reason and one too low for the wrong one.

What did NOT drift, and is worth crediting. tools/genref/generate.sh --check exits 0 at HEAD on a detached worktree — 38 files byte-identical — and --converge --check reaches a fixpoint on the first pass. There is no generated-register-with-a-stale-twin in the sense I went looking for. The twin problem that does exist is N-2: two pages that each pass --check and disagree with each other. Byte-identity is not cross-page consistency, and the gate cannot see the difference. Likewise clean: the MEASURED_REAUTHENTICATION_CU_V1 65,390 → 11,337 change reached docs/reference/budgets.md:53-54 and tools/gauntlet/CU_BUDGETS.md:384-386, and the four surviving mentions of 65,390 all name it as the retired value; and tools/cohort14/README.md and tools/cohort15/README.md both carry a "superseded by tools/cohort/" banner.

---

4. User-inaccessible capability: the census saw 28 more magics and a stranger gained nothing

Re-derived at HEAD and at 9e3c4eeff, so one instrument ran at both ends — three spellings (ASCII, 0x.. byte list, decimal list) over apps/dclutch-web + packages/dclutch-sdk + tools/dclutch-cli, an import-graph walk, and a hand check of all eight client WASM crates.

Newly reachable: none. Newly unreachable: none. Zero selectors changed reachability class. Three changed accounting class and one builder changed file (DCRRLC02, hand-written → generated). The tree spent the night teaching its census to see 28 more magics and 10 more routes, and did not make a stranger able to do one additional thing.

4.1 The published accessibility number is stale, its gate is red, and its

derivation is unsound for one program

The ACTS lane replaced yesterday's question with a better one — does a findable act declare this route rather than does any client construct these bytes — and packages/dclutch-sdk/lib/capabilityAccess.ts:21-28 says so outright. Credit where due: it is regenerated, it lists its own exclusions, and it asks what a stranger asks. Three defects:

• Stale by four hours, and CI is red on it. 1407859b4 published "6 of 75" at 22:24; ec600e8aa moved the denominator at 02:22 and nobody re-ran. At HEAD it computes 8 of 85, and apps/dclutch-web/lib/capabilityAccess.test.ts fails 4 of 6 with expected 85 to be 75, plus one failure in capabilityRouteDerivation.test.ts: 2 files failed, 5 tests failed, 114 passed. tools/ci/run.sh:483 runs that suite with two excludes, so the web job is red at HEAD on a number this file publishes.
• The sentence overclaims in both directions. capabilityAccessSentenceV1 ends "…are not reachable from any client at all", but its inaccessible is selectable − act-declared. Seven magics the browser genuinely builds are counted unreachable-from-any-client (the test's own builtButOffered list); and DCLRFCQ1 is counted reachable with zero builders anywhere — its hex and decimal spellings return zero and its gate capabilityCloseFundGate.live.test.ts is live-gated and skipped.
• A green test asserts an unsound answer for Registry. apps/dclutch-web/lib/capabilityRouteDerivation.test.ts:117-133 compiles compileRegistryRoleActivationTransaction and asserts it reaches registry/record_v1::dispatch. It passes. The builder emits 16 bytes with bytes[10] = 0 (releaseRegistry.ts:646-648, :19), and the guard at programs/dclutch-registry-sbf/src/lib.rs:373-381 needs data[10] >= RECORD_FIRST_ACTION_V1 (2) or len != 16 — both false. The bytes fall through to process_activate_role, which the census itself lists under UNSELECTED_ENTRY_ROUTES as unnameable. routeSelector.ts documents this extra-discriminant hazard for Core and Rent, misses it for Registry, and then claims a caller "now gets a sound answer for every program".

The honest reconciled figures at HEAD: 14 of 85 buildable by a client; 8 of 85 offered by an act; 5 of 85 both offered and correctly built — custody_replay, terminal_settlement, hot_execution_v3, user_position_admission, core/found#Found.

4.2 The two plainest cases, one year later in tree-time

DCLTDFS1 — the witness moved, the client did not. It has a devnet witness now (route-witnesses.md:68, cohort 15 slot 492,865,496, 5yVEK542AE4o…, a permissionless third-party fee completion on a public chain at 95,583 CU). Client side: four ASCII hits, all census listings; hex and decimal return zero; directFeeSettlement / feeSettlement / DIRECT_FEE_SETTLEMENT return zero. New at HEAD is one reader row in apps/dclutch-web/lib/explorer/instructions.ts:325. tools/local-validator/bootstrap/successor/src/direct_fee_settlement.rs:115 still calls itself "the only caller of the DCLTDFS1 route outside a program test", and that file did not change in the window. A permissionless act whose only caller is our bootstrap is not permissionless, and executing it from the bootstrap on devnet does not change that — completion item 7 forbids exactly this shape.

DCLTPCA1 — nothing moved, 0/0/0 on every spelling across all three client surfaces; its four hits are generated listings. It gained a reproducible witness (source-abort-programtest) in exchange for losing the parked tier-1 one, and docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:4106 records the reason it cannot reach a validator: DCLTPCA1 is 1,237 wire bytes against the 1,232-byte legacy packet ceiling — over by five.

---

5. Unowned economic flow: byte-for-byte unchanged, and sharper

Re-run with the same mechanism-disjoint method at HEAD and at 9e3c4eeff, then diffed with line numbers stripped: try_borrow_mut_lamports / lamports.borrow_mut 92 calls → 48 sites, &transfer( 19, SPL close_account 5 rent destinations, create_account 8. All four channels are content-identical line for line, the 27-file lamport-flow set is identical, and the nine files carrying the twelve unowned rows are git diff --quiet clean against the baseline. 12 of 80 unowned, 4–5 outside doctrine, zero rows fixed and zero created. What moved is how sharply the tree states three of them.

