COHORT-17 — THE FIRST REFUNDING MARKET THAT COULD BE FILLED

Devnet evidence. Not mainnet evidence. Written by lane COHORT-17, 2026-09-06. Dated and not edited; a reversed verdict gets an in-place, dated addendum.

Cohort-17 exists to carry four links that cohort-16.1 could not: the closure burn (7d45d6ba3), the retirement tail (42c3bb931), the General account profile's liability basis (1dd18be91) and the profile checkpoints (fc39a5bc7). The question it answers is the one cohort-16.1 could not reach: can a market founded REFUNDING be traded, settled and retired at all.

What this document reports, in one line each:

• the candidate reproduces from two roots on the named builder, and cohort-17 is four links and not the three the ledger says;
• the founding SEATS the failure column in the market's own escrow, and the census reads L3 HOLDING where cohort-16.1 read it VIOLATED;
• the fill is CERTIFIED, which cohort-16.1's could not be, and the escrow is why;
• the General market's basis wall is CLEARED and a later one is named;
• the runbook had ten defects that only running it could find, and each is repaired in the runbook rather than worked around in a lane.

1. THE CANDIDATE, AND THE FOURTH LINK NOBODY COUNTED

deploy commit 932edc83fc5a108fa362be216c84a3b0f78f29b4 driver commit 5a0d022e2 (record-core-digest), detached worktree, debug, CARGO_TARGET_DIR = the live tree's target/ sha256 0a497c4eaf39dfc0056b60a558386819956895e33c212778a249786f7160de96 builder hbox through swarm-build, platform-tools v1.53 on Linux/x86_64, node v26.4.0, SWARM_MEM_MAX=32G reproduction two repository roots (/tank/dclutch-c17/repoA, repoB) and two --work roots on that host release gate a98ed988f9d266084b3835dc5f838a03c8513810669395373960d58ce7df6be3 EQUAL from both roots; all eight ELFs byte-identical (cmp) diagnostics sbf_build_diagnostics_total=0 in both summaries; sbf_build_freshness=passed, links=8; release_builder=true

Cohort-17 is FOUR links, not three. docs/ledger/2026-09-05.md and the frames ratchet both say three -- trading, claims, core -- and the accelerator moved too, between cohort-16.1's candidate 87eec1c3a and this one. PROGRAMS-17F measured d2ff2b87… at both 1dd18be91 and bded4c038, so the move is at or before 1dd18be91 and is not the basis-rule commit; which commit moved it was not bisected, because a bisect costs a build and the count is the fact that matters. It changes nothing about the deploy -- a genesis cohort deploys eight fresh identities regardless -- and it changes what a reader is told the cohort is.

The two runs' CHECKED_UPGRADE_GATE and SUCCESSOR_CAMPAIGN_PACK digests are NOT equal (6569364c…/45a7c982… against d585477c…/642637ca…); the reproducible release gate and every artifact are. Only the latter is this row's verifier, and the difference is not investigated here.

2. THE FOUNDING WAS LAUNCHED TWICE BEFORE IT RAN, AND BOTH ABORTS WERE RIGHT

Neither abort touched a chain. The founding frame has no suffix resume, so the only safe place to stop one is BEFORE the frame starts -- and both stops were in cargo build, with the price-update file the only thing on disk.

Abort 1: the driver was building under the wrong toolchain. The stage script 13-found-direct-1.sh shells into tools/release/stage-devnet-sponsored-market-open.sh, which builds the successor driver with

cargo build --locked --manifest-path "$BOOT/Cargo.toml"

--manifest-path does not move cargo. rustup resolves rust-toolchain.toml from the current working directory, and this lane's shell had its cwd reset to a sibling checkout that pins nightly. So $REPO's driver compiled under nightly-aarch64-apple-darwin while /Users/ember/dev/dclutch pins 1.97.1, from a cold target directory, and NOTHING SAID SO: the log is a wall of Compiling lines either way. The only tell was the toolchain path in ps.

Repaired at both build sites: ( cd "$REPO" && cargo build ... ). The toolchain is a property of the repository being built and of nothing else. The generator carries the same guard one level up -- every emitted stage now cd "$HERE" before it does anything -- as defence against the class, not as a second author.

The cost was not only the forty minutes. target/ is shared by every lane in this tree, and a nightly excursion through it invalidates the 1.97.1 fingerprints, so the next lane to build paid a cold rebuild too.

Abort 2: the window lead is anchored at LAUNCH, not at the founding. --window-start $(( $(date -u +%s) + 2400 )) is evaluated when the stage script starts. A build queued behind another lane's cold rebuild therefore spends the market's whole 2,400-second lead before the founding frame opens, and the market would be founded with its capture window already open -- with activate, checked-execution-release, arm-relay, sim-config, admissions, fill and fee-settlement still to run inside a 1,800-second window. The relaunch was held until the driver was already built.

3. THE REFUNDING DIRECT MARKET, AND THE SEATING THAT MADE IT TRADEABLE

Open Market (founding_market) 9e8fTH75s82pjcEK8pY8PaLPoZW6W1am1qQ6J4JHjagQ Found31 Market (market) 7yaJUoUk8qjzPUMVeehs3owsmdfHy6Ud2nyJNNMruEYt generation 2 collateral mint 3FdkfVoG1C3khoDpXpDsfC7czTPrR9NbVegHTNuJ7Bfd Hoard vault DzPa65EueTKcG1CBjowDH6rE8jWzDpivfzVXsDEX9e2o Claims aggregate EMgGTUGsmdvvvve7pLhDrWxaYGqjkLUEqzXA51R1ndPv founder Position 8txUquS8iyLWBUpzCmYsH2fPkST7L22wwCT4JjArs5Xo FAILURE ESCROW Position 8HLLen86V9Vy7NXQYHxP1hGEm4FT99av6WWsagm2FbNA claims admission GiPm7k4F6uf4JB9rA6yeAiYGbzGmkj5KiEDJ4iZ8mGhg linked liability basis Cv9t9a7tJV5Fm3d1rderPnyAKFXmyRf2CGepCvkSM7Rz capability manifest record DUfiXKPgVboiRudPH1wwYPSZ9XkACtNAQ9zpKkzWSFXn window spec record AxQF2E338bv7wr1UFjySQzVskWEAXFRB5KgjV1jmvs6N frozen DCLTGMF3 routing table DMcjvbaftXzqdoHY8GHJg4Qvf6h7TjeKaeYm5vogMqa9 selected manifest entry index 0 window 09:04:55Z to 09:34:55Z (2,400 s lead, 1,800 s wide)

The compiler's own founding terms, quoted verbatim from its stderr:

founding-reserve-terms-v1: reserve 1000000002 atoms; founding budget 500000001 atoms (the lower half); basis width 4; derived payout scale 3; complete sets 166666667 = budget / scale, exact; reserve provenance derived: the smallest reserve at or above the intended 1000000000 atoms whose budget this scale divides exactly

Payout scale 3 against basis width 4 is categorical_refunds_on_failure_v3: this is a REFUNDING market, the shape no market had ever traded past.

THE SEATING, READ OFF CHAIN

escrow-seated, which is ledger-census at the founding boundary:

L1 holds tracked 1000000002 atoms across 3 accounts == Mint supply 1000000002 L3 holds 4 Positions sum to the aggregate supply vector [166666667 x4] L4 holds Hoard 500000001 >= worst outcome 166666667 x unit 1

failure-escrow [0, 0, 0, 166666667] founder [166666667, 166666667, 166666667, 0] participant-1 [0, 0, 0, 0] participant-2 [0, 0, 0, 0]

The escrow holds the WHOLE failure column and the founder was issued NO failure claim. That is decision 0025 item 2, on a chain, for the first time. Cohort-16.1 founded the same shape and read

VIOLATED L3: Positions sum to [166666667, 166666667, 166666667, 0] but the aggregate owes [166666667 x4]

and could not fill, could not retire, and could not be repaired.

THE SPINE, WITH ITS SIGNATURES AND ITS COMPUTE

THE FILL IS CERTIFIED, AND THAT IS THE POINT. Cohort-16.1's Hot transaction LANDED and its driver then refused

REFUSED: Direct terminal claim schedule is not the exact K+1 partition

because direct_claim_balances_v1 collects only NONZERO balances and the seller could not contribute a fourth row it never held: seller 3 + buyer 1 = 4, against the required outcome_count + 1 = 5. The escrow is the fifth row. Cohort-17's direct-trade-finalized.json reads status: finalized, and the post-fill census reads

L1 holds tracked 1000000002 atoms across 5 accounts == Mint supply 1000000002 L3 holds 4 Positions sum to the aggregate supply vector

with the claims moved (founder [166666667, 166666467, 166666667, 0], participant-2 [0, 200, 0, 0]) and the collateral split 199 to the seller's destination DqRro8k3HcoJmbCMitfX7yLigMJpaGe9u27URd695rxN and 2 to the venue fee account 8NayUmLgEAa19LcCMGShcfT1BBMB7PQH75Ne1Bj2GjwT.

The relay capture needed eight tries and SEVEN OF THEM WERE THE LANE'S OWN FAULT. devnet-sponsored-push-v1 is plan-then-sign ON ONE OUTPUT PATH: the first --execute writes a key-free planned report and refuses, and the sign must follow it back to back because the candidate PDA is seeded by the live publish_time. The EMITTED STAGE SCRIPT DOES EXACTLY THAT, and says so in a comment it carries. This lane did not run the emitted stage -- the blocks chain puts census in front of relay-capture, and the census could not be green until the fill, which is not what the chain requires -- so it hand-rolled a loop that used a fresh path per attempt and planned six times without ever signing. The seventh, signing a plan made five minutes earlier, drew a real refusal from the deployed Resolution program:

custom program error 0x8015 = ResolutionSbfError::SponsoredPush "Sponsored-push candidate, head, release, or deadline authentication failed" 89,993 of 1,399,700 units, no CPI

The eighth was a plan and a sign back to back and landed on the first send. The runbook was right and the hand-run was wrong, and the only real finding here is that 0x8015 is what a stale plan looks like -- a code coarse over four causes by its own doc comment.

A blocks edge that is not a chain constraint costs a window. census blocks relay-capture in the runbook, but the capture is bound by the market's own window and nothing else; cohort-16.1 fired its capture BEFORE its admissions and its fill, in that order, and was right to. Left as a finding rather than edited under a running clock.

