C-16 rehearsal, third walk — the swarm's delta

Status: rehearsal, not an assurance-entry certificate. Owner: lane C16-REHEARSAL-3. Measured 2026-09-05 at /Users/ember/dev/dclutch (the live tree; not the frozen subtree at /Users/ember/dev/dragons-clutch/dclutch), pinned at 873a43914, in the window 08fe86470 → 873a43914 — 432 commits. The tree moved three times while this was written (873a43914 → 9fe4506f2 → 311797cc3 → 16e79dfaf); every measurement names the revision it was taken at, and §8 records the two findings that changed underneath me.

The baseline is C16_REHEARSAL_2026_09_04.md (second walk, at 08fe86470), which is itself a delta on C16_REHEARSAL_2026_09_03.md. This file is the third delta: for each of C-16's six categories and each of the second walk's ranked twenty, what moved, by how much, and the commit or chain fact that moved it. Nothing is relayed from docs/ledger/; every ledger sentence quoted below was treated as a claim and checked. The window's dominant event is the simplification swarm (docs/evidence/SIMPLIFICATION_CONVERGENCE_2026_09_04.md, docs/design/SIMPLIFICATION_MAP_2026_09_04.md): programs 12 → 8, crates 94 → 33, 55 Cargo workspaces → 1, apps/dclutch-web −46,557 lines now importing the SDK, GOAL.md 4,992 → 106 lines and an index. A simplification that deletes a route also deletes its witness, so every count below says whether it fell by deletion or by evidence.

0. The four findings that frame the day

(a) Every devnet witness in the register now attests to a binary the tree cannot produce. docs/reference/route-witnesses.md:21 reports 42 routes in class devnet, up from 26 — the register's strongest class and the largest part of the 66 of 148 that meet contract item 5. Every one of those 42 is corroborated against a cohort-13/14/15 transaction. Cohort-15 deployed from commit 1cae26fd6, and git merge-base --is-ancestor 1cae26fd6 330bbfaba succeeds: cohort-15's ELFs predate the swarm base. The convergence's own ELF table (SIMPLIFICATION_CONVERGENCE_2026_09_04.md:152-175) states the consequence without flinching — "No link is byte-identical … every link owes rows, and cohort-16 carries every redeploy (cohort-16 has not deployed)" — and ls tools/cohort/cohorts/ returns 14.json 15.json. Read off devnet here at finalized slot 493,609,778: all seven cohort-15 ProgramData accounts are LIVE with deployment slots 492,745,516 … 492,746,271, exactly the range packages/dclutch-sdk/lib/deployments.ts:134-141 documents. The chain is healthy; the tree has moved away from it. Contract item 3 asks that "the real program ELF admits the honest case at runtime limits"; the ELF that admitted it is not the ELF the tree builds, for all eight links. No C-row records this, and the register does not print it.

(b) The eighth program has never existed on any chain, and it is the one that carries three families. programs/dclutch-accelerator-sbf (General + Dealer + series-shadow folded, band 0xC, Dealer 0xC100, Series 0xC200) is a new link in the convergence's table. docs/reference/README.md:30-31 publishes "8 programs, 148 routes" and :37 says "The seven dClutch programs are deployed on Solana devnet" — both true, five lines apart, and nothing joins them. The accelerator live on devnet is 8pgnyNvg… at deployment slot 491,959,038 (read here), the pre-swarm general-accelerator ELF, pinned by programs/dclutch-registry-sbf/src/record_v1.rs:2127. Its routes in the register read program-test (accelerator/process_instruction) or blocked (accelerator/series::*, accelerator/set_return_data*). C-05, C-06 and C-07 now all depend on a program that has never been deployed.

(c) The never-executed count fell 40 → 32, and 100 % of the denominator's fall is deletion. docs/reference/routes.md:48 reads 2 of 148 unrecorded (from 0 of 163) and :57 now prints the honest second number itself — undriven 32 of 148 — adopting the first walk's own formula into the generated register. Tracked one at a time, 163 → 148 is: 16 routes deleted with their code (2418e6173 Claims' Core-effect route, 3ed848701 the Dealer scenario checkpoint chain ×7 and Custody's reservation route, cb9f0c1dc direct-aot, c9b41990f product-runtime-v2), 1 lost to an entrypoint merge (5b4fe2313), 2 genuinely new. Zero routes left the denominator because they were driven. Ten of the deleted routes were witnessed, and eight of those lost their only campaign in the same commit: 3ed848701 deleted tools/gauntlet/dealer-checkpoint/bindings.json and programs/dclutch-dealer-sbf/program-test/tests/accepted.rs (−9,965 lines, the 31-test accepted campaign) together. Of the −8 in the honest figure, 7 are pre-existing chain evidence finally being read and 1 is deletion.