• Row 3 is worse than "no check": the check exists and ships on the wrong side of the ELF boundary. snapshot.opener.key.to_bytes() != escrow.opener is at crates/dclutch-operator/src/claim_check_v1.rs:935, inside verify_claim_check_compaction_postcondition_v1. dclutch-operator is a dev-only dependency of claims-sbf (programs/dclutch-claims-sbf/Cargo.toml:101, whose own comment says "none of this reaches the cdylib") and dclutch_operator appears nowhere under programs/dclutch-claims-sbf/src/. The tree knows how to check the opener, checks it in the harness, and deploys an ELF that does not — which is why a cranker supplying its own pubkey at the opener slot still collects opener_repayment() while the book records the real opener discharged, and why nothing has gone red for four days.
• Row 4 is now self-declared. crates/dclutch-claims-svm/src/fractional_claim_check_v1.rs:832-836 records that the fractional route added RentProgram to its frame so authenticate_rent_credit could run — "the one this crate's siblings all run and this route alone could not" — and says of the native crank: "that route checks the RentCredit's writability and nothing else."
• Row 9 is convicted at the contract line, not inferred. crates/dclutch-record-contract/src/lib.rs:1724 assigns cleanup_recipient: observation.abort_actor; the observation was built from frame.abort_actor.key at record_v1.rs:592 and the check at :611 compares it back to frame.abort_actor.key. The conjunct is a tautology that cannot fail. The proof is its own sibling in the same struct: sponsor_recipient: cursor.sponsor_rent_refund reads persisted state and its check at :610 is real. One half of that close is authenticated and one half is a mirror. Driving registry/process_abort#4 for the first time did not touch this: process_abort refuses at :581, :602 and :614, all before the payout at :655-668, so a refusal outcome never reaches the circular conjunct's consequence.

Unchanged in every particular: HoardPrincipal → FeeVault (no pair rule in CustodyRequestV1::validate, refused on the one Dealer scenario route, both other pins still cfg-dead in the deployed SBF, TransferKindV3 still six variants with no HoardToFee); the rent-refund-source declaration at 1 of 80 readers with validate_registered_record_close_lifecycle_v3 still cited live and still absent; the FUNDED_CRANK_V1 self-declared violation (COMPACTION_CRANK_REWARD_LAMPORTS_V1 = 200_000, a bare literal read by two live on-chain routes); and the seven permissionless-work routes, still seven, none newly drawing on Hoard principal or future revenue.

LivenessVault still has zero transfers on any substrate — and the absence is now a positive control. tools/gauntlet/journey/src/ledger.rs:270-280, :460-473 widened the compartment census so a never-created compartment reads a measured zero, asserted at :1792. Yesterday it was an absent signal; today it is a measured one. The underlying fact did not move: no producer of a nonzero work_funding exists outside tests, and Plan::push (crates/dclutch-dealer-codec/src/lib.rs:1415-1418) returns early on zero.

5.1 What the night's own money moved without an owner

• ≈0.951 SOL of campaign-payer spend appears in no table. COHORT15_…:473 gives 1.588734021 exact and :965 gives 0.628283565 exact; the named spend across that gap is 9,421,512 lamports. The largest identified consumer is the General founding — 576 transactions (:574) with no lamport cost stated anywhere; §13's cost table has no General row. The doc's own two tables disagree by ~0.17 SOL (:476 "~1.53" against :492 "~0.42"), and its only two approximations sit on the single largest unexplained spend.
• The 500,000,000-atom payout has no named recipient. The ATA is referenced four times and its address, owner and mint are never given. Market 1 never traded (:880, :1001), so the payee is presumably the founder; the document never says so.
• No conservation census covers Addendum C or D. The last one is at :948. Market 3's fill, its DCLTDFS1 settlement, market 1's four payouts and the General seal's 6,940,968 lamports all moved with L1–L8 switched off. The document credits L7 for "earning its pass by failing first" and then stops running it exactly when money starts moving.
• 2,431,872 lamports are debited from the Direct funding ledger with no stated destination (:1273, :1276) — derivable as the 256-byte capability root's rent, and the two facts sit in one sentence unjoined. And market 3's fee destination GoEvhmG4… appears exactly once with no derivation, no bump and no owner (:1261), one paragraph after the seller's PDA got a deliberate cross-market control. The one economically terminal address in the first fee-bearing fill on a public chain got the least scrutiny in the document.

---

6. Unexplained authority: the class closed, the gate is red again, and 0 of 121 were adjudicated

Genuinely closed, and it is the best repair of the night in this category. d8a679168 collapsed Custody's three *_from_cache wrappers into authenticate_reservation_frame_v1 (programs/dclutch-custody-sbf/src/lib.rs:1052), which borrows once, decodes once, and calls authenticate_activation_cache_identity_v1 in its own body (:1069-1075) before passing an authenticated view down. The other two decode sites (delegated.rs:30-42, lib.rs:~390-403) follow the identical shape. Yesterday's hazard — provenance established by a sibling call, so that deleting or reordering one line silently underived two readers — is gone. Residue, stated: ActivatedExecutionReleaseSetViewV1<'_> is not a proof-carrying type, so a fourth decode site could still hand over an unauthenticated view; and the same shape survives untouched one account over, at read_replay (custody-sbf/src/lib.rs:2203-2208), a bare borrow-and-decode at six call sites whose provenance still comes from authenticate_replay_identity one line earlier.