4. THE RETIREMENT: BEGINRETIRING EXECUTED, AND ONE HOST GUARD STANDS BETWEEN IT AND RETIRED

Cohort-16.1 could not reach BeginRetiring at all. Cohort-17 executed it, and then the closure of the funds behind it, and stopped one stage short of Retired.

Payouts that emptied the market first:

The census at the retiring boundary, read off chain:

L1 holds tracked 1000000002 atoms across 5 accounts == Mint supply L3 holds 4 Positions sum to the aggregate supply vector [0, 0, 0, 166666667] L4 inapplicable the Market is retiring: settlement DISCHARGED the liability this law is stated about Hoard 0 aggregate [0, 0, 0, 166666667] failure escrow [0, 0, 0, 166666667], still open

The three ordinary columns are gone and the Hoard is empty. What remains is exactly the column decision 0025 says the CLOSURE burns, and the closure has not run because the stage before it has not.

THE WALL, LOCATED TO ONE CONJUNCT ON ONE LINE

Error: Direct close caller preflight: Successor(MakerRootCountInvariant)

require_closable (crates/dclutch-trading/src/successor.rs:706) is one discriminant over two conjuncts, and the failing one is measurable: the Direct capability root 3dgyRvrebvaXKL8Z1hqgYMWRewXXsgxBjbseERjep3xK reads, at its own bytes,

DCLTDRT1 ... open_maker_root_count = 2

The fill opened two maker replay roots and both are live: 59rvxdSf4vzfin1pdh VidvDHEZSAAgURhaPo8GNkNZRu (seller) and VnQRqKSg3uHnQj8VdoqEX3vVv6PiwiRvMGJ UGvM15kw (buyer), 160 bytes each, owned by Trading.

The producer for closing them EXISTS -- devnet-direct-close-maker-v1, "closes one Direct maker replay inside Retiring: wall 22's missing decrement" -- and the runbook has no row that calls it. That is the producer-missing pattern, in the runbook rather than in the tree.

And when it is called by hand it refuses, and the refusal is a host defect:

REFUSED: embedded Direct Hot journal lookup closure was not exact, ordered, and distinct

That message is one sentence over three conjuncts (tools/local-validator/bootstrap/successor/src/direct_trade.rs:5757-5765), and the failing one is the FIRST:

lookup_keys.iter().any(|key| *key == Pubkey::default())

Pubkey::default() is thirty-two zero bytes, which is the System program. The Hot frame's frozen lookup table H2QMjhby88h4mGAovFX8rwS3BJcgUXTMEnEfMAVLexox holds 57 addresses and its index 36 is 11111111111111111111111111111111 -- read off the chain, not off the journal -- because Trading CPIs System to create accounts and the table must name it. The journal reproduces the table exactly (all 57 distinct, index 36 identical to the on-chain word), so the list is neither inexact nor indistinct: the guard is reading a legitimate System-program entry as an unset slot.

The list's authentication is the third conjunct, pubkey_list_sha256(&lookup_keys) != journal.lookup_addresses_sha256, and a genuinely unset slot cannot survive it. NO CHANGE WAS MADE. This is a ruling for the owner: whether the default-key conjunct is redundant against the hash it sits beside.

What that costs: open_maker_root_count stays 2, require_closable refuses, DirectCloseCapability cannot run, and the four retirement packets and the closure's burn are unreachable. The market 9e8fTH75s82pjcEK8pY8PaLPoZW6W1am1qQ6J4JHjagQ sits in Retiring with an empty Hoard, three discharged columns, and its failure column seated exactly where decision 0025 puts it.

No market has been retired on any chain, and this cohort says so. What moved is that the wall is no longer the founding's seating, no longer the manifest's dependency edges, no longer BeginRetiring, and no longer ResolutionCloseFund -- all four of those are behind it now.

5. THE GENERAL MARKET: WALL 3 IS CLEARED AND WALL 4 IS NAMED

Open Market (founding_market) E5jHZvCPLJ2K22dayGuJM9MzDZhKS5FGPqz45cJ3HabY Found31 Market (market) CJVARrAjDvv45GnExJfRKn2LdGCyNXFVqRr1GdaNg7Ne generation 2 collateral mint 7AGbrfnU5SrFfi1qoR1JgV2BRad7hQbotqT9yX2R7keX Claims aggregate ARCw6w3UoWvkE1KBjDaxxLm4x3huH4Um56aSsTZSQHPC founder Position 7Ey7qTAjv7LZBMNEbgEuBvsQH7NCRo5gX7iUDvcCe3ei result domain record GzaQibVTxLVcdaHD2nRb4uhQHgMvn7iARwHFo4Kcyk5V portfolio record A87J263uYDcMhY1bjEDHRLTjbdAnjFNKGcG294x4T9w2 linked liability basis record DRETjpnLtT4eYrRz8GS8DghkQJVW2MEiCsPaFo2yz7C5 rent credit 2oaNBEctfWKwgPFc9fHueBN3YY7gLqohbqn62rNCUNC2 founding frozen table 4jZvzXdtbS12sCwA9bHdYD57LQDTiJKgzmTt5YUdbqJq (DERIVED) founding 547 transactions, completed true activation 484,523 CU (cohort-16.1's 520,541) capability seal 3AryF51KGHt6BLTxBzA58A1tCZM1w4PAmf8C2gY5dPAn 2dUc4EkP2L6JjTVE2GdfjPEagTwZJkW2XSuZXj7QjfEgx2wvXMiWDGNDLUu73SRKSnqv6G2XdEqcmvvwRJ5QAu1R slot 494,024,322, 622,058 CU, action 7, frozen table 3Q1dJ8JCpBajEUSq4M4iPouD5nAMgEXk7Fm1XnBsECpG

The General inputs are this cohort's own: compiler-release.txt and toolchain.txt authored for accelerator WMGVfhVu… / d2ff2b87…, a fresh 134-byte price-update.bin, and a translation-validation manifest RE-MINTED from a real check.sh run against this tree, 976e535fa1bb34e0b9eed997f6f655e904e783ebeb4723e6f71195281742e267, whose whole evidence directory is archived at candidate/translation-evidence/ so the next cohort does not lose what cohort-15 lost.

THE OPENBATCH REFUSAL, AND WHY IT IS PROGRESS

openbatch-frozen-tables ran both passes and both frozen tables. The route compiled, the plan produced, the execution simulated at 361,934 units and devnet's preflight refused the send, so nothing landed and no fee was paid.

outer 272BExJXWc7FSFh5PLps6DBWVWqoggmskoPbfbp21VNd (Trading) custom program error 0x4004 = TradingSbfError::Transition, Custom(16388) consumed 361,626 of 1,399,700 inner WMGVfhVuWuMRCkBDnR7nrqj6uY1XbnxQtShxdM4h7km (the accelerator) consumed 31,797 of 1,071,478 -- INVOKED, and it answered log: general-candidate: refused, a record did not decode log: general: refused, candidate projection receipt DCLTAAK2, 144 bytes, generation 2 4e39c194c5f2cf420805a21cacf648b7458c831f18101ad2d6224394961ca32f aa89ce45d8707c686380aafbbe119014a589e62d6eabe95d4a036c59e171d99b

COHORT-16.1's WALL 3 IS GONE. Its refusal was GeneralAcceleratorSemanticErrorV3::ConfigMarket --- the account profile projected the Portfolio's CLAIM basis at offset 96 while the config binds the LIABILITY basis at 128 --- and PROGRAMS-17F's repair moves the published artifact, the descriptor and the manifest entry and moves no link. Cohort-17 founded on the corrected profile and the accelerator no longer disputes the market: it now reaches the CANDIDATE PROJECTION, one phase later, and consumes 31,797 units getting there against cohort-16F's 30,771.

Wall 4 is GeneralHotCandidateErrorV3::InvalidPlan, whose text is "a record did not decode" and which is COARSE by construction: it is the target of a map_err(|_| …) at eight separate sites in crates/dclutch-trading/src/general/hot_candidate_v3.rs --- 755, 816, 820, 879, 881, 929, 996 and 998 --- covering GeneralRootV2::decode, GeneralBatchV1:: decode and the projection in between. It is exactly the shape AGENTS.md names: "map_err(|_| Coarse) converts a located defect into a search". It is NOT localized here, and no program was changed to chase it. The step stops at the refusal, as instructed.

close-batch and second-open-batch need a Batch this refusal did not create, and were not attempted.

6. TEN RUNBOOK DEFECTS, EACH FOUND BY RUNNING THE ROW

A row that has never run is a row with no author. Every one of these was invisible to check-steps.py, to preflight.sh and to test.sh, and every one was repaired in the runbook rather than worked around in this lane.

1. MARKET_KIND is keyed by row. openbatch-two-pass and its two cohort-17 successors ask for market.result_domain_record, which only a General market carries, and the default kinds sent them at market 1 -- so the generator refused the whole General family and deleted every script it had written. That is why cohort-16.1 ran those five OpenBatch acts by hand.
2. A {stage:…} brace in VERIFIER PROSE. Prose is not substituted, so seal-general's tail reached the emitted script as the literal /session.json and the self-contained value test read it as an absolute path.
3. The preamble created $OUT and nothing else. prepare --output-file $HERE/observed/<role>.programdata.bin died on the first of seven roles with No such file or directory (os error 2), naming neither path nor flag.
4. A write directory must survive its own backup. devnet-direct-trade- produce-v1 --output-dir refuses an absent directory; the preamble created it and the backup step removed it one line later. prepare --account-dir is the opposite and refuses one that EXISTS, so the exception is named rather than guessed.
5. The ? guard checked an input. It took the first write-shaped flag, so arm-relay -- which passes --evidence <the founding report> before its --output -- announced "present, not overwriting" about a file that had been there since the founding, and produced nothing at all.
6. {execute:…} never expanded its payload. Single-quoted, --fee-payer-keypair $HERE/keys/campaign-payer.json reached the driver with the four characters $HERE in it, and the refusal was "fee settlement payer keypair path must be absolute" -- about a path that was never a path.
7. The fill row named a file the producer does not write. It passed direct-trade-private.json; the producer writes direct-trade-session.json and states it in its own privateSession field, which the row now reads.
8. seal-general passed --routing-table unconditionally. devnet-capability-seal-v1 publishes its own table unless given one, so an empty manifest field made --execute the flag's value: "invalid pubkey --execute". The table is an OUTPUT of that row.
9. escrow-seated had no producer, and then no token list. The row is the census that already derives the escrow through dclutch_operator::failure_escrow_v1; giving it only the Positions left L1 reading "tracked 500000001 atoms across 1 accounts".
10. The census's --token/--position take LABEL=PUBKEY. Cohort-16's manifest carried empty lists, so no cohort had ever put a value there.