(d) Every one of the twenty-three gate rows is a single draw, and nothing in the tree can tell a row that passed on one toss from one that passed five of five. The ledger records claims-lifecycle as nondeterministic since 2026-08-27 (4 of 8 draws at HEAD, 3 of 8 at the base) and says tools/gate suites runs each row once. Checked at the source: tools/gates/tiers.py:878 is one line with no repeat, no retry, no seed and no --test-threads; tools/gates/common.py:205-215 emits exactly PASS / NOT RUN / FAILED and attaches no draw count; grep -E 'retry|--test-threads|flaky' tools/gates/ returns zero. The suspected mechanism is not special to that row: solana-program-test-4.3.0-beta.2/src/lib.rs:1034 mints a fresh random payer keypair per run, and all 15 suites rows plus programs call start_with_context(). Two more rows turn on machine load (clippy's wall-clock backstop tiers.py:384-386; root-targets :760-762) and two on a live network (web liveness, witness). §6.

---

1. The matrix, row by row: evidence class second walk → today

class is the strongest evidence that exists today: devnet act, validator, real-ELF, kernel/fixture, nothing.

---

2. The ranked twenty, re-ranked

The second walk's verdicts, with today's. CLOSED = the thing asked for happened. MOVED = materially advanced, named residue. UNMOVED = the citation still resolves to the same defect. Items 1, 2 and 10 closed on the second walk and are not re-litigated.

---

3. The new gaps the swarm created

Ranked by what an assurance reviewer would do about them first.

N-1. The register's strongest evidence class attests to binaries the tree cannot produce, and no row says so. §0(a). 42 devnet-witnessed routes, 66 of 148 meeting contract item 5, all against ELFs built at 1cae26fd6 — before the swarm base 330bbfaba. The convergence's own table says every link moved and "cohort-16 carries every redeploy"; tools/cohort/cohorts/ holds 14 and 15. tools/gate witness re-checks the signatures against the chain and I ran it here — PASS, 4 documents, 78 route claims, 0 problems, 61 s — but what it proves is that the transactions happened, not that the program that ran them is the program the tree builds. Nothing in the tree compares a witness's release identity to HEAD's, so the register cannot distinguish "corroborated" from "corroborated against a superseded ELF". That distinction is the whole of contract item 3.

N-2. The corroborator has a discovery mode, a gate, and no habit. tools/gates/witness.py's docstring calls --discover "how a cohort is meant to reach the register, and it exists so that nobody authors a route claim". tier_witness (tools/gates/tiers.py:90-97) runs --check and nothing else. The last witness pass was 4c5ecb423, 2026-09-04 06:01. Since then cohort-15 addenda G and H landed acts on a public chain: harvesting the base58 signatures out of COHORT15_DEPLOYED_SEALED_FOUNDED_CAPTURED_2026_09_04.md and matching them against every docs/evidence/witnesses/*.json gives 26 signatures in the document and 6 in no witness file — 3rDH7V5X… (ResolutionCloseFund, the route the second walk's shortest path named), dfUtUcZs…, 5K5Tqf1N…, 2qrSV6jR…, UNQQiM29…, JGLMWwRM…. The second walk's N-3 was "a route executed on a public chain and no artifact in the tree names the transaction"; that half is fixed — all six are named in the evidence document. The other half recurred one rung out: the artifact names them and the register still cannot see them, and the tool that would fix it in twenty seconds is in no tier.

N-3. Three false sentences are hardcoded inside the generator of the generated register, so --check --converge will reach a fixpoint on them forever. The second walk's N-2 was "byte-identity is not cross-page consistency". It is not intra-page consistency either, because the generator is also an author:

• tools/genref/generate.mjs:1253 → docs/reference/route-witnesses.md:27, "Those five classes partition the 163", above a table on :21-25 that sums to 148.
• tools/genref/generate.mjs:668 → docs/reference/README.md:37, "The seven dClutch programs are deployed on Solana devnet", five lines under the derived line :30-31 that says "8 programs, 148 routes". Both sentences are true; nothing on the page joins them, and the reader is not told that the eighth program is the one three families now run on.
• tools/genref/generate.mjs:1647 → docs/reference/decisions.md:36-37, "The five pre-docket rulings (0019-0023) were not part of that reading and stay PROVISIONAL", two lines above the derived counter :39 "16 CONFIRMED, 0 PROVISIONAL, 0 OPEN" and twenty above the derived table :68-72 showing all five CONFIRMED at 2026-09-04 15:50 EDT.