And the gate is red again for the reason yesterday named. docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:4031's "all 45 adjudicated, run.sh seam PASS, zero untriaged" was true when written and is false at HEAD. Run here at HEAD, twice, stable: SEED_LEN 49 / DERIVATION 277 / PIN_CENSUS 0 / UNSET_PIN 287 / DOMAIN_DUP 2 / PRIVILEGE 67 / **AUTHORITY 0**, exit 1, with one NEW DOMAIN_RAW_RESTATEMENT at programs/dclutch-core-sbf/tests/infrastructure_program_test.rs:288 (the SUCCESSION lane's own new test, spelling a one-seed tuple for a domain dclutch-release-set-contract exports CallerAuthoritySeedsV1 for) and two GONE in tools/fractional-exterior/src/stage.rs. The lane closed at 4a8b87f3e 12:50:06 and 7083a0bc2 broke it at 12:53:24 — three minutes later; 65c4026d4 broke two more at 13:25:27. Yesterday diagnosed the instance; nobody fixed the mechanism, and the mechanism recurred inside three minutes. The baseline also still carries one entry verdicted confirmed-defect, against yesterday's headline of "0 confirmed open".

0 of 121 candidates were adjudicated, and the category has no reproducible instrument. Re-run at HEAD and at 9e3c4eeff with one matcher: signer-with- no-key-comparison 42 → 42, set-identical; PDA-decoded-with-no-owner-check 368 → 367, and the single moving function is d8a679168's custody collapse, which was an in-scope row rather than one of the 121. The three dense clusters are byte-identical or line-shifted only. Yesterday's 28/103 against today's 42/367 is entirely matcher difference — measured by running today's matcher at yesterday's commit — and yesterday's sweep script was never committed under tools/, so the largest open surface in this category cannot be re-run by anyone.

One of yesterday's clusters is a false positive. programs/dclutch-trading-sbf/src/execution_strategy_v2.rs:656,683,710,737,791 all call authenticate_finalized_record, defined in the same file at :1056, which does find_program_address, an owner comparison against the registry program, and a content-hash check. Yesterday's declared method included "one hop of delegation" and its one hop failed on a same-file callee. That cluster comes off the list.

6.1 The producer-missing roster: 17 instances, 7 open, 4 blocking a dispatched route — and the detector is finally connected

Yesterday's sharpest instrument finding is closed. 36b6e5517 replaced reader_booleans_without_a_computing_producer_v1's env!("CARGO_MANIFEST_DIR") resolution with an ancestor walk, tools/ci/run.sh:1090 runs cargo test --bins, and all four tests pass each with its own red control. It is no longer an absent signal with no positive control. Two qualifiers: its shape is bool fields in the successor's own src/, so every instance on the roster below is invisible to it; and tools/ci/run.sh:1294-1300 still says in the present tense that those host tests "are simply not wired yet".

Six instances closed in the window — GeneralSuccessorRouteV1 (808302b84), the capability seal host (f730068b1, executed on devnet at 225,141 CU), the General lookup table and plan signer (680bb2085), and DCLTPOS1 + DCSRCER1 (958901b45), DCLTSRS1 + DCLTCAT1 (3d41f8f85). Four of those six closed by deleting the reader, which is legitimate and is a different act from writing a producer; the roster should not blur them.

Open and blocking a dispatched route:

The line worth carrying: the two most damaging open instances are the same Series lifecycle in sequence, and their two missing producers sit ninety lines apart — stage_pending_funding at series/accounts.rs:224 and plan_prepare at series/projector.rs:86, both with no caller anywhere. Series' whole occurrence path is a finished machine with no starter. That is C-07's row in one sentence.

Two corrections to yesterday and one to a lane, recorded because they change the roster's shape: yesterday's cited blind-spot example (crates/dclutch-operator/src/series_lifecycle_v3.rs:569) is itself inside a #[cfg(test)] module opening at :383 — the blind spot is real as a class, the instance was already a test constructor; and PARSIMONY's "the Dealer equity builder is PRODUCER-MISSING" (docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:4163) is mislabelled — its own commit aaa40f931 and the module doc it added (crates/dclutch-operator/src/dealer_equity_hot_v3.rs:9) both say the opposite, that "the missing piece is the CONSUMER." It is the inverse shape.

---

7. The six categories, yesterday → today

---

8. The ranked twenty, re-ranked

Yesterday's ranking, with today's verdict. CLOSED = the thing asked for happened. MOVED = materially advanced, named residue. UNMOVED = the citation still resolves to the same defect.

---

9. The new gaps the night created

Ranked by what an assurance reviewer would do about them first.

N-1. The browser's deployment record pins a closed cohort, and the commit that fixed this exact defect one cohort ago is in the log. packages/dclutch-sdk/lib/deployments.ts:88-127 declares DEVNET_DEPLOYMENT_V1 as cohort-14; apps/dclutch-web/lib/deployments.ts re-exports it; both deployments.test.ts:31 assert the dead registry id. Read off devnet here: all seven cohort-14 ProgramData accounts are AccountNotFound, and COHORT15_…:110-125 is the lane's own table of closing them and reclaiming 42.20 SOL. README.md:194-196 names the failure mode in advance — "a cohort redeploy serves the browser a dead cohort's program ids, which the site then reports as an honest refusal on a market that is perfectly healthy." 0f1d75b27 fixed it once. Nothing goes red when a cohort lands, and the fixtures are in the same state (§3, and cohort-15's Open Market 3QytL1bB… appears in five web test files and neither fixture).