And one defect NOT in the runbook, which cost this lane forty minutes and every other lane a cold rebuild: cargo --manifest-path does not move cargo. See section 2.

Two further findings are left as findings, not edits:

• A blocks edge that is not a chain constraint costs a window. census blocks relay-capture, but the capture is bound by the market's own window and by nothing else. Cohort-16.1 fired its capture before its admissions and its fill, and was right to.
• arm-relay's third act is plan-then-sign and its shape is once. devnet-sponsored-push-v1 --action prepay-certificate writes a key-free planned report on its first --execute and signs on the second, and a once row runs it exactly once -- while the emitted attempts and wait: shapes already run the pair back to back and say so in a comment they carry.

7. THE LEDGER, TO THE LAMPORT

deployer before anything 28.657732010 close cohort-16.1's seven roles +32.808449040 61.466181050 close cohort-16.1's accelerator +3.740043320 65.206219370 deploy the eight -36.601529360 28.604690010 fund-payer, 2 SOL plus one fee -2.000005000 26.604685010 the ladder (36 tx) and the seal -0.032285920 26.572399090 deployer, unchanged since the seal 26.572399090

payer before the cohort 1.364363844 the one recorded top-up, deployer -> payer +2.000000000 3.364363844 the whole Direct spine, the General founding and seal, both OpenBatch tables, the four payouts and the terminal sequence -1.359424138 2.004939706

Closing cohort-16.1 returned 36.548487360 SOL and the eight deploys cost 36.601529360 — the cohort very nearly paid for itself, and the 0.053042 SOL difference is the four links that grew.

Nothing was spent on the General OpenBatch itself: devnet's preflight refused the send, so no fee was paid for a transaction that never landed.

---

ADDENDUM, 2026-09-06 afternoon. Lane COHORT-17B. Devnet evidence, not mainnet evidence.

The ruling on the zero-key conjunct was executed, the two maker replay roots are closed on chain, and the retirement stopped at the NEXT stage, on the second fact tools/cohort/README.md had already named as a question. This addendum does not edit anything above it; every line above stands as written.

1. THE ZERO-KEY CONJUNCT IS DELETED, AND IT WAS RED-PROVEN BOTH WAYS

40f1cb703. authenticate_embedded_hot_journal_v1's lookup-closure guard was one sentence over three conjuncts; the first, lookup_keys.iter().any(|key| *key == Pubkey::default()), is gone. The remaining two are now separately named refusals behind refusing_direct_hot_lookup_closure_clause_v1, and three tests hold the line:

Four builds, four measured results; the whole direct_trade::tests module is 26 green at the shipped shape. The first test walks the System Program through all 57 indices, which is the geometry cohort-17's Hot frame actually has, and the second zeroes a coordinate AFTER the digest was taken -- the only thing that distinguishes a named System Program from a vacancy.

The class had already been met once and exempted rather than deleted: terminal_sequence.rs:8342 carries a comment saying that without its exemption "ResolutionCloseFund refuses at frame index 18 of 19 on its own System Program, which is why no market had ever reached the stage behind it."

2. AND THE GUARD BEHIND IT WAS READING THE WRONG TWO ROWS

d7d09500e. With the conjunct gone the same close refused

REFUSED: embedded Direct lookup activation was outside the freeze-to-seal interval

authenticate_embedded_direct_mutations_v1 took the freeze and seal slots from evidence.mutations using ACTION ordinals -- which are ordinals into evidence.mutations[2..], because the two setup mutations (replay-setup, token-setup) sit in front of the action rows. For cohort-17's fill that read the third lookup-extend (493,995,350) and the lookup-freeze (493,995,433) as the freeze and the seal, and the activation at 493,995,464 is after the second of those. The true interval is freeze 493,995,433 to seal 493,995,546 and the activation sits inside it.

The indices now come from freeze_and_seal_mutation_indices_v1, and the_freeze_and_seal_slots_are_read_off_the_rows_that_carry_them holds them against the ordinal ladder AND the extension_count + 6 count guard at six extension counts. Red at the old offsets, green at the new.

Both defects are HOST ONLY. Nothing under crates/ or programs/ moved, the candidate commit is still 932edc83f and the release gate is still a98ed988…. Driver da6bc96f52dc63b5344a25f20543678aad2937e1bbb1fb92e2415df59e61ba2c at d7d09500e, staged with its provenance; the prior two are in backups/bin/.

3. THE RUNBOOK HAS A close-maker ROW, AND BOTH MAKER ROOTS ARE CLOSED

tools/cohort/steps.tsv gains close-maker (since 17, shape once, two invocations), documented at ### close-maker. It carries NO blocks edge and the README says why: a close runs INSIDE Retiring, and the root only enters Retiring at the terminal sequence's stage two, so the row runs BETWEEN TWO PASSES of retire. An edge in either direction is a deadlock.

seller maker qBhAiQ43YNqrdsDmpz22FjZn611XBwUHsFPxrEk9oB6 replay 59rvxdSf4vzfin1pdhVidvDHEZSAAgURhaPo8GNkNZRu 771oHXjD5fXd9vx6rakDq48vk5hV485ydaFyJQ5XT75vapaKSjWnb8UVS2mAwXG4qj7wNSBGHafBM497oWk4oDD slot 494,059,660, 98,248 CU, open maker roots 2 -> 1 buyer maker FsujuPtjS2Q4RowfuF5D12cq71xhLUZ2B1jNHnnrugW3 replay VnQRqKSg3uHnQj8VdoqEX3vVv6PiwiRvMGJUGvM15kw 5NJTCZ3z2hhvzVCeWNWEEUyCCN2Z6T2HVBZ5uuQSfQQbk7cHg8wa2RbDxaDbHwb7SKCbHvTPi68BPjb1L5BR7WWk slot 494,059,757, 98,248 CU, open maker roots 1 -> 0

Each close credited exactly the 1,463,040 lamports its own replay recorded, to the beneficiary the replay itself names (CuSvrfJ3rTEdkwNGW9EEWhTX9Y4db3iiy6RHDgcTDRdB, 2,926,080 after both), with donation 0 and closer carve 0 -- a stranger's close moved no lamport the fill had not already fixed. Both replays read back gone, from the chain, inside the driver. Read off the Direct capability root 3dgyRvrebvaXKL8Z1hqgYMWRewXXsgxBjbseERjep3xK afterwards: DCLTDRT1 phase byte 1, open_maker_root_count = 0. Successor(MakerRootCountInvariant) is gone and cannot come back on this market.

4. THE NEW WALL IS STAGE FOUR AGAIN, AND IT IS THE QUESTION THE RUNBOOK ASKED

Error: Direct close caller preflight: Capability(InvalidLength)

terminal_sequence.rs:5943 reporting preflight_direct_native_close_caller_v1 (crates/dclutch-operator/src/terminal_retirement_v1.rs:732). Convicted, from the journal and the chain, in three reads and no replay:

• the account is the Resolution dependency funding ledger GqyjjFmGzqL8ieqy3XPYoXVwBTpKgMxBhPnHH1BgpV9F, 264 bytes at founding, one of the snapshot's two funding_ledgers. On chain now: AccountNotFound. Its sibling GnD4k4JSjcxst3nDcofvJJfJF78mE7rWvMsrh4oUdYGw is live, 120 bytes, DCLTFL02, owned by Trading.
• who closed it: stage THREE. retire-1/terminal/journal/13-resolution-close-fund.json reads phase: finalized and carries that address at meta 12 as lookup-stable, writable, with expectedAccounts owner 11111111111111111111111111111111, lamportsAfterProtocol: 0, empty data -- and its finalized/poststate says the same thing after the fact. ResolutionCloseFund is 3L6ULNQN4S41wnYN9KuYH7pwoCFyexbgpJyACQfNCPtE.
• who needs it: stage FOUR. DirectCloseCapability decodes both funding ledgers to build CapabilityFundingHeaderV2 and to PRESERVE the dependency one, and an empty account is InvalidLength before any frame is built.

That is the second fact tools/cohort/README.md's retire section had already named: "stage three closed the Resolution funding ledger that stage four decodes and preserves -- which is a question about which stage owns those lamports, not a typo." It is now measured, on a chain, with both stages executed.

It is not repairable on this market and not repairable by this lane. The ledger is gone; recreating it would be fabricating protocol state. Every candidate repair -- reorder ResolutionCloseFund after DirectCloseCapability (TerminalStageV1::ORDERED, host), have stage three preserve the ledger, or have stage four tolerate its absence -- changes either the order a market already executed or dclutch-operator, which is compiled into the Claims, Core, Custody and Registry links. This lane changed no program.

CORRECTION, 2026-09-06, lane COHORT-17E. The clause "dclutch-operator, which is compiled into the Claims, Core, Custody and Registry links" is WRONG, and the same wrong sentence is repeated in this document's COHORT-17D addendum. dclutch-operator is a [dev-dependencies] entry of all four programs and is in NO link's path-dependency closure: tools/gates/frames.py drops an edge whose every dep_kind is dev when it walks a link's closure, which is why an operator change moves no frame row. Read directly: programs/dclutch-{claims,core,custody,registry}-sbf/Cargo.toml each name it under [dev-dependencies]. Settled by PROGRAMS-18A and confirmed here by running tools/gate frames before and after this lane's operator change -- PASS both times, the complete per-function manifest matching the ratchet admitted at 1dd18be91, every one of the eight links unmoved. An operator repair is HOST-ONLY. It needs a driver rebuild, not a re-release, not a redeploy, and not a new cohort. Both facts this document deferred to cohort-18 were repairable on cohort-17 all along, and one of them was repaired on it: see the COHORT-17E addendum.