A hand-written literal in a generator is a fact with two authors wearing a @generated — DO NOT EDIT header, and it is the one class the reference gate is structurally unable to catch.

N-4. Sixteen decision records cite one twenty-one-word sentence as their confirming act, and the tree's own generated index says it did not cover five of them. Every record 0019–0034 carries the same status line — "CONFIRMED (ember, 2026-09-04 15:50 EDT, in conversation; reversible on request)" — and the same quotation: "you aren't waiting on me for rulings are you? i was reading the docket and contemplating it, but overall find your takes reasonable." 856e7861f flipped 0019–0023 from PROVISIONAL to CONFIRMED on the ground that "the docket listed them as M1–M5"; docs/reference/decisions.md:37 says the opposite. This is ember's declared operating mode — rulings stand until reversed — and the records are honest that reversal is available at a stated cost. What a C-16 reviewer cannot do is say which propositions the sentence affirmed: two of the five (0021 adds a persisted wire field, 0023 moves every caller-authority address) are exactly what the contract's own register reserves for Ember as "genuinely new wire choices".

N-5. A structural block was falsified two minutes after it was written and survived two regenerations. blocked.json's rule is "delete it the moment its route executes". ad55bdb5d (21:37) added resolution/process_advance_recovery#AdvanceRecovery classed structural — the class the file defines as undrivable at HEAD — and cfa9088fb (21:39) added the ladder binding that drives it. It is the sole row in route-witnesses.md:186-201 and it passed through 3e142ade5 and 1761b7c26 untouched. The second walk's finding was eight stale blocks; seven were deleted and the mechanism that mints them was not.

N-6. The one C-00 subject the retirement did not rehome is the one the same swarm deleted. docs/OMISSION_INDEX.md:13-16 retires the fifteen U- rows on the ground that "their subjects are the contract's rows, which carry the evidence". Checked row by row: U-014, "Interpreted and stateless-AOT execution of one semantic descriptor", has no C-row — grep -in 'aot\|interpret' docs/MASTER_COMPLETION_CONTRACT.md returns zero. Its program was deleted in the same window (dclutch_direct_aot_sbf.so, "deleted link | never shipped", band 10 retired by theorem), and the only surviving statements of the ambition are docs/OMISSION_INDEX.md:24 (O-003, "may later run through") and :25 (O-004, classed likely scar — a class the contract's scope section says the accepted project still wants lifted). Implemented, ruled out, or a third state: it is the third, and its register was retired.

N-7. The browser's fixtures are one phase behind the market the project's scale repair exists to prove. apps/dclutch-web/fixtures/og-card-facts.devnet.json records market 3 C9dLhWj7… as "phase": "Open". Read here off devnet: phase @10 = 2, Terminal. cohort14-statistic-spec.devnet.json still names a closed cohort. The second walk's verdict on C-12 was "the pins are fine, the fixtures are not"; the pins were then broken and are now fixed and verified live, and the fixtures are exactly where they were.

N-18. A gate is red at HEAD because six of its rows name packages the fold removed. tools/gate root-targets exits 1: "the census and root-targets.tsv disagree about what exists." Six UNWIRED rows of the 134 in tools/gates/root-targets.tsv name dclutch-accelerator-program-test, dclutch-cli, dclutch-relayer, dclutch-ticket-board and dclutch-trading-program-test (×2) — packages the one-workspace fold removed or renamed — and the successor bootstrap has no row at all. Adjacently tools/gate journey --dry-run crashes with an uncaught JSONDecodeError at tools/gates/tiers.py:590, because :589 guards only on returncode and the dry-run stub returns empty stdout: the journey gate cannot be inspected without running it.

N-19. The seam register's declared provenance is 108 commits older than its own last write. tools/seam-audit/baseline.json declares measured_commit = d0219d449; its last edit is 6e34f1d21. A baseline that names a commit it was not written at is the baseline-goes-stale class the second walk named, inverted: not a baseline that has aged, but one that cannot say when it was taken.

---

4. The suite-verdict honesty table

docs/ledger/2026-09-05.md records claims-lifecycle as a coin flip since d6c4dea63 (2026-08-27) and says "tools/gate suites runs each row ONCE, so the tier verdict is a coin flip", and that "every one-toss row is void". Taken at its word, that is a statement about the whole gate. Read at the source:

All twenty-three tiers are single draws, and no row records that it is one. Verdict.record (tools/gates/common.py:205-215) emits exactly PASS, NOT RUN and FAILED; the only number a caller attaches is elapsed seconds (cli.py:66). grep -E 'retry|--test-threads|RUST_TEST_THREADS|flaky' tools/gates/ returns zero. No flaky-suite policy is written down anywhere in the tree — not in AGENTS.md, not in tools/gates/README.md. So a row that passed on one toss and a row that passed five of five render the identical string, which is AGENTS.md's own "distrust silent success" hazard applied to the instrument that is supposed to catch it. claims-lifecycle is not special: it is the only row anyone has measured over N draws, and the mechanism blamed for it is present in sixteen.