N-2. Two generated register pages disagree about the same 163 routes, and the page that explains the gap explains it backwards. routes.md tallies 111 witnessed / 52 blocked; route-witnesses.md:21-25 tallies 113 / 50; docs/reference/README.md:29-30 sides with routes.md. Both pass tools/genref/generate.sh --check (EXIT 0, 38 files byte-identical, and --converge --check reaches a fixpoint on the first pass), so byte-identity is not cross-page consistency and the gate cannot see this class. The two rows that differ are trading/hot_v3::process_capability_seal_v1 and trading/user_position_admission_v1::process_user_position_admission_v1, both class devnet, both printed blocked by rule on the page a reader opens first.

N-3. A route executed on a public chain and no artifact in the tree names the transaction. COHORT15_… §D7 says "core-begin-retiring and direct-begin-retiring then landed" and gives no signature and no slot for either — the same shape yesterday flagged in cohort-13's close. Recovered here by reading the Market's own transaction history: 51xXs3Zq… slot 492,898,053, 92,137 CU, magic DCLTDBR1 (Direct) and 35P7GLnQ… slot 492,897,913, 23,106 CU, magic DCLTCRQ2 (Core). The first-ever execution of one of yesterday's sixteen never-executed routes is recorded in prose only.

N-4. The devnet witness tool drops the one magic the night gave an owner. docs/evidence/witnesses/cohort-15-discovered.json's single skipped entry: "DCLTCRQ2 to core resolves to no core route". c4b7bfa7d made CORE_REQUEST_MAGIC Lean-emitted and moved Core's Action match behind an if the census reads — magic-selected routes 73 → 84, eleven Core routes gained their magic. The census learned it; corroborate.py did not. Every Core Action instruction on devnet — Found, BeginRetiring, AdmitTerminal, Retire — is invisible to the devnet witness channel, which is why C-10's first retirement act cannot reach the register.

N-5. C-14's strongest claim now has a measured counterexample, produced by the tree's own instrument. docs/runbooks/COLD_MACHINE_2026_09_03.md:106-188: at one commit, --genesis-cohort, 9 of 10 role ELFs differ between hbox (linux-x64) and the laptop (macos-arm64); the control (two candidates at two absolute work roots on ONE host) is all-ten-identical, so the divergence is the hosts. The cause is platform-tools embedding Anza's CI absolute paths (/home/runner vs /Users/runner) into core/alloc panic locations; series-shadow has zero such strings and is the one role that reproduces. It propagates into execution_release_set_id, checked_infrastructure_id and infrastructure_profile_sha256. The pack's supported_builders lists local, persvati and hbox-through-swarm-build, and its members can reproduce each other only within one platform-tools host OS; excluded_nondeterminism names "host OS, kernel, C toolchain, and libc identity" and does not exclude the shipped SBF ELFs, which carry the host OS inside them. compare-packs cannot be run across two hosts at all, by construction.

N-6. derivation_policy is convicted in a THIRD family, on a public chain, and the contract still says two. docs/MASTER_COMPLETION_CONTRACT.md:190: "Convicted ON-CHAIN in TWO families by two independent routes (Dealer by CU-bracketed bisection; Direct by swapped-fixture experiment) … No lane may start it." COHORT15_…:1582-1613 adds General, by a devnet simulation and a devnet --execute that agree: descriptor derivation_policy 68b51371… ≠ manifest entry child_derivation_id 7fe9b22d…, 0x4015 at 128,724 CU, the accelerator never invoked. The evidence calls this founding's version fixable by re-founding; the contract's row is about the field's protocol-wide representability. Whether the third conviction is the same defect or a founding-input mistake is exactly the question nobody may start, and it now blocks C-05's whole lifecycle.

N-7. Two of last night's own lanes recorded debts that no reader carries. docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:4084-4085 — "decision 0011 §3b and the docket's D7 line 'K=3 with the packet wall gone' are WRONG … (amendment to 0011 owed)"; docs/decisions/0011-structured-v2-physical-route.md was last touched a968858cd on 2026-09-01 and §3b stands unamended, beside a §3e that says K=2. docs/evidence/ASPIRATION_LEDGER_2026_08_27.md:1144 still states build_general_hot_instruction_v3 "has zero callers" while docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:4167 records it LOAD-BEARING with five. A ledger and a decision record contradicted by the same tree's own log are the C-00 third state wearing a date.

N-8. A credential lived in the operator job dirs across three cohorts and no gate saw it. docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:4249-4252: the Helius key was in nine local job-dir files back to cohorts 7/8/11 — execute scripts, a validator log, sim configs — all redacted; never in the repo, its history, or the cut. The cut's credential sweep is a value test over the published tree, a different corpus from the job dir the runbooks tell an operator to build. The author fix (the simulator resolves the endpoint at use time and refuses a config carrying a credential) landed in c311e5a70. Rotation is Ember's call and is not recorded as done.

N-9. docs/runbooks/COLD_MACHINE_2026_09_03.md contradicts itself about its own verdict. :252 — "No market was founded … C-13 is not met." :472-485 — "Met. … founds and opens one", then its own "Not met" list. The two passages are a narrative before and after §7-8's fix and nothing in the file says so. A reviewer who greps for the verdict finds both.