Market 9e8fTH75s82pjcEK8pY8PaLPoZW6W1am1qQ6J4JHjagQ therefore stands at DCLTCOR3 phase byte 3 (Retiring) with outstanding_capabilities = 1, an empty Hoard, three discharged columns, its failure column seated in the escrow, and zero open maker roots. No market has been retired on any chain. What moved is the wall: it is no longer the maker roots, and the site's featured market is unchanged for the same reason as before.

5. THE GENERAL InvalidPlan: EIGHT SITES ARE TWO CONJUNCTS, BY READING

No replay was run. The eight map_err(|_| GeneralHotCandidateErrorV3::InvalidPlan) sites in crates/dclutch-trading/src/general/hot_candidate_v3.rs are not eight for THIS refusal:

• the action is OpenBatch, so only project_general_open_batch_candidate_in_place_v3 runs. Sites 879, 881 and 929 belong to CloseBatch and 996, 998 to SubmitCandidate. Five are unreachable.
• the three that remain are 755 (GeneralRootV2::decode(root_tail)), 820 (GeneralBatchV1::open) and 823 (requested_batch_id != Some(batch.batch_id()) || state.status != Collecting).
• the twenty-conjunct block between 755 and 820 returns InvalidCoordinate, not InvalidPlan. Its passage is evidence: the root's lifecycle, market, config id, generation, revision, next batch sequence and open-batch count all matched their independently projected observations, as did every config scalar and the primary account's bump, owner and rent.
• site 755 is excluded by the chain. The composite root 9edU3YfdbRWZYLoTw6v7PDLqm1x5UQRxSyvBhSCSZ93Z is 360 bytes; DCGROT02 sits at offset 232 and the tail from there is exactly 128 = GENERAL_ROOT_BYTES_V2, version 2, lifecycle 1, generation 2, revision 1, next_batch_sequence 0, open_batches 0, both reserved spans zero.
• inside site 820, GeneralBatchV1::open's Substitution arm cannot fire (sequence is taken from the root; market, config and generation were compared above), OutsideWindow cannot fire and validate_opening's window arm cannot fire (collection_slots 16, selection_slots 16, settlement_slots 64, max_orders 32, all from general/policy.json).

What is left is two conjuncts. Either root.open_batch(expected_revision, …) refusing CoordinateMismatch -- which is reachable because the block above compares expected_revision and root.revision() against two different candidate scalars and never against each other -- or the batch identity at 823. GeneralBatchOccurrenceTermsV1's preimage carries no slot fields, so batch_id() is slot-independent and a plan-time prediction of it is legitimate; that was checked and is not the defect.

Splitting those last two needs the replay (docs/design/DEVNET_FRAME_REPLAY_V1.md) with a profiled Trading, and that is where the next lane starts rather than at eight sites.

6. THE FRAMES DEBT AGAINST COHORT-17 IS OVER A TEST-ONLY MODULE

tools/gate frames owed names one commit in 1dd18be9..c5ddf118: 108f950f [lane COHORT-17], reaching dclutch-registry-sbf via programs/dclutch-registry-sbf. Its whole change to that link's sources is inside #[cfg(test)] mod devnet_general_accelerator_observation (programs/dclutch-registry-sbf/src/record_v1.rs:2090): the devnet observation fixture's program id, ProgramData, ELF digest and deployment slot, moved from cohort-16.1's accelerator to cohort-17's. Both hunks are inside that module and the attribute sits directly above it. A release build never compiles it, so the shipped link's bytes cannot have moved, and no recapture from two captures is owed on a linked crate that did not move. The ratchet is file-granular and stays RED until someone spends an hbox link build on --capture twice and accept; this addendum is the statement AGENTS.md admits in its place.

7. THE LEDGER

deployer 26.572399090 unchanged payer before this lane 2.004939706 two permissionless maker closes, 75,000 each -0.000150000 payer after 2.004789706

rent returned by the two closes +2,926,080 lamports to CuSvrfJ3rTEdkwNGW9EEWhTX9Y4db3iiy6RHDgcTDRdB, the beneficiary the replays themselves name -- not to the payer, and not to this lane

---

ADDENDUM, 2026-09-06 evening. Lane COHORT-17C. Devnet evidence, not mainnet evidence.

Cohort-17's market 9e8fTH75… can never be retired: ResolutionCloseFund ran before DirectCloseCapability and destroyed an input that stage decodes and preserves. PROGRAMS-18A ruled the order, gave it one author, and the ruling is HOST-ONLY — the same eight ELFs, the same release gate a98ed988…, a driver rebuild. So this lane founded a SECOND refunding Direct market on the same cohort, at the same release set, and drove it to the boundary the ruled order opens.

The market reached Retiring with both funding ledgers alive — a state no market on any chain has held — and stopped inside DirectCloseCapability on a frame ordering, located to one conjunct with its three numbers. No market has been retired on any chain, and this document says so.

This addendum does not edit anything above it.

1. THE SECOND MARKET, AND WHAT DID NOT MOVE

driver rebuilt three times; the last is 8e5bd2259 plus this lane's split discriminant, detached worktree, debug, toolchain 1.97.1, CARGO_TARGET_DIR the live tree's target/ candidate 932edc83f UNCHANGED gate a98ed988f9d266084b3835dc5f838a03c8513810669395373960d58ce7df6be3 UNCHANGED deployed the same eight ids at the same eight slots; no redeploy, no re-release

Open Market AvKSizb7j3VCzB41bKxYXntoXyRojDVM9UzyjgFvAadR window record 9CLAg1X6hpQjGrEszWM59Dupn7zRkGkNBwJRNqWT1McX window 1788703359 → 1788705159 (14:02:39Z, 1,800 s) collateral mint 9qJXBAcyeTJn3hq7sGb8mgh1dkXAp9m2UqLjiLtMipzg Hoard vault 86ZYfCNMX5uwc9NFRbDk5oUBF8NU3bVYkQkPLHwzs6Ub Claims aggregate DbnUvBnHvJy1SuxCMnF6yewFWmB9JeBudFMXQyizzjso failure escrow 68d1nDjNAczqGLCMw3HEHbLXEChdc6j7HZmnvCvpB1GU routing table EX5MafgFsroPVwV9aaNMqYdum4PnKPHYytPNrNsPnBdU Direct root CjwSZR42g29oDzdax89GAX7r2RckcKu5T6h8JXcGkV1s funding ledgers 7zJ8t92AzhC7BRonwMmE1sYZ8XUbjyvLqVLkJ7gmoM9N (Trading, mask 0b0001) 4Sng5gjNDBK2jS6dRfuRZ4YF2AmGTvuLsqMWNoifNdbg (Resolution, mask 0b1110)

The founding derived the same terms market 1 derived — reserve 1,000,000,002 atoms, budget 500,000,001, basis width 4, payout scale 3, 166,666,667 complete sets exact — in 83 transactions for 0.155320329 SOL, a fifth of market 1's, because the cohort's published records already existed and the campaign skipped them.

ResolutionCloseFund DID NOT RUN, and that is the reorder working. In market 1 it was stage three and it destroyed the ledger stage four preserves. In market 2 the terminal sequence executed CoreBeginRetiring, then DirectBeginRetiring, then went to DirectCloseCapability — the ruled order, on a chain, for the first time.

2. THE MARKET RESOLVED TO OUTCOME 2 AND THE STRANGER WAS PAID NOTHING, HONESTLY

The certificate Avf7aMpuGGAFRPze1JiWFUGLQiv97UfgN8qsyTR5YqJB reads kind 1 (ResolutionSuccess, not the failure kind 4), selector 2, result numerator 10,686,301,883 over denominator 1, observed at 1788703585. The market's cuts are 10200 and 10600 over a denominator of 100, so 106.86 is the top ordinary cell and index 2 is the honest selector's answer.

The stranger, participant-2, had bought 200 atoms at outcome 1 and holds [0, 200, 0, 0]. Their terminal payout ran and paid 0 atoms (64KrrWoPouaaQJUe9uVGgbkwdwLm74aB2k3YeVaj64HgidmdYyYpFYLsQkYF86VnsmYv9dd4fKCn4vHJKmWs6h2i, slot 494,151,571, 159,803 CU). That is not a failure of the market; it is the market. Cohort-17's market 1 resolved to outcome 1 and its stranger was paid 600; this one resolved to 2 and this one was not. A market whose stranger can only ever be paid is not a market.

The founder then claimed all three ordinary indices and the Hoard reached zero:

Census at the terminal boundary, read off chain: L1 holds (1,000,000,002 atoms across 5 accounts == Mint supply), L3 holds (4 Positions sum to [0, 0, 0, 166666667]), Hoard 0, and L4 reports INAPPLICABLE by name because settlement discharged the liability it is stated about. The escrow at 68d1nDjN… holds the whole failure column and the founder was issued no failure claim; at the founding boundary it read [0, 0, 0, 166666667] against a founder [166666667, 166666467, 166666667, 0] and a stranger [0, 200, 0, 0].

3. THE WALL: ONE CONJUNCT, THREE NUMBERS, AND A FRAME THAT DISAGREES WITH ITS OWN RULE

Direct close caller preflight: CloseFundingMasks(4, 15, [14, 1], InvalidDependency)

validate_funding_ledger_masks_v2 orders the two ledger masks by their lowest selected entry index and refuses a pair that is not ascending (crates/dclutch-market/src/capability_manifest/funding.rs:1577). The three numbers are the manifest entry count, the selected entry's required dependency union, and the masks in the order the frame presents them:

• entry count 4 and required union 0b1111. The manifest's entry 0 carries dependency_count 3 and the ascending array [1, 2, 3], read off D2S8BHbVsPxzVnRE2nPEqQF4RtFv3jCRoEW6mMHCxKcS at CAPABILITY_ENTRY_DEPENDENCY_COUNT_OFFSET_V1. manifest-edges's verifier is satisfied on a real market for the first time, and its closure is every bit.
• masks [0b1110, 0b0001]. The Resolution dependency ledger is presented FIRST and the Trading selected ledger second.
• and the Direct capability root reads entry index 0 at CAPABILITY_EXECUTION_SELECTION_ENTRY_INDEX_OFFSET, where selected_funding_ledger_leads_v1 says the SELECTED ledger leads.