Four further honesty defects in the same instrument, each read from the code:

• set -e swallows rows in two suite runners. programs/dclutch-core-sbf/run-open-market-program-test.sh:21 sets set -euo pipefail and loops cargo test per discovered target at :64-72 with no guard — the first failing target voids the rest and the row reports one number, in a file whose own header is a treatise on targets going unrun. programs/dclutch-claims-sbf/program-test/fractional-atomic/run-program-test.sh:2 does the same over six sequential campaigns (:73,81,91,108,113,122). programs/dclutch-trading-sbf/program-test/run-postjoin-hostiles.sh:94-99 is the counter-example the others are not held to: it turns set -e off, runs every row, reports each, and voids every hostile verdict if the control fails.
• guards counts the selected set, not the executed set. A lean-emit guard with no --check script prints skip and continues (gates/emission.py:368-369) while the summary reports ran={len(selected)} (:416). "Failed" and "never ran" are distinct; "ran" and "was selected" are not.
• A devnet outage turns the web row green. If getHealth does not answer, the cohort-liveness gate is noted NEVER RAN (tiers.py:542), failed is not incremented, and the tier returns EXIT_PASS (:545). The tier's headline is "a shipped cohort that does not answer", and an unanswered cohort is exactly what makes it pass.
• emission early-returns, so a failing verify() means pins() and fixpoint() never run (gates/emission.py:395-402).

The dated-evidence consequence, and it is a live C-16 stale claim. AGENTS.md requires a reversed verdict to get an in-place dated addendum. docs/evidence/CLAIMS_LIFECYCLE_LAYOUT_WALL_2026_09_05.md:80 has one and is exemplary — "the verdict above is WITHDRAWN", the instrument named a coin, the surviving claims narrowed to three bullets. docs/evidence/SIMPLIFICATION_CONVERGENCE_2026_09_04.md has none: grep for addendum|withdraw|superseded|correction returns zero, and it still publishes :255 "tools/gate suites at 1ef14c5a1 — 11 of 15 green" (a one-toss-per-row figure stated as a verdict) and :289 "The red is the crates merge's" for the general row, an attribution its own lane retracted in the ledger the next morning after finding the author was 0c9811bc6's map_err sweep. The lane that knew wrote the correction into docs/ledger/2026-09-05.md:133-137 and not into the dated document a reviewer opens.

N-8. The commands gate does not scan the directory holding the tree's only operator runbook. tools/gates/commands.py:65 — DEFAULT_ROOTS = ("README.md", "docs/guides", "docs/operators"). docs/runbooks/ and tools/cohort/ are not in it, and tools/cohort/ is what AGENTS.md hands an operator. So commands PASS — the line docs/ledger/2026-09-05.md:48 publishes — is a statement about three directories, while docs/runbooks/COLD_MACHINE_2026_09_03.md tells a cold machine to run seven commands whose programs are absent at HEAD: :98, :99, :100 tools/cohort14/check-steps.py and preflight.sh (deleted — the second walk's N-17, closed by deletion, taking its own caller's citation with it), :203/:388 tools/release/private-validator-lifecycle/run.py, :736 test_preflight.py, :739 tools/ci/run.sh release. Closing a parallel-authority finding by deleting the loser is only half the sweep.

N-9. Deleted units are named by 95 surviving files, and one of them is a gate's own printed remedy. 65 distinct deleted things are cited at HEAD. The sharpest: tools/gates/tiers.py:576 tells an operator whose ABI gate failed to run packages/dclutch-sdk/scripts/sync-from-web.mjs --copy --only, deleted in this window — a failing gate prints a repair that cannot be executed. tools/release/public_route_campaign.py:59 and successor_campaign_pack.py:865,1182 pack tools/local-validator/bootstrap/successor/Cargo.lock as release evidence; the one-workspace fold deleted that lock. tools/ci/run.sh is named by 14 live files including tools/gates/root-targets.tsv:7 and clippy-debt.tsv:7; tools/genref/generate.sh is still named as the byte-gate by five generators; tools/release/private-validator-lifecycle/run.py is named by 9, including two fixtures that cite it as the authority that produced them (tools/economic-lifecycle-ledger/fixtures/private-canonical.json:8, multiwallet-20-seeds.json:4). crates/dclutch-source/src/pyth/devnet.rs:11 cites deleted tools/release/devnet-observe.sh as the provenance of a chain-derived measurement. Running AGENTS.md's sweep rule backwards — Rust and fixtures naming deleted browser files — finds nine more.