N-10. The tree's own proof that "the two selectors agree" for market 3 does its arithmetic on a number the certificate does not carry. COHORT15_…:1740-1746 states "The observation staged with this market was SOL/USD $103.972224, which at the statistic's own source_scale_exponent = -8 is 10,397.2224 on the cuts' ×100 scale." Read off devnet here, market 3's certificate 9BnUF5rK… carries result_numerator = 10,357,558,463, result_denominator = 1, observed_at = 1,788,499,917 — $103.57558463, i.e. 10,357.5585 on the cuts' scale. $103.972224 is the founding anchor read 67 s before staging the cuts (:1194), not the observation the certificate committed. The conclusion survives — both readings fall in cell 1, and the committed selector at offset 256 is 1 — and the number the document reasons from is $0.40 off the one the chain holds. For market 1 the same table reproduces exactly (10,373,844,866 / 1, cell 1, selector 1). This is the one artifact cohort-15 exists to produce, and half of it is not re-derivable from its own text.

N-11. A chain parameter moved and left a settled market un-terminalizable, with a stranger holding the winning outcome. Market 3 C9dLhWj7… reads phase 0x01 Open off devnet, holding an honest kind-1 certificate and a buyer on outcome 1; its admit-terminal refuses ResolutionCoreOperatorErrorV3::Funding — "native custody arithmetic" — raised from two _ => catch-alls at crates/dclutch-resolution-core-v3-operator/src/lib.rs:2558 and :3456. The conjunct is CapabilityFundingLedgerV2::validate_native_custody (crates/dclutch-capability-contract/src/funding.rs:2033-2048): it requires account_lamports == rent.minimum_balance(len) + remaining_native_lamports exactly, unless the donations flag is set, and rent.minimum_balance is a chain parameter read at check time. COHORT15_…:1758-1768 measured both ledgers as equal in every quantity: 264 B, 2,482,539 lamports, rent minimum 1,991,360, surplus 491,179. Deriving from those committed numbers: (264 + 128) × 5,080 = 1,991,360 exactly, and (264 + 128) × 6,333 = 2,482,536 — three lamports off the ledger's balance. The ledgers were funded at rent-exemption under a rate of 6,333 lamports per byte-year; devnet's rate is now 5,080; the difference is the 491,179 surplus, and an exact-equality conjunct refuses a surplus. Market 1 was admitted before the parameter moved. The evidence document left this as "one instrumented re-run away and is not guessed here" (:1770); the derivation above is that re-run done on paper from its own table. A funded market can become un-terminalizable because a chain parameter fell, and the code that refuses it cannot say so — which is AGENTS.md's coarse-map_err class in the operator layer, on the path between a stranger and their money.

N-12. A refusal's operator-facing meaning is published wrong in seven generated files. programs/dclutch-core-sbf/src/lib.rs:214 documents InfrastructureAlreadySucceeded = 0x301B as "The V2 profile PDA is already occupied: the succession happened." At HEAD 0x301B fires only on ProfileSuccessionStateV2::Succeeded (programs/dclutch-core-sbf/src/infrastructure_v2.rs:424-425); BornAtV2 sets occupied = true and proceeds (:423, :428). "PDA already occupied" is the ordinary standing. tools/gauntlet/census/src/enumerate.rs:854 publishes a variant's first doc paragraph as the refusal's meaning, so the false sentence ships in docs/reference/refusals.md:249, packages/dclutch-sdk/lib/generated/refusalRegistryV1.ts:73, apps/dclutch-web/lib/generated/refusalRegistryV1.ts:73 and four more. The SUCCESSION lane's whole finding was that a reader had been left behind; this is its fourth reader, and it is the one a stranger sees. One line at the source; genref heals all seven. Adjacently: tools/release/private-validator-lifecycle/README.md:27-37 still states the superseded conjunct as current, and blocked.json's core/infrastructure_v2::process_initialize_v2 still says "Undrivable at HEAD" after two executions.

N-13. A census bound was raised by one and shipped with the property its own commit message convicts. tools/gauntlet/census/src/phases.rs:230 — const MAX_GUARD_DEPTH: usize = 4;, used at :1225 and :1298 behind a bare continue: no counter, no warning, no diagnostic. Measured by rebuilding the census at depths 3/4/5/6/20 against one snapshot: 5, 6 and 20 are byte-identical to 4, so saturation holds today; depth 3 silently loses two gate rows and the census's own summary line does not move. Reverting to the broken value leaves the suite at 85 passed / 0 failed. The sibling bound MAX_SELECTION_DEPTH (:1422) does go red when tightened — the looser bound has a red control and the one whose under-reach publishes a gated route as ungated does not. And tools/release/check-all-workspaces.py:197-198 runs cargo check, not cargo test: those 85 tests execute in no CI tier.

N-14. Two magic-name collisions are live and exported, and the gate is green because its parser cannot see them. tools/gauntlet/census/src/magics.rs accepts only [u8; 8] literals (is_eight_byte_array, :175-194) and returns None for non-literal initializers (magic_bytes, :144-171). So pub const STATE_MAGIC is DCLTCOR3 at crates/dclutch-market-core-codec/src/generated.rs:30 and DCES at crates/dclutch-economic-kernel/src/lib.rs:21; pub const MAGIC is DCLTDP03 at one site and DCLTAP02 at another. check_names — the inverse gate the MAGIC-NAMES lane added so that "a name means one thing" — would be red at HEAD if it could read them. The lane's own OWED line names the STATE_MAGIC emission as "the last one"; it is not unique, it is already colliding.