So the frame contradicts the rule the driver states one function away, and it is a HOST disagreement: no program was asked and none was changed. It could not have been found before, because it needs a market at Retiring with two live physical funding ledgers, which is exactly the coverage PROGRAMS-18A named as owed — cohort-17's market 1 reached this preflight with its Resolution ledger already closed and refused on the zero-byte account first.

Before the split there was nothing to say which of twelve calls produced Capability(InvalidDependency). 7a4fff006 gives the funding walk's calls their own names and gives the mask partition its numbers; the two lines above are that commit's whole output on its first run.

4. FIVE RUNBOOK DEFECTS AND ONE HOST DEFECT, EACH FOUND BY RUNNING A SECOND MARKET

1. build-sim-config.py named one market implicitly — <job>/market/ literally — so a second Direct market got a config naming the FIRST market. Repaired with --market-dir; sim-config and admissions now fan out per market (843ceb73a).
2. The same repair left three job / "sim" literals behind --work-dir, so the config was written with market 1's Position addresses and aimed market 2's admissions at market 1's reports. One work_dir now (b8e07f89d).
3. census blocked relay-capture, which is bound by the market's WINDOW. A read in front of a deadline spends the deadline. The edge is deleted and arm-relay — whose input-capture.json the capture actually sends — blocks it instead (e1d3712e1).
4. Two rows whose shape was once and whose act was not (ae879936c): the fill's session is nine durable stages and once drove ONE, printed exit zero and wrote GREEN over an unfilled market; and the prepay certificate is a plan-then-sign pair whose planned report the row's own backup; rm -rf deleted between the two runs, so it could never sign. journal and attempts.
5. A window is not a sprint (29bbb2a53). relay-capture fired six attempts in thirty seconds of an 1,800-second window and called it a failure. Both cohort-17 markets exhausted the six and landed on the next try — market 1 at 652 s into its window refusing ProviderFreshness 0x8012 six times first, market 2 at 523 s refusing ProviderWindow 0x8011 six times first, and both of those codes say in their own doc comments that they are "no answer rather than a wrong one". A wait: row now paces 60 attempts against the window's own deadline.
6. THE HOST DEFECT THAT ONLY A SECOND MARKET COULD HAVE (8e5bd2259). The capability seal is ONE ACCOUNT PER RELEASE SET: both markets carry capabilitySeal DMS8YN3RNsDRHdpy5VVhrGwRUQD7pThP893nwhQ78p3u, market 1 published it, and market 2's session observed it — phase: finalized, null expectedSignature — and signed eight mutations where authenticate_embedded_direct_mutations_v1 demanded extension_count + 6 = nine. close-maker refused "embedded Direct evidence did not own the exact setup/ALT/seal/Hot mutation count", so no second market on any cohort could have had its maker roots closed, and that is the whole distance between a filled market and a retired one. Both shapes are admitted now, the refusal names both, and the Hot row's ACTION INDEX is unmoved at extension_count + 4 because the session still HAS a seal stage — only whether it was signed moves.

And one restatement of the terminal order that PROGRAMS-18A's sweep did not reach was already found and fixed in this tree by the journey tier (55225a504) before this lane's first pass; this lane paid for it only with a driver rebuild, and no chain act was attempted by the refused pass.

5. THE LEDGER

payer 2.004789706 → 1.676102937 (-0.328686769 over 83 founding transactions, the activation, the prepay, two admissions and their capital, the nine-stage fill, the fee settlement, seven captures, the settle, admit-terminal, the custody replay, four payouts, two maker closes and seven terminal-sequence transactions) deployer 26.572399090 UNCHANGED. This lane deployed nothing.

6. WHAT THE NEXT LANE INHERITS

Market AvKSizb7… stands at DCLTCOR3 phase 3 Retiring with outstanding_capabilities = 1, Hoard 0, three ordinary columns discharged, the failure column seated, zero open maker roots, both funding ledgers alive, and a frozen terminal ALT with CoreBeginRetiring and DirectBeginRetiring finalized in its journal. It is the first market ever to hold that state, and unlike 9e8fTH75… nothing about it is destroyed: the one thing in front of DirectCloseCapability is which of two host authors owns the funding slice's order, and the refusal now names the conjunct and prints the three numbers.

---

ADDENDUM, 2026-09-06 evening. Lane COHORT-17D.

Devnet evidence. Not mainnet evidence. The deployed eight are UNCHANGED, the candidate commit is UNCHANGED at 932edc83f, and the release gate is UNCHANGED at a98ed988…. Every commit below is host or runbook.

1. THE FRAME'S LEDGER ORDER HAS ONE AUTHOR, AND THE CLOSE RAN

CloseFundingMasks(4, 15, [14, 1], InvalidDependency) was two host authors on one market. direct_native_close_discovery_from_chain_v1 TYPED its funding slice [Resolution dependency, Trading selected] as a literal, while the meta closure two thousand lines away DERIVED it from selected_funding_ledger_leads_v1. The caller preflight builds its masks by walking the discovery's slice, so the literal is the one that reached validate_funding_ledger_masks_v2, which orders a partition by each mask's lowest selected manifest index and refuses [0b1110, 0b0001].

ordered_funding_ledger_slice_v1 is now the single declaration, beside the rule it reads, and all four frame authors call it: both capability activations, the close discovery, and the close's meta closure (f3931362b). A slice typed rather than derived is right only for a market nobody has founded.

2. THREE MORE WALLS, EACH ONE STAGE FURTHER, EACH HOST

The close does not fit the default meter. With the frame ordered the close reached a chain for the first time and Core consumed 200,000 of 200,000 at exceeded CUs meter at BPF instruction. That packet (38XaHrUjwAgZQmfZjLmZ24yWyZr9BX11aEUSfdyNLdPqWTykvQfitQbttfrUNM9KpXTkte5Ni31gfrdES1VHgwLH) was retired through the driver's own --supersede-unlandable: block height 481,945,925 past its last valid 481,944,348, and absent from transaction history with searchTransactionHistory on. Its exact message, rebuilt with a ComputeBudget key appended to the static readonly-unsigned section and simulated with sigVerify off under a 1,400,000-CU probe, drew 500,929 three times out of three — 500,779 inside Core, of which the Trading CPI is 211,558, plus the ComputeBudget instruction's own 150. Band 0, tolerance at its 15,000 floor, so DirectCloseCapability declares 515,929 and the route now MUST declare (9de26202a). That is the second row in a table whose None arm had promised "a new row with its own measured draw, not a blanket".

A live session may gain a measured row. authenticate_terminal_session_v1 held a session's ComputeBudget table and the driver's exactly equal, and market 2's session was written before this stage had ever executed anywhere. Equality is stricter than the invariant it protects: a stage that has never been planned compiled nothing, and a packet planned and then retired as unlandable moves aside under its own signature, which is what frees the canonical path. A table that only GAINS such a stage is now amended in place with the addition printed; a changed value, a removed row, or an addition for a stage whose journal already exists stays refused.

The close's return data is an acknowledgement no plan authors. Under the measured budget the close LANDED — and its journal refused "finalized terminal transaction carried unexpected return data". A Core-effect route always returns the role program's CoreEffectAckV1: 240 DCLTCAK1 bytes under Trading's id. The stage declared none, and it cannot declare the bytes: every field of that acknowledgement is a coordinate the plan owns except post_resource_digest, which Trading frames inside dclutch-trading-sbf — a crate the driver does not link, whose own comment records that no consumer in the tree recomputes it.

So the declaration is the acknowledgement's own authority (001cd8c41): CoreEffectAckV1::validate_for, run against the effect envelope the journal's instruction data already authenticates — action, target role, role program, release set, market, context, the full-effect digest over exactly the signed bytes, and both pre-revisions. --reconcile-landed gained the arm that writes that contract into an already-landed close, under a scope guard that for this route re-derives no poststate and so requires every declared account back identical.

3. THREE STAGES CERTIFIED, AND THE DIRECT CAPABILITY IS CLOSED

DirectCloseCapability JZ1pwcJqXkGj8cGQnhwhjVa6AiJiXcCCXcevaYaYwH9qPVwvd47NyFTpN9SYTba9de7xvTkbU41xMu3Si4dvjga slot 494,169,472, 500,929 CU, fee 5,000 Resolution prepay vw9zdDn3TMioU3xti3SHJmkkc26Dnxqyw4XogdtZS3yUyQXR1Vyb6uAyaaRqkwmDeBwTazVYKoMB9CXNDRQE7vx slot 494,176,208, 150 CU ResolutionCloseFund ugKnUgZmpUT6nXNT7QmfdyFN3KwTxvoqZYzKMUk4V2fU2LfAMoGKLdpyFXnrvvAMqYyUhpLtXwaWC8Qk9ujgSNG slot 494,176,359, 256,399 CU

Market AvKSizb7… reads DCLTCOR3 phase 3 Retiring with outstanding_capabilities = 0 — the count that has stood at 1 on every market this project has ever founded. The Direct capability root and the Trading selected funding ledger are closed with their rent to the market's RentCredit, and the Resolution dependency ledger is closed in the ruled order, AFTER the capability rather than before it. Cohort-17's market 1 died of the opposite order; this is the ruling running.

4. THE WALL, AND IT IS ONE CONJUNCT CONVICTED BY ONE SIMULATED FIELD

RetirementReplayHandoff — the fifth stage of six — refuses:

Program 2PAzXCkAhCtznHEk3QwcBMDdAyEZbRjttvTGvRMJG8fM consumed 61946 of 200000 Program 2PAzXCkAhCtznHEk3QwcBMDdAyEZbRjttvTGvRMJG8fM failed: custom program error: 0x3003

0x3003 is CoreSbfError::Reference, and in this route it is ONE code over ten sites in programs/dclutch-core-sbf/src/retirement_replay_handoff_v1.rs (186, 188, 199, 328, 332, 333, 346, 351, 352, 363) plus release.rs:486's identity helper. It is localized to one line, and not by reading:

The site. retirement_replay_handoff_v1.rs:326, the last conjunct of authenticate_prestate's single Reference block:

|| accounts[PAYER].lamports() != request.payer_lamports()

The conviction. The packet's own message was rebuilt with exactly eight bytes changed — the request's payer_lamports at offset 192, reduced by the 5,000-lamport transaction fee — and simulated with sigVerify off:

control (the packet as signed) err Custom 12291 (0x3003) 61,946 CU payer_lamports minus the fee err Custom 12297 (0x3009) 65,169 CU

The prestate block passes and execution proceeds 3,223 CU further. 0x3009 is CallerAuthority, which is the patch's own shadow: the caller-authority PDA is seeded by hash(request.to_bytes()), so changing a request byte moves it. One field, one block, one line.