N-10. The crates merge turned a cross-crate magic-name collision into an intra-crate one, and the census still cannot read either. crates/dclutch-vm/src/account_profile/lifecycle_v3.rs:52 and v2.rs:77 both export pub const MAGIC, one DCLTDP03 and one DCLTAP02, in one crate. tools/gauntlet/census/src/magics.rs:149-170 accepts a byte-string or an array of integer literals and skips anything "computed, negative or referential"; both are referential, so inventory --check-unique prints "0 constant names bound to more than one magic" and the reference reports 0 exported name collisions. Credit where due: the second walk's other pair (STATE_MAGIC = DCLTCOR3 / DCES) did resolve — only crates/dclutch-market/src/generated.rs:30 survives — and the three byte-value collisions at HEAD are all adjudicated in tools/gauntlet/magic-collisions.json with argued verdicts.

N-11. One rename shim lets 222 references in 71 files read a type under a second public name. crates/dclutch-custody/src/lib.rs:41 — pub use dclutch_registry::release_set::ExecutionRoleV1 as CallerRoleV1;, added by 3203a23dd. The owner spells it ExecutionRoleV1; thirty program sources and four successor modules spell it CallerRoleV1. It is the only rename among the six cross-crate pub uses at HEAD (the other five are a genuine shared vocabulary), which is why it is worth naming: the merge swept the paths and this one reader survived by being given a second name for the fact.

N-12. Seven live browser ABI surfaces lost their reference page and the README says the register still covers them. The window deleted eight docs/reference/abi/*.md. Seven of the deleted pages' modules still ship under apps/dclutch-web/lib/generated/ with live abi:*:verify scripts and 1–5 importers each (capabilitySurfaceV1, sbfRuntimeV1, partitionQualityWasmV1, productPayoffV2WasmV1, userPositionAdmissionWasmV1, walletTerminalInputWasmV1, walletTerminalPayoutWasmV1), and none has an SDK twin. Each still has a producer, so this is not the mirror-becomes-authority failure — it is the register shrinking by seven surfaces while the surfaces stayed live, with docs/reference/abi/README.md:5 declaring its sources to be the SDK's generated directory only.

N-13. GOAL.md, the index, publishes a crate count no other author agrees with. GOAL.md:98 says "crates 94 → 46"; SIMPLIFICATION_CONVERGENCE_2026_09_04.md:138 says "94 → 33"; measured at HEAD, 33 directories under crates/ carry a Cargo.toml. The file's own preamble says it is "an index, not a store" and that "nothing below is a fact's only home" — and it is the only home of that 46. Adjacently: ten SIMPLIFY_*.md lane briefs plus WAVE.md and BROWSERTASK.md are still tracked at the repository root after their merges landed, and three of them are among the 95 files citing deleted paths.

N-14. Decision-record citation damage is now a measured 18.5 %, and three cited commits do not exist. Across docs/decisions/*.md: 604 full-path citations, 112 dangling, 14 of them killed by this window; 253 sha citations with three real dangling commits — 01a00a3d (0014:59), ace5d24e9 (0030:194) and b31b35a21 (0031:87,134,255). The newest CONFIRMED band is not spared: 0024:58,252,60 name crates/dclutch-direct-aot-v3-contract/src/lib.rs and tools/gauntlet/direct/expectations.json, both deleted here; 0028:311 names deleted apps/dclutch-web/lib/generalPlanV5.ts. Two file:line citations point past EOF into the same 13×-shrunk file: 0021:178 → hot_v3.rs:6409 and 0023:154 → :14231, where hot_v3.rs is 1,077 lines. The second walk's N-22 was about line numbers rotting within hours; at HEAD it has reached whole commits, in records the tree calls CONFIRMED. A confirmed ruling whose evidence path does not resolve is an unfalsifiable ruling.

N-15. docs/decisions/0011's amendment landed beside the wrong claim rather than on it. The second walk recorded an amendment owed to §3b. It exists — :614 "3e. CORRECTION: the campaign ran, and it moved two of §3b's numbers", :639 "cap at K = 2 on a cluster" — and §3b was not touched: :329 still heads "The executable ceiling is K = 3, it is hard", :345 still says K = 4 is refused with 8 bytes to spare at K = 3, and :750 still tells the next encoder-writer it caps at K = 3. Two spellings at the baseline, two today; the reader who arrives at §3b has no forward pointer.