N-15. Two client generators still do first-match regex over lines with two authors, and one of them is the exact defect a lane deleted last night. packages/dclutch-sdk/scripts/generate-aggregate-retirement-v1.mjs:38 matches put_u16(&mut output, N, AGGREGATE_RETIREMENT_CHECKPOINT_VERSION_V1) over the whole source; crates/dclutch-market-core-codec/src/retirement_checkpoint_v1.rs writes that identical line at :266 (the intended record) and :539 (a different one). :40-41 runs two independent first-match searches for reservedOffset and reservedBytes over sites that disagree — :241 require_zero(input, 11, 5) against :559 require_zero(input, 10, 6) — with nothing requiring them to land on the same line. The deleted agreedOffset at least refused on disagreement. packages/dclutch-sdk/scripts/generate-relay-transport.mjs:40-41 has the same shape over terminal_sequence sites that already disagree (32 at crates/dclutch-relay-contract/src/instruction.rs:350, 24 at :418). abi:*:verify proves determinism, not authorship: a first-match regex bound to the wrong record emits the same wrong number every run and stays green forever. Only block() in generate-state-machines-v1.mjs:189-192 throws on ambiguity.

N-16. The client's highest-traffic submit path is hand-owned under a comment claiming a Rust owner that does not exist. packages/dclutch-sdk/lib/directInlineV3.ts:132-156, :504, :830 (and its web twin) hand-type the Direct trade transaction's whole geometry — a 39-account runtime tail, 57 lookup addresses, 61 unique message accounts, 78 trading indices, and the alias/writable/executable index tables. :123 says the layout is "owned by the Rust route projection"; RUNTIME_TAIL_ACCOUNT, UNIQUE_MESSAGE_ACCOUNTS and TRADING_ACCOUNT_INDICES have zero hits in any .rs. packages/dclutch-sdk/lib/releaseRegistry.ts:645-680 does the same for Registry ActivateRole/Reauthenticate, hand-encoding DCLTRIX1 at :647 and offset = 352 + index * 248 at :459 — in a file that documents its own production failure from exactly this drift at :31-46 ("every cache the current Registry signs into existence was refused — measured on devnet cohort-12 … Nothing went red"). Five Rust↔client byte pins exist for roughly twenty hand-written builders; packages/dclutch-sdk/lib/claimsCustodyReplay.ts:447-465 is the standard the rest are not held to. WEB-RATIONAL fixed the instance (2e3ec462b); the class is bigger than the instance.

N-17. tools/cohort14/ is a live second author of a fact tools/cohort/ now owns. AGENTS.md:323-324 forbids parallel legacy/current authority paths. Both READMEs carry a superseded banner — and two executable, unmarked scripts survive with names the successor also uses (tools/cohort14/check-steps.py, tools/cohort14/preflight.sh, both 755, the preflights differing by 318 lines). Three ELF digests are typed independently in both trees, which tools/cohort/steps.tsv:16 itself forbids ("A literal typed here instead is a fact with two authors"), and nothing compares them. The two preflights already answer different questions under the same heading: the old one gates the working tree, the new one gates the manifest's deploy commit 8e96ec3f8cd…, and both print green under "the deploy commit contains what cohort-14 must carry." docs/runbooks/COLD_MACHINE_2026_09_03.md:98-100 — an operator runbook written last night — tells a cold machine to run the superseded checker. --prove-frozen is in no CI tier, so editing the frozen file breaks nothing.

N-18. The one-runbook successor emits 22 stage scripts and every one of them refuses. tools/cohort/generate-stage-scripts.py:290-299 creates 22 empty flag stubs, and :114 makes every emitted script exit 64 with "names no flags". The lane's summary counts flag files, not flags, so "134 flags" reads as carried when none is; test.sh:208-209 passes trivially against every stage. No retire row exists among the 25 keys though market 1 began retiring, and both activate.sh:27 and activate-c.sh:27 call the Direct activation binary, so the General activation row has no script.

N-19. Five wire changes were ruled by the swarm, labelled PROVISIONAL, and reach no register a C-16 reviewer walks. docs/decisions/0019–0023 are each honest that the orchestrator ruled, and — checked hash by hash — every commit they cite says what the record says it says, every verbatim quote is verbatim, and the contract's decision-register table cites none of them, so no C-row is closed by one. Three things are still wrong. (a) All six invoke "ember's standing goal" and none cites it; the standing goal is at docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:2392-2395 and is a scope directive that delegates no ruling authority, while the contract says Ember rules and "Silence is never a ruling" (:180). (b) The word PROVISIONAL is inverted from the tree's own prior use — docs/ledger/COHORT9_CLOSEMAKER_RULINGS_2026_08_31.md:43 is "PROVISIONAL, NEEDS EMBER", burden on the swarm; the new records use it for "decided without ember, reversible by ember", burden on Ember to notice. (c) The docket that would redeem them (M1–M5, docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3952) lives outside the tree — git ls-files | grep -i rulings_context is empty, and not one of 0019–0023 mentions M1–M5 or the docket. Two of the five are exactly what the register's own scope covers (:177, "genuinely new wire choices"): 0021 adds a new persisted wire field and 0023 moves every caller-authority address. The orchestrator made the distinction in the same lane — docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:2863 uses "RULING FOR EMBER (decision 0003)" — and applied it selectively.

N-20. An unanswered question is cited twice in the file lanes read as "ember's ruling". docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:3006 — "(ember's 0003 ruling)" — and :3059 — "the output page (ember's 0003)". docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:2863 lists the same question as "RULING FOR EMBER", unanswered, and the DECISIONS lane's own commit body diagnoses the false attribution and wrote the amendment marking 0003 open — and left both sentences in place. Lanes have already planned against it (:3059, "End state: inline input + the output page").