The cause, and Core is right. Solana deducts the transaction fee from the fee payer while the transaction is loaded, so a program reads the fee payer's balance NET of the fee. The request declares the observed PRE-fee balance: 1,673,324,417 against the 1,673,319,417 Core sees. The driver's own intent already distinguishes them — that journal carries lamportsAfterProtocol 1671211137 beside lamportsAfterFee 1671206137 — and the request builder does not: crates/dclutch-operator/src/terminal_retirement_v1.rs:1748 writes payer_lamports: snapshot.payer.lamports.

Every other conjunct of every Reference block was excluded against the chain before the simulation, and each exclusion is a read anyone can repeat: the Claims aggregate DbnUvBnH… derives under dclutch:lbv2:market ‖ market at cohort-17's Claims and its seven identity fields all appear in the Market's own CoreState; TRADING_REPLAY, CORE_REPLAY, HOARD and CUSTODY_AUTHORITY re-derive byte-identically from the custody seed domains at bumps 254, 252, 3 and 255; the trading replay's and the Hoard's data digests equal the request's; the replay's caller_role is Trading, open_vault_count 1, next_revision 1, generation 2 and rent_refund the frame's RentCredit; the Hoard is an Initialized Token-2022 account of the frame's mint owned by the custody authority with no delegate, no native reserve, no close authority; and the other three lamport conjuncts — trading replay 4,754,880, Hoard 1,488,440, RentCredit 20,182,849 — hold exactly.

THE REPAIR IS NOT THIS LANE'S AND NOT THIS COHORT'S. crates/dclutch-operator is compiled into the Claims, Core, Custody and Registry links, so subtracting the fee there moves four ELFs and decision 0012 forbids upgrading a founded market's release set. Market AvKSizb7… cannot reach Retired on cohort-17's programs. No market has been retired on any chain.

The packet that carried the refusal (2ne4KgkvMLqgrVNAmne9Vfe8MoMTerg67gTNB9GANaLoSRH1B1uN9efzKStnvesh7XUjqxm5x83Vr6GxS8CQKxNb) never landed and was retired: block height 481,958,041 past its last valid 481,954,377, absent from history.

5. THE LEDGER

payer 1.676102937 → 1.673324417 (-0.002778520: the close, the prepay, the close-fund, the receipt's 2,763,520-lamport rent, and two transaction fees for packets that never landed) deployer 26.572399090 UNCHANGED. This lane deployed nothing.

6. WHAT THE NEXT LANE INHERITS

Market AvKSizb7…: phase 3 Retiring, outstanding_capabilities 0, Hoard 0, three ordinary columns discharged, the failure column seated at 68d1nDjN…, zero open maker roots, BOTH funding ledgers closed, the terminal ALT frozen and five of its six stages settled — four finalized and the fifth retired unlanded. Nothing about it is destroyed and 33-retire-2.sh --execute still resumes from the persisted session; what it will meet is the same conjunct until an operator that subtracts the fee is deployed.

Cohort-18 carries two operator facts now, not one: which stage owns the Resolution funding ledger (COHORT-17B), and that a request committing the fee payer's balance must commit it net of the fee. Both are dclutch-operator, so both ride the same re-release, and after them the sixth stage — AggregateRetirement's four checkpoint packets and the closure's burn — is the only thing between a fully spent refunding market and Retired.

The site's featured market is UNCHANGED, for the third cohort running and for the same reason: there is no retired market to feature.

---

ADDENDUM, 2026-09-06 night. Lane COHORT-17E.

Devnet evidence. Not mainnet evidence. The deployed eight, the candidate 932edc83f and the release gate a98ed988… are all UNCHANGED; every commit in this addendum is host or runbook. tools/gate frames PASSED before the first change and again after the last: the complete per-function frame manifest of all eight links matches the ratchet admitted at 1dd18be91.

1. THE HANDOFF LANDED, AND THE OPERATOR REPAIR WAS HOST-ONLY

RetirementReplayHandoff oxjzfjwH1Tsv7j8VZeka5pfhk3NtJmhW7MqpwhTae6USj1mYVK4fPB6H6pDgyqmGM8qi5WKd68j9K8WDFVqicb5 slot 494,191,265, 188,686 CU, fee 5,000, 644 wire bytes

COHORT-17D convicted the refusal — 0x3003 CoreSbfError::Reference at 61,946 CU, retirement_replay_handoff_v1.rs:326, accounts[PAYER].lamports() != request.payer_lamports() — and deferred it to cohort-18 on the ground that its producer is compiled into four links. It is not (see the correction above), and the repair took a driver rebuild.

One author for the payer's lamports. handoff_payer_lamports_at_load_v1 is now the only place the observed balance becomes the balance the route reads: the snapshot carries the exact fee this stage's own message pays and the producer subtracts it, feeding both the request and the plan observation from one expression. expected_payer_lamports becomes the protocol-only poststate, BEFORE the fee, which is the basis an exterior caller compares against the observed prestate — the program's own receipt reports what it READ and is therefore already net of the fee, and the planner now asserts that the two differ by exactly the committed fee.

The fee is quoted, never assumed, and the quote is checked against the signed bytes. The fee and the request depend on each other: the fee is quoted for a compiled message and the message carries the request the fee goes into. settle_retirement_handoff_payer_fee_v1 iterates and returns only the pass whose own compiled message pays exactly the fee its own bytes commit — convergence asserted rather than argued, because changing those eight bytes moves the request digest and one static caller-authority key and moves nothing that prices a message. build_protocol_stage_journal_v1 then re-quotes with getFeeForMessage for the message it is about to sign and refuses unless the committed account is that message's fee payer and the committed fee is that message's fee. The landed packet's journal reads transactionFeeLamports: 5000 and the chain charged 5,000.

The other three balances the route compares are excluded by construction, not by observation. trading_replay, hoard and rent_credit take no subtraction because none can be the fee payer: require_handoff_distinct refuses any snapshot in which they alias the PAYER role, and only_the_payer_role_can_be_the_fee_payer_the_route_compares asserts it for each of the three by name.

RED-PROVEN against the DEPLOYED ELFs. The SBF harness case a_request_built_from_the_pre_fee_balance_refuses_and_the_net_one_lands runs against core 2f28309f… and custody 2600db72…, byte-identical to cohort-17's deployed set. The pre-fee request refuses 0x3003 at 61,870 CU — the devnet reading was 61,946 — and the identical packet with those eight bytes net of the fee the harness itself quotes lands at 183,793. Both halves, one test, one program, eight bytes apart. Every other case in that file pays from the harness's mint keypair, which left the frame's PAYER role never debited and its observed and read balances the same number, so none of them could ever have caught this.

2. THREE MORE WALLS FELL BEHIND IT, AND ALL THREE WERE HOST

Claims was one code over eleven conjuncts. The checkpointed campaign refused checkpoint AggregateRetirement: Claims with nothing to say which of eleven return sites across two functions produced it. Split into five accusations — UnescrowedSupply, FailureIndex, BasisRecord, BasisContract, EscrowFrame, EscrowResidue — leaving Claims on the one site it is about.

The aggregate carries the product INSTANCE, not its record. authenticate_claims compared the Claims aggregate's product_instance_id against the Core state's product_record. Those are different 32 bytes on every market ever founded — Core offsets 112 and 80. Read off market 2: the aggregate holds f7512201…, which is the Core state's product_id byte for byte; its product_record is bd203b38…. Market 1 reads the same pair. The DEPLOYED Claims program is the field's semantic owner and binds the instance (rational_product_v3.rs:201, affine_batch_v2.rs:700), and so does every other host reader of it; this was the only reader in the tree that read the record. The fixture agreed because one hand wrote both: market_retirement_v1_lifecycle.rs seeded its aggregate from identity.product_record, so the harness and the reader mirrored each other about a value no chain carries. The fixture now seeds it the way Claims writes it.

The campaign's classification did not count shape A's escrow tail. build_aggregate_retirement_campaign_v1 classified the refund as market + rent_credit + checkpoint + custody_replay + hoard_vault and compared the sum against the operator's expected_refund_delta. On a refunding market those disagree by exactly the escrow pair's rent: the prepare packet closes the failure-column Position and its admission INTO the checkpoint, so the operator counts claims_aggregate + escrow.rent(). The classification now carries the tail, present exactly when the closure burns a column, and stays INDEPENDENT of the operator's — the equality is what makes it a check.

And one runbook defect. The retire row typed --source-receipt from the cohort manifest, which holds market 2's SETTLEMENT receipt CQhYgPTm… (464 bytes, DCLTSPR1); the account the campaign wants is the SourceClosureReceiptV3 its own ResolutionCloseFund stage writes, AgFyF27L… (416 bytes, DCSRCLS3), which the terminal sequence already records in session.json. The row reads it there now.

3. THE WALL: THE CHECKPOINTED RETIREMENT HAS NO ALT PRODUCER

With every check above passing, the campaign builds all four packets' exact frames — prepare, close-vault, close-replay, finish — from finalized chain state, opens the prepare's durable journal, and then refuses compiling the first message:

aggregate-retirement-prepare: v0 message: PacketTooLarge

devnet-aggregate-retirement-v1 requires a supplied --lookup-table and nothing in the tree produces one for this frame. Measured against market 2's 38-account prepare frame:

terminal ALT 5WRnxEvPnC2hftYB1MDNwkLjr1wp9ZXWccdpczdNdnbB 52 addresses, 14 static manifest ALT EX5MafgFsroPVwV9aaNMqYdum4PnKPHYytPNrNsPnBdU 64 addresses, 9 static both together 4 static

and the same four are missing from all four packets:

BhUz7WYNT1AZwHDniU1rAUN1dRM5Fx8n8UHVdjnVbKNT GBDfbQRxtYAF3aVAUVScWWXswt8kDxwkTtjVdKbz1WDv 7jrSBj5gefyhKNbedtxWWo6HmKomjucj2nMQqcpgWn4s 9FiZyD9bqgRDYr1eHacVWvAgftveY9oWHjT2sr4c1pzS

All four read AccountNotFound: they are accounts this retirement CREATES, at addresses derived from the campaign's own plan. That is why no earlier-frozen table can carry them and why this is a producer gap rather than a wrong address. The terminal sequence's ALT is frozen over the union of its six stages' closures, and its AggregateRetirement closure is the ONE-SHOT 35-account frame; the checkpointed route's frame is 38 on all four packets and its extra addresses do not exist until the campaign is planned. The row's {market.lookup_table} is therefore not repairable by naming a different address, which is why this lane did not change it.