N-16. An orphaned frame runner builds two manifests that no longer exist. programs/dclutch-trading-sbf/program-test/run-program-test.sh:41-44,95 cargo build-sbf --manifest-path over programs/dclutch-dealer-accelerator-sbf/Cargo.toml and programs/dclutch-general-accelerator-sbf/Cargo.toml, both deleted. tools/gates/tiers.py:852-853 re-pointed the dealer and general suite rows at the folded accelerator and nothing names this script, so it is an orphan that would exit 1 on its own frame-overwrite refusal path. Whether the trading link's frame check was absorbed or silently dropped is not settled by reading; if dropped, a refusal was lost, not a file.

N-17. ls programs/ reports the pre-swarm geometry. git ls-files programs/ returns 8 program directories; ls programs/ returns 12. programs/{dclutch-dealer-accelerator-sbf, dclutch-general-accelerator-sbf, dclutch-dealer-sbf, dclutch-series-shadow-sbf} and crates/{dclutch-token-svm, dclutch-fractional-cubic-life-evidence} hold zero tracked files each — build residue shaped like a live unit. Recorded because it caught me: any reviewer or agent orienting with ls measures the tree the swarm deleted.

---

5. The six categories, second walk → today, and what the swarm did to each

Every count below was re-derived. Where a number moved because the instrument or the denominator changed rather than the tree, it says so; where it fell because something was deleted, it says that too.

5.1 The ranked rows §2 could not settle before the categories were measured

Two corrections owed to the second walk, both found by re-deriving rather than by reading, and both false at their own commit. (a) "The tree has zero hits for send_and_confirm_transaction, RpcClient::send_transaction — the CLI cannot submit and neither can anything else in it": at 08fe86470 there were three (tools/fractional-exterior/src/claim_check.rs:908, validator.rs:262, :458), plus tools/relayer calling rpc.send_transaction; and packages/dclutch-cli could submit at both revs — src/internal/rpcSubmission.ts was a hand-rolled fetch POST of sendTransaction then and is client.sendRawTransaction(...) at :49 now, reached from commands/redeem.ts:22. The walk grepped one of the two CLIs and generalized. (b) "DCLRFCQ1 is counted reachable with zero builders anywhere": a WASM builder existed at 08fe86470 and still does — plan_source_close_fund_v1 → crates/dclutch-source/src/resolution/funding_lifecycle_v1.rs:301, consumed at apps/dclutch-web/lib/sourceCloseFundV1.ts:274-281. The §4.1 overclaim charge survives in the direction the walk named first, and dies in the direction it named second.

And one the second walk got right that this one can now state exactly. packages/dclutch-sdk/lib/capabilityAccess.ts publishes no number at HEAD — :18-21 says so, in as many words: "a live count typed into prose is the rehearsal's defect one layer up." apps/dclutch-web/lib/capabilityAccess.test.ts and capabilityRouteDerivation.test.ts are green, 44 tests, run here scoped. The red closed by deleting the literal and asserting four invariants instead, which is the right repair. Two of the three §4.1 defects are unchanged: the sentence at capabilityAccess.ts:141 still ends "…are not reachable from any client at all" over an inaccessible defined at :131 as rows.length − act-declared; and the unsound Registry answer is still green — capabilityRouteDerivation.test.ts:189-206 asserts compileRegistryRoleActivationTransaction reaches registry/record_v1::dispatch while releaseRegistry.ts:672 calls registryInstruction(0, role) writing bytes[10] = 0 into 16 bytes, and programs/dclutch-registry-sbf/src/lib.rs:288-296 needs data[10] >= 2 or len != 16 — both false, so the bytes fall through to a route routeCensus.ts:552 itself lists as unnameable.

5.2 The producer-missing roster: four open, four still blocking a dispatched route, zero closed by deleting a reader

The second walk's sharpest structural worry was that instances were closing by deleting the reader rather than by writing a producer, and that the roster should not blur them. Re-located at HEAD — every path moved — the swarm closed none of the four, by either means:

The two Series producers still sit in the same family with no caller between them, so C-07's whole occurrence path remains a finished machine with no starter — and now the reader says so in its own source.

A third correction owed to the second walk. It reported the detector reader_booleans_without_a_computing_producer_v1 as having "all four tests pass, each with its own red control". There are two, at tools/local-validator/bootstrap/successor/src/campaign.rs:7163 and :7185, one of which is the red control — and there were two at identical lines at 08fe86470, so this is a baseline overstatement, not a swarm regression. What the second walk got right holds: the detector still runs, through tools/gates/tiers.py's tier_journey invoking the same cargo test --bins the deleted tools/ci/run.sh:1128 invoked, reaching it because tools/gauntlet/journey/src/main.rs:42-44 #[path]-links the campaign in. Its blind spot is unchanged: bool fields in the successor's own src/, so every instance in the table above is invisible to it.