N-21. The contract's register says the economics row is open while decision 0014 says the fee rate was ruled. docs/MASTER_COMPLETION_CONTRACT.md:186 — "Sustainable economics … open"; docs/reference/decisions.md:28 — decision 0014, "RULED 2026-08-30, all three". C-11 (:96) puts fee rates in that row and the register cites 0014 zero times. This is precisely the C-15 defect the DECISIONS lane fixed for privacy, left unfixed for the fee rate.

N-22. Decision-record line citations rot within hours and nothing gates them. docs/decisions/0019-…md's five upgrade.rs citations were all correct at b798926a2; eight hours later f4ffbe732 landed 425 insertions and three no longer resolve — :9941 now points at a receipt-transition lock. The lane's commit promises "Every citation was checked against this tree before it was written", which was true and is already false. genref --check gates the generated reference; nothing gates the records.

N-23. refund_source, the wire field decision 0021 added, has no semantic owner. crates/dclutch-account-profile-contract/src/lifecycle_v3.rs:2194-2196 reads it with hand-written integer literals (offset + 4, + 5, + 6) over a 40-byte record; grep -rl 'ACTION_PLAN\|actionPlan' formal/ is empty. Its neighbour in the same file is Lean-emitted with named offsets (lifecycle_v3/generated_v5.rs, from EmitStateLifecyclePolicyV5AbiRust.lean). Contract items 1–2 (:51-52) require one semantic owner and generated codecs that reproduce it. The record names "the rule is not in Lean" as debt; the sharper fact is that the layout is not either.

N-24. Two gates went red inside hours of the lane that made them green, by the mechanism yesterday named and nobody fixed. The seam audit: the lane closed at 4a8b87f3e 12:50:06 and 7083a0bc2 broke it at 12:53:24 — seam_audit.py --commit HEAD exits 1 here, twice, stably (§6). The accessibility census: 1407859b4 published "6 of 75" at 22:24 and ec600e8aa moved the denominator at 02:22, and apps/dclutch-web/lib/capabilityAccess.test.ts now fails on expected 85 to be 75 inside a suite tools/ci/run.sh:483 runs (§4.1). Both are the baseline-goes-stale-within-hours class, and the third instance of it in this file is N-22, decision-record citations. The tree has three instruments whose correctness depends on a human remembering to re-run them after someone else's commit, in a tree taking 236 commits a night.

A reading hazard in the tree's own log, recorded because it caught me

GOAL.md interleaves Started HH:MM: LANE **(spawned)** — <the brief> with LANE closed (<commits>) — <the result>, in the same bullet style. A brief reads exactly like a result. Measured instance: the emission census figure "100 → 103" appears at docs/ledger/GOAL_2026-08-31_to_2026-09-04.md:4327-4328 as a launch line; the lane retracted it in daad707b9 and its closeout omits it, and the measured value at HEAD is generated=100 guarded=100 unguarded=0 PASS (tools/emission-guard/emission_guard.py). I carried 103 forward on my first pass. A reviewer reading GOAL.md for facts should take only the closed lines.

---

10. Is C-16 met?

No, and the night did not bring it close — but it changed which sentence is the hard one. Yesterday the honest summary was "the instruments improved faster than the tree." Today the tree moved further than the instruments: the never-executed count is genuinely 0, tier 1 completes, twenty-six routes have a corroborated devnet witness where none did, the rounding boundary that took value from a stranger is repaired on a public chain twice over, the first retirement act in the project's history is on devnet, and the first General capability seal, route document, plan and routing table exist on a real cluster. Against that, every one of C-16's six categories is still non-empty, two of them are worse than yesterday by measurement rather than by framing (58 confirmed stale claims against 47; blocked status-reports 28 → 34), and the night created a class of gap it had not had before: acts on a public chain that no artifact in the tree names, and a client surface pinned to a cohort that no longer exists.

The sharpest way to say where completion actually stands is with one market. The only complete Direct lifecycle this project has — compile, found, open, admit two strangers, cross, third-party fee completion, provider resolution, redeem — is cohort-14's market C BL8zsFok…. It sits at phase 2 Terminal on a Core program whose ProgramData account I read as AccountNotFound; its certificate is an artifact of the scale defect, which is why cohort-15 exists; and it can never move again. The market whose certificate is now correct (cohort-15 market 1) was never filled. The market that was filled correctly (market 3) is refused at admit-terminal. The complete arc and the correct arc are still two different markets, and neither has reached Retired — 18 markets across four Core programs, phases 0×10, 1×4, 2×3, 3×1, and zero at phase 4.

The shortest honest path

Not a work plan — the smallest set whose absence is what makes the answer "no".

1. Ember's D1 economics ruling. C-11 cannot close by engineering and no lane may implement past it. The docket has been published since 2026-09-03 11:30. D4 (mainnet's place) and D5 (recovery ontology) are the other two rows the contract cannot close without a person.
2. Make the register see the chain. Teach corroborate.py DCLTCRQ2 (N-4), re-run the witness pass over COHORT-15D's transactions (N-3), and reconcile routes.md with route-witnesses.md (N-2). Until then the register's own numbers are a floor whose distance from the truth nobody can state — which is exactly the C-16 condition.
3. Re-pin the client to the live cohort and gate it. N-1 is a recurrence, which means the repair is the gate, not the edit.
4. One market from Open to Retired on a public chain. The wall is named and small: Resolution CloseFund: Funding — a coarse code raised from two _ => catch-alls (resolution-core-v3-operator/src/lib.rs:2558, :3456) — plus outstanding_capabilities = 1 against a required 0. AGENTS.md names this idiom as the most expensive in the tree and names the remedy: surface the inner distinction.
5. Regenerate the six authority documents, and wire one tripwire. 58 stale claims, one fixed in 234 commits, concentrated in what a stranger opens first; doc-citations --check exits 1 with 27 NEW and is wired into no tier. A red tripwire nobody watches is the same as no tripwire, and it is now catching the night's own lanes.
6. Say what supported_builders means. C-14's row asks for artifacts that "reproduce on supported builders"; measured, they reproduce only within one platform-tools host OS (N-5). Either the field narrows to the set that actually reproduces, or the ELFs stop carrying Anza's build paths.