The shape the repair wants already exists in this runbook: the General openbatch row is a TWO-PASS row precisely because its caller-authority span is seeded by the plan's own digest. The retirement campaign needs the same — plan, then create/extend/freeze an ALT over the plan's own union, then execute against it — and each of those is a durable journal the campaign does not yet have.

4. WHERE THE MARKET STANDS

Market AvKSizb7j3VCzB41bKxYXntoXyRojDVM9UzyjgFvAadR: DCLTCOR3 phase byte 3 (Retiring), outstanding_capabilities 0, Hoard 0, three ordinary columns discharged, the failure column seated at 68d1nDjN… holding 166,666,667 against an aggregate supply of [0, 0, 0, 166666667], zero open maker roots, both funding ledgers closed, and every terminal stage this market can run has run — five of the sequence's six are finalized, the Trading-role custody replay is closed and the Core-role replay exists. Nothing about it is destroyed. The campaign document holds all four packets' exact frames — prepare, close-vault, close-replay, finish, 38 accounts each — and the prepare has a durable journal at phase prepared: built from finalized chain state, no key read, no packet signed. They wait only on a table.

The terminal sequence itself cannot report completion on a refunding market: its stage 16 is the one-shot route, which refuses by name for a seated escrow and points at the checkpointed route, while the row's second loop is gated on a completion.json that shape A can never produce. The retire row's gate is owed the same ruling as its table.

No market has been retired on any chain. The site's featured market is UNCHANGED, for the fourth cohort running and for the same reason.

5. THE WITNESS REGISTER

tools/gate witness --discover against this document takes cohort-17 from 17 corroborated routes to 19: 29 records from 37 signatures, 8 carrying no resolvable first-party magic. tools/gate witness --check: 7 documents, 140 distinct routes, 0 problems.

6. THE LEDGER

payer 1.673324417 → 1.671206137 (-0.002118280 exactly: the handoff's 5,000-lamport fee plus the Core replay's 2,113,280 rent. Every other refusal this lane met came before a key was read, so it cost nothing.) deployer 26.572399090 UNCHANGED. This lane deployed nothing.

---

ADDENDUM, 2026-09-06 night. Lane COHORT-17F.

Devnet evidence. Not mainnet evidence. The deployed eight, the candidate 932edc83f and the release gate a98ed988… are all UNCHANGED; every commit in this addendum is host or runbook, and tools/gate frames owed names only 108f950f — COHORT-17's pre-existing debt over a #[cfg(test)] module — before this lane's first change and after its last.

1. A MARKET IS RETIRED. IT IS THE FIRST ONE, ON ANY CHAIN

Market AvKSizb7j3VCzB41bKxYXntoXyRojDVM9UzyjgFvAadR, founded REFUNDING, traded, settled, paid out and now Retired, through the four checkpointed packets in their ruled order:

prepare 3w2F2n5EGoCwf3RNig2NBzg83Y6ZMUkYLMWBX4FWYcDvKnVoUNY8554yvsUrvFbHj5Q6gzzVbKYrc6NAidxFnAga slot 494,212,407 158,024 CU fee 75,000 1,141 wire bytes close-vault 3VteUAQT2pJmx28R6PwwsndsNnZvHiEyCskJLzWUWuj5ZbYrBXQXLUDrtvd5pbzjbCB56c6HPwJ1WA4p2MbnFATV slot 494,212,468 146,687 CU fee 75,000 1,197 wire bytes close-replay 65RsvS8xVE2opJTCPXQVyqzHLhbirA7QpGnehBXi7VW9TYGDFYhxuhZg5rnF3kGYayv2XfVX5J4vvJ2agRLAvCdM slot 494,214,505 139,205 CU fee 75,000 1,197 wire bytes finish 53m47rGS36MbivKCJ98rQhCxnYnJSUxn4dvCWD89U27AEhLunTopeQEjr1QcqvmGbzZdViFn2vPeGmhpR8WdV5Xd slot 494,214,573 127,016 CU fee 75,000 1,077 wire bytes

Read off devnet at finalized slot 494,214,666, every account this retirement was stated about:

market AvKSizb7j3VCzB41bKxYXntoXyRojDVM9UzyjgFvAadR AccountNotFound rent credit 6MJ63PAX1cWUZ6Lr6bfE9nzRLhNmsamPjpFT8CtVfTKx AccountNotFound checkpoint DbnUvBnHvJy1SuxCMnF6yewFWmB9JeBudFMXQyizzjso AccountNotFound custody replay DzQWrBbwi2J8Hmyof488zxC3Dj6Rr7LY23uCJbBzxv97 AccountNotFound Hoard vault 86ZYfCNMX5uwc9NFRbDk5oUBF8NU3bVYkQkPLHwzs6Ub AccountNotFound escrow Position 68d1nDjNAczqGLCMw3HEHbLXEChdc6j7HZmnvCvpB1GU AccountNotFound escrow admission D4UkUraKbKRNggLQk3NTjCu1qkNKMdhZpEgA8cdoBWyr AccountNotFound refund wallet CuSvrfJ3rTEdkwNGW9EEWhTX9Y4db3iiy6RHDgcTDRdB 43,738,809 lamports

The rent is reclaimed to the lamport. 5,852,160 before, plus the operator's own expected_refund_delta of 37,886,649, is 43,738,809 — the number the chain reads. The classification behind that sum is INDEPENDENT of the operator's: market 2,519,680 + rent credit 24,937,729 + Claims refund 6,827,520 + custody replay 2,113,280 + Hoard vault 1,488,440, and the equality between the two is what makes the completion receipt a check rather than a copy.

AGAINST THE LOCAL HARNESS, PACKET FOR PACKET. tools/gauntlet/retirement-checkpoint drove the same four refunding packets on a private validator: its README's table records 148,544 / 124,440 / 110,718 / 96,182 CU and its bindings.json notes the v0 extents 1,089 / 1,145 / 1,145 / 1,025. Devnet:

packet harness CU devnet CU delta harness bytes devnet bytes prepare 148,544 158,024 + 9,480 1,089 1,141 close-vault 124,440 146,687 +22,247 1,145 1,197 close-replay 110,718 139,205 +28,487 1,145 1,197 finish 96,182 127,016 +30,834 1,025 1,077

The widths differ by exactly 52 in all four, and the devnet number is the one AggregateRetirementOperationV1::expected_wire_bytes fixes for this frame -- the packet the campaign signs, which the harness's figure is the message inside of. The CU gap is NOT explained here. Both sides run the same ELFs; a devnet transaction loads real account data where the fixture loads its own, and that is a hypothesis this run did not test. What the gap is not is a regression in the route: the ordering of the four is identical and every one is well inside its declared budget.

THE PHASE BYTE IS NOT THE OBSERVABLE, AND THE ROW'S VERIFIER SAYS ONE THING THIS RUN CANNOT SHOW. The row asks for the Market's phase byte at CoreState offset 10 to read 4 Retired. The finish packet does not leave a Market account at phase 4; it CLOSES it, which is why AggregateRetirementChainPhaseV1::Complete is the branch where all five accounts read absent. A reader wanting "this market retired" reads the closure and the refund, not a byte. The row's verifier should say so; it is the one line of it this run refutes.

2. THE BURN, READ FROM THE PREPARE PACKET'S OWN TRANSACTION

Not inferred from the Retired phase. Against 3w2F2n5E… itself, the only three balances that moved besides the fee:

68d1nDjN… escrow Position 1,463,040 -> 0 D4UkUraK… escrow admission 3,251,200 -> 0 DbnUvBnH… checkpoint 2,113,280 -> 6,827,520 (+4,714,240)

4,714,240 is 1,463,040 + 3,251,200 exactly, and 6,827,520 is the campaign's claims_refund exactly. That is decision 0025's shape A observed: the closure burned the failure column, closed the escrow Position and its admission into the checkpoint, and the checkpoint carried their rent onward to the refund wallet. The failure column held 166,666,667 units against an aggregate supply of [0, 0, 0, 166666667] and no certificate could ever pay it.

The completion receipt does NOT carry a burned_failure_units field; the row's verifier names one. What it carries is the classification above, and the burn's evidence is the prepare transaction's own three balances.

3. THE PRODUCER THAT WAS MISSING, AND WHAT IT COST

COHORT-17E stopped at aggregate-retirement-prepare: v0 message: PacketTooLarge — a MISSING PRODUCER. devnet-aggregate-retirement-v1 requires a supplied --lookup-table and nothing in the tree built one for the checkpointed 38-account frame; both of this cohort's frozen tables together left four coordinates static and all four read AccountNotFound, because they are accounts the retirement CREATES at addresses the campaign's own plan derives.