---

6. Is C-16 met?

No — and for the first time the answer is "no" for a reason that is one devnet act rather than a list. The day's work was real and large. The contract's only precondition on a person is discharged: D1, D2, D4, D5, D6, D7 and D8 all have decision records, 0024 carries the adversarial economics modelling C-11 demanded, and the one item still genuinely ember's is 0029's tenth. The seam gate is green with AUTHORITY 0. The two register pages agree on all 148 routes. The DCLTCRQ2 blindness that made the protocol's most-driven program invisible to its own witness channel is closed, and corroboration is now a gate I ran here against the chain — PASS, 4 documents, 0 problems. The browser's deployment table pins the live cohort and its generator refuses a vacant role. Fifty-eight confirmed stale claims became sixteen. Fifty-five workspaces became one and no program byte moved. The cross-host reproducibility counterexample that cost C-14 its standing is closed by narrowing supported_builders to a named builder artifact.

Against that, every one of C-16's six categories is still non-empty, and the swarm's arithmetic has to be read carefully in three of them: the never-executed denominator fell entirely by deletion, the reachability denominator fell by deleting seven magics that were already unreachable, and the stale-claim roster fell partly by deleting the rows that recorded the staleness — including all fifteen U- rows, whose retirement note claims the contract's C-rows carry their subjects and is false for U-014, the one whose implementation the same swarm deleted.

And the swarm created a class of gap the project has not had before. Every ELF moved. The register's 42 devnet witnesses — its strongest evidence, and most of the 66 of 148 that meet contract item 5 — corroborate transactions run by binaries built at 1cae26fd6, before the swarm base. Cohort-16 has no manifest. The eighth program, the folded accelerator that General, Dealer and Series now all run on, has never been deployed anywhere. The tree is in the best shape it has been in and it is further from a chain than it was yesterday. Nothing in the register says so, because nothing compares a witness's release identity to HEAD's.

The sharpest way to say where completion stands is still with one market, and the sentence changed. Cohort-15 market 3 C9dLhWj7… reached Terminal — read here off devnet, phase @10 = 2 — and ResolutionCloseFund executed at 252,368 CU against a prediction exact to the unit. Market 1 3QytL1bB… is at phase 3 Retiring with outstanding_capabilities = 1, and its wall is no longer a compute budget or a coarse code: DirectCloseCapability refuses because the market's own capability manifest declares no dependency edges at all, which is a founding input frozen at founding, and stage four would refuse anyway on a Resolution ledger stage three consumed, an order TerminalStageV1::ORDERED pins. The last two walls between this project and its first Retired market are a re-founding and a stage-ownership decision, and the re-founding needs cohort-16. Seven markets across the two live Core programs: phases 0×4, 1×1, 2×1, 3×1, and none at 4.

Six design notes and roughly two hundred sorry-free theorems landed in the same window (0031–0034; batch spine, joint clearing, scoring Dealer, ensemble, founder bond, conditional markets). No program byte moved for any of them, and all six are CONFIRMED as wanted. They close no C-row and they enlarge the accepted project, which is a ruled choice and worth naming while C-16 is trying to close.

The shortest honest path

Not a work plan — the smallest set whose absence is what makes the answer "no". It is still six items. Three of the second walk's six closed; three of today's are new, and two of the six are now downstream of the first.