Items 1 and 6 are rulings or scope statements; 2, 3, 4 and 5 are engineering already scoped by lanes that closed last night. None of them is a research question. That is the real change since yesterday, and it is why the honest answer is "not met" rather than "not close".

---

11. What a reviewer should distrust in this file

• The delta is only as good as yesterday's baseline, and yesterday's baseline had at least three defects I found by re-deriving rather than by reading. It called market phase 3 Retired when 3 is Retiring; it refuted U-006's "zero callers" clause by matching a different symbol; and its §8 headline "13 of 17 rows carry a material gap" does not match its own §1, which lists fifteen. I have re-derived every number I carried forward and none is relayed.
• Two of my own six category counts moved because the instrument improved and not because the tree did, and both are labelled: the reachability denominator (78/77 by hand yesterday, 85/73/68 by the census today, over program code that is byte-identical except one guard) and the never-executed figure (0 by the register's own vocabulary, 40 by yesterday's honest formula). A smaller number is not automatically progress.
• Four measurements in this file were taken while the tree moved under them. HEAD went 183b44cb7 → 83238c9d2 → 76617868b → 0b6ca0ed4 during the review, and one finding is a consequence: at 83238c9d2 tools/genref --converge --check reported HEAD off its fixpoint by docs/reference/abi/capabilitySurfaceV1.md; at 0b6ca0ed4 it reports a fixpoint on the first pass, because 76617868b regenerated it. The convergence loop worked inside an hour. Anything here I did not re-pin at 0b6ca0ed4 should be assumed to have the same volatility.
• The capabilityAccess red is at HEAD, and a lane is fixing it as I write. I verified it from committed blobs rather than from the working tree: the committed generated census at packages/dclutch-sdk/lib/generated/routeCensus.ts yields 85 distinct selectable route ids (84 INSTRUCTION_MAGICS rows, 81 distinct; 33 PREDICATE_SELECTED_ROUTES rows, 31 distinct), while the committed test at apps/dclutch-web/lib/capabilityAccess.test.ts:33 asserts 75. Both test files and packages/dclutch-sdk/lib/capabilityAccess.ts are dirty in the shared checkout, which is a lane repairing exactly this.
• The chain reads are the strongest evidence in this file and the narrowest. Every account and signature I quote was read from devnet through getAccountInfo / getTransaction / getProgramAccounts at finalized commitment. A finalized signature says the transaction landed and its outer magic went to the declared program. It does not say which branch ran, and eighteen markets is not a proof about markets in general.
• The unadjudicated surfaces from yesterday are still the honest frontier, and this walk did not shrink them: the authority candidate residue, the producer-missing candidates, and the ~31 selectors whose "no operator caller" is an upper bound on absence rather than a proof of it.

---

Addendum, 05:10 EDT — the window's own last commit widens N-11 and half-serves §10 item 4

Written after the body was committed, because 08fe86470 — the revision this file pins as the window's end — lands inside both findings and is the kind of thing a reviewer should not have to discover by reading the log.

N-11 is confirmed independently, and it is broader than I wrote it. 260684fad convicts the cause by name: an epoch-1141 rent change, 6,333 → 5,080 lamports per byte at slot 492,912,000. My derivation from cohort-15's own committed table (2,482,539 = 392 × 6,333 + 3; surplus 491,179 = 392 × (6,333 − 5,080) + 3) and the tree's conviction agree without having consulted each other. What I understated is the blast radius: it does not only refuse market 3's admit-terminal. 08fe86470's message records that market 1's terminal sequence no longer reaches CloseFund at all — the rent change "stranded two guards in front of it", the first being authenticate_terminal_receipt_funding_v1, which refuses because "terminal session receipt rent no longer rederived from the canonical Rent sysvar". So one chain-parameter change at an epoch boundary is now the live blocker on both cohort-15 markets' terminal paths, and on the retirement C-10 names as its endpoint. It is the sharpest open economic finding in this file and it was created by the cluster, not by the protocol.

§10 item 4 is half-served. 08fe86470 did exactly what AGENTS.md prescribes for the coarse-map_err class: authenticate_close_funding published one ResolutionCoreOperatorErrorV3::Funding from twelve sites, six of them map_err(|_| …) and one a _ => arm that discarded which side of a pair disagreed; each site now names its conjunct, the four numeric ones print both numbers, and the _ => arm becomes an explicit (material_side, observed_side). Nothing on the wire changes. And the commit says plainly that the labels are not exercised on a live refusal, because the sequence stops earlier now — which is the honest form of the claim and is why this is half of item 4 rather than all of it.

Two things this does not change. The remaining half of item 4 is still a market reaching Retired: the census in §8 stands at 18 markets across four Core programs, none at phase 4. And the diagnostic that made the conviction possible is a map_err surfaced by hand, not a gate — nothing in the tree would have gone red had it stayed coarse, which is the finding AGENTS.md already carries and this file's §6 records recurring in the seam baseline.