A lookup table holds PUBKEYS. extend_lookup_table never reads the accounts behind them, so that table was always publishable and the missing thing was the hand that derives the set from the plan rather than from a list.

devnet-aggregate-retirement-lookup-table-v1 plans the campaign from the same finalized state and derives its address set from the four packets' own metas. aggregate_retirement_routing_addresses_v1 offers each packet to the message compiler exactly as the signer will — alone, behind the two ComputeBudget declarations bounded_instructions owns — and takes the compiler's own answer for what a table may carry, so the packets and the table cannot disagree. Measured on market 2: a 38-account frame, 37 table addresses, all four of COHORT-17E's missing coordinates among them.

create 5fZd1BHiXBFnjDXkb4cD4q3TSxyzzwuRx9AxLqTc36CwP65vt1JBABYqw1RtRGbxNeNvSaAbdbzJzC7Bk6DiRrW9 slot 494,211,936 10,805 CU extend 0 4esp2qzDq5uwzkKXwYbewRyaEu1CDxQ22VxwxBJqAdfBCssac2yhXzQTLTVLEAPDP6mMsrctGHkVttDTFQm8Brkb slot 494,211,976 11,957 CU extend 1 4wDohBTryTMC86EEcx1VVyhazVR1zGghXujeJCAHJkJJrDX16syPkGVHgz1YGkqWPSZLzaknRkzhvNHCni5vBTAv slot 494,212,016 11,077 CU freeze 5dHAZDaxikjkcJus7sRfUHHc9vVLpSYVRZNeCe27ejY8iZkLevJFhEEDijdNf4fZ8nE7fcgTJUMrmNwWswknBQTj slot 494,212,056 1,817 CU

frozen table 8QkhoQ68zd34w2HAGgdkkf8SfE3KNnWMvtALEeQyenFB 37 addresses, 6,949,440 lamports

It then compiles all four packets over the table it just froze and refuses unless each lands at the exact width the frame fixes. It did: 1,141 / 1,197 / 1,197 / 1,077 bytes, 37 addresses resolved through the table in every one, against the 1,232-byte ceiling — and those are the widths the four signed packets actually carry.

SIZED ON BOTH SIDES, before any rent was paid. The producer's dry run (--output without --execute: no key opened, nothing sent) reports what the bare tableless route costs:

prepare 2,254 bytes, 1,022 over the ceiling routed 1,141 close-vault 2,310 bytes, 1,078 over routed 1,197 close-replay 2,310 bytes, 1,078 over routed 1,197 finish 2,190 bytes, 958 over routed 1,077

The host test the_four_packets_fit_over_this_retirement_own_table_and_a_short_one_refuses_by_bytes carries the same measurement offline for BOTH frames: all four packets compile over the derived table at their exact fixed widths, and over a table four coordinates short each measures exactly +124 bytes — 32 for the static key, less the one index byte it gives back — which puts the prepare over the ceiling and the finish under it. The prepare then refuses PacketTooLarge there, which is COHORT-17E's wall reproduced as arithmetic.

And the campaign now refuses a table that cannot route its own packets, by name and with the count and the missing addresses, rather than leaving that to the compiler's PacketTooLarge — a refusal that says the route does not fit and nothing about which coordinate is absent. A superset is admitted; only an absence refuses. Both retirement paths ask it: the live exterior off the observed table, the Series path off its durable capture's bytes.

4. TWO RULINGS THE ROW NOW CARRIES

The terminal sequence stops at the handoff. The row's first loop waited on $OUT/terminal/completion.json, which the sequence writes only when all six of its journals finalize — and its sixth stage is the ONE-SHOT AggregateRetirement, which refuses by name for a seated escrow and points at the checkpointed route. A refunding market could never satisfy that gate, so the row could never reach its own packets. The gate is now the fifth stage's own journal reading finalized. This row retires through the CHECKPOINTED route for every shape — the sixth stage is not its route, because the next act performs the retirement — so a categorical market takes the four packets here too (AggregateRetirementFrameShapeV1::Categorical, 35 accounts). One rule, not a shape-dependent one.

The retirement freezes its own table, as an act between the terminal sequence and the four packets, --lookup-table reading lookupTable out of its evidence. Being an act is the ?-guard: a resume reuses the table it already froze rather than paying rent for a second one. Like the row's other two acts it carries a literal --execute, because a preflight of a retirement can compile nothing without a table — the same call openbatch-frozen-tables makes.

5. ONE MORE HOST WALL, AND IT WAS THE HOST DISAGREEING WITH A LANDED PACKET

Between close-vault and close-replay:

REFUSED aggregate retirement: live retirement account differed from its exact initial fact

3VteUAQT… had already landed — slot 494,212,468, 146,687 CU, no error. The account it refused was the Custody replay, whose address, owner, executable bit, width and lamport balance were all exactly what the campaign recorded. Its BYTES had moved, and they had to: the close-vault packet IS a Custody action under that cursor. CustodyReplayV1::advance writes exactly four words — next_revision, open_vault_count, last_request_digest, last_poststate_commitment — and copies every identity field through ..self, refusing ReplayBindingMismatch on a request that disagrees with one. The chain read revision 2 and ZERO open Vaults. A byte-equality check against the planning-time reading refused the one poststate the deployed program can produce.

The replay is authenticated as a CURSOR now, and that is four accusations where there was one digest: the same account exactly (address, owner, executable bit, width, lamports); bytes that MUST have moved, because a cursor that did not move would mean the close was not replayed through it; still THIS Market's cursor under THIS campaign's Core program; and zero open Vaults, because the Vault it counted is the one the packet just closed. the_hoard_vault_close_must_advance_ the_custody_replay_and_leave_no_open_vault drives all five refusals by name.

No program changed and none refused. This was the host disagreeing with a transaction that had already succeeded, which is the fourth time on this market's terminal path and the fourth time it was host-only.

6. THE CENSUS CANNOT READ A RETIRED MARKET, AND THAT IS A FINDING

ledger-census --stage post-retire refuses by name:

missing Claims aggregate account DbnUvBnHvJy1SuxCMnF6yewFWmB9JeBudFMXQyizzjso

Every account the instrument is stated about is closed. So there is no L1–L8 verdict at the retirement boundary, and there cannot be one from this tool as written. The last measured boundary stands where COHORT-17C left it (census-2/post-payout.json, slot 494,153,475: L1 holds, L3 holds, L4 inapplicable by name, L5/L6/L8 hold; L2 and L7 read VIOLATED because the row hardcodes --declared-hoard-delta 0 and the payout drained 500,000,001 atoms out of the Hoard that the invocation had no way to declare — a runbook declaration defect, not a protocol one, and it is owed a row that can state it).

What stands in place of a post-retirement census is the conservation statement above: two independent classifications of the same lamports agreeing exactly, and a refund wallet whose observed balance is their sum.

7. THE LEDGER

payer 1.671206137 -> 1.663656697 (-0.007549440 exactly: the frozen table's 6,949,440-lamport rent, its four 75,000-lamport transaction fees, and the four packets' four 75,000-lamport fees. Nothing else moved.) deployer 26.572399090 UNCHANGED. This lane deployed nothing.

refund wallet CuSvrfJ3… 5,852,160 -> 43,738,809

8. THE SITE CANNOT FEATURE THE RETIRED MARKET, AND ITS FEATURED MARKET IS ALREADY DEAD

Three cohorts of evidence documents have ended "the site's featured market is UNCHANGED, because there is no retired market to feature." There is one now, and the site still cannot feature it — for a reason worth stating exactly, because it is not a missing fixture.

Measured, through the site's own SDK, at finalized slot 494,221,111:

AvKSizb7j3VCzB41bKxYXntoXyRojDVM9UzyjgFvAadR refused account is absent at the finalized observation floor GyD95eyERwRfwj8fSFNhWjKF2eaDg5XcREidPKex65zY refused account owner differs from the selected Core program, or it is executable program data 9e8fTH75s82pjcEK8pY8PaLPoZW6W1am1qQ6J4JHjagQ decoded Retiring, terminal 7yaJUoUk8qjzPUMVeehs3owsmdfHy6Ud2nyJNNMruEYt decoded Founding, open CJVARrAjDvv45GnExJfRKn2LdGCyNXFVqRr1GdaNg7Ne decoded Founding, open

The retired market is refused because it has no account, which is the whole point of a retirement, and readDeploymentLivenessV1 refuses an absent featured market BY NAME — a refusal deploymentLiveness.test.ts's case refuses an absent featured market rather than reporting on the programs alone pins with expect(liveness.reason).toContain('does not exist'). Featuring a retired market means weakening that refusal, and this project does not weaken a refusal to make a page render. public-cut.devnet.json was NOT changed.

AND THE SITE'S FEATURED MARKET WAS ALREADY DEAD, INDEPENDENTLY OF THIS RETIREMENT. tools/gate web's live liveness suite is RED today, both of its cases, with one message:

The featured market GyD95eyERwRfwj8fSFNhWjKF2eaDg5XcREidPKex65zY is owned by 4wv7JxoAad6JMQi2vHJyByLXasWS8RzJSTdvEEmpCjpe, and this deployment's Core program is 2PAzXCkAhCtznHEk3QwcBMDdAyEZbRjttvTGvRMJG8fM. The cut features a market from another cohort.

DEVNET_DEPLOYMENT_V1.programs moved to cohort-17 and the market the cut headlines did not. That is AGENTS.md's own rule unmet — "banishing a program is finished only when every non-Rust consumer is swept in the same commit, apps/dclutch-web above all" — and it is a cohort-17 debt, not this lane's retirement.

THE COHORT-18 RULING THIS ASKS FOR: A COHORT THAT WANTS TO HEADLINE ITS MARKET MUST KEEP ONE ALIVE. Cohort-17 has no market the site can honestly headline. Market 2 completed its lifecycle and is therefore unreadable; market 1 is Retiring and cannot be retired (its Resolution funding ledger is gone); the Found31 and General markets are Founding. Re-featuring is not a fixture swap either — it needs, together and consistently:

• public-cut.devnet.json's market (hand-written; no generator);
• an editorial market-registry.devnet.json row, whose charter marketRegistry.test.ts pins: title, question and outcomes NULL, a truthy coordinate.label and story, and a resolution naming Pyth and the source-failure outcome;
• a fresh 368-byte DCLTCOR3 capture to replace cohort16-featured-market.devnet.json, which the liveness gate's OFFLINE cases decode — and which a retired market cannot supply, because there are no bytes at its address;
• the share-card facts, staged by the reader that checks them (DCLUTCH_LIVE_DEVNET=1 DCLUTCH_OG_FACTS_WRITE=1 npx vitest run --config vitest.config.ts lib/ogCards.live.test.ts) — and note the trap: a registry row with a null title MUST have a staged facts row, which a market that does not decode can never get, so a retired market cannot be registered titleless either;
• /pulse's public/simulator-series.json, whose market is still GyD95eyE… and whose generator joins ledger-census observations — which, per §6, cannot read a retired market at all.

Every one of those is a reading of a LIVE market. The site's whole vocabulary for "featured" is present-tense, and the first complete lifecycle this protocol has produced is