1. Deploy cohort-16. New, and the largest single unblocker in the tree. It is what makes the register's evidence current again (N-1), what puts the folded accelerator on a chain for the first time (§0b), what C-05's OpenBatch, C-06's first Dealer market and C-07's entire family are waiting on, what the contract's derivation_policy row means by "no lane may start it without a cohort that carries it", and what item 2 needs. The runbook is ready — tools/cohort/steps.tsv carries accelerator-release and every general_accelerator field, tools/cohort14/ and tools/cohort15/ are gone, and the deploy authorization is standing.
2. One market from Open to Retired on a public chain. Advanced two rungs and lengthened: it now needs a founding that declares dependency edges (so, cohort-16) and a decision about which terminal stage owns the Resolution ledger's lamports. Both are named; neither is a search.
3. Make a cohort landing turn something red. Three instruments exist and none is habitual: derive-deployment-manifest.mjs re-pins the client and is in no tier, no gate and no steps.tsv row; tools/gate witness --discover is "how a cohort is meant to reach the register" and tier_witness runs only --check, so six finalized cohort-15 signatures sit in an evidence document and in no witness file; and nothing compares a witness's release identity to HEAD's. The repair is the gate, not the edit — the second walk said this about the client pin, the edit was made, and the gate was not.
4. Wire one citation tripwire and pay the swarm's citation debt. doc-citations --check exits 1 with 27 dangling and is in none of the 23 tiers; it cannot see docs/ at all, where 592 of 1,451 cited paths dangle in live documents, 315 killed by this window. docs/decisions/ alone carries 112 dangling paths of 604 (18.5 %) and three cited commits that do not exist, in records the tree calls CONFIRMED. A confirmed ruling whose evidence path does not resolve is an unfalsifiable ruling.
5. Give the gate a draw count and a flaky-suite policy. All twenty-three tiers are single draws; Verdict.record cannot express "passed 5 of 5"; two rows turn on machine load and two on a live network; a devnet outage turns the web row green; two suite runners abort their remaining rows under set -e. The ledger's own "every one-toss row is void" is a statement about the whole instrument, and docs/evidence/SIMPLIFICATION_CONVERGENCE_2026_09_04.md still publishes an uncorrected one-toss verdict and an attribution its own lane retracted, with no addendum.
6. Build C-11. The row that could not close by any amount of engineering can now close by nothing else: five knobs ruled and confirmed, a governable parameter surface designed, and UpkeepVault with zero hits in crates/ or programs/. The wall stopped being a person and became a lane nobody has started.

Closed since the second walk: its item 1 (the D1/D4/D5 rulings), its item 6 (supported_builders), and the register-reconciliation two-thirds of its item 2. None of today's six is a research question, and items 2 and 3 both wait on item 1.

---

7. What a reviewer should distrust in this file

• Three of the second walk's claims are false at their own commit, and I found them by re-deriving rather than by reading: the CLI's "zero hits for send_and_confirm_transaction" (three existed, and packages/dclutch-cli could submit at both revs); DCLRFCQ1 "counted reachable with zero builders anywhere" (a WASM builder existed then and now); and the producer-missing detector's "four tests" (two, at both revs, one of them the red control). Assume the same rate here for anything I did not re-derive twice.
• Two of my six category counts moved because the DENOMINATOR moved, not the tree, and both are labelled: never-executed (163 → 148, entirely by deletion) and reachability (85 → 81, seven of the departing magics already 0/0/0). A smaller number is not automatically progress, and in this window it is usually a deletion. The stale-claim fall, 58 → 16, is the reverse case and should be read the other way: most of it is genuine repair, and the OMISSION_INDEX share of it is the removal of the rows that recorded the problem.
• My reachability, economic-channel and authority-proxy figures come from matchers I wrote and ran at both revs, not from the baseline's matchers, which were never committed. Where my absolute number disagrees with the second walk's (strict 12/13 against its 14; sites 43 against its 48; proxies 208/175 against its 42/367) the delta under one instrument is the measurement and the level is not comparable. The second walk said this about its own numbers and it is still true.
• HEAD moved four times under this walk. Every figure here is pinned at 873a43914; the tree reached 16e79dfaf and then 66c425726 while the lanes ran. Two of those commits repair reds this file would otherwise have reported: 9fe4506f2 cleared the guards clippy red over the merged dclutch-trading, and 311797cc3 fixed walk.ts's book-field typecheck. Both are recorded as fixed, at commits later than my pin.
• The chain reads are the strongest evidence here and the narrowest. Every account and signature was read from devnet at finalized commitment through getAccountInfo / getProgramAccounts / getSignaturesForAddress at slot 493,609,778. Seven markets on two Core programs is not a proof about markets, and a finalized signature says a transaction landed, not which branch ran. tools/gate witness PASSing says the transactions are what the documents say they are; it says nothing about whether the program that ran them is HEAD's.
• ls lies in this tree. ls programs/ shows twelve directories and git ls-files eight; two crates/ entries are the same. I caught myself measuring the pre-swarm geometry once. Print git ls-files, not ls.
• The unadjudicated surfaces are still the honest frontier and this walk did not shrink them: the 121 authority candidates (0 adjudicated for a third day, instrument still uncommitted), the four open producer-missing instances, the 592 dangling path citations in live documents, and the ~68 selectors whose "no client builder" is an upper bound on absence rather than a proof of it.
• This file will be stale in one respect the moment it lands. docs/MASTER_COMPLETION_CONTRACT.md:75-77 names the hostile walks of the matrix as the 09-03 and 09-04 files. It is a two-line edit and it is not mine to make; it is owed, and it is the same recurrence this file records four times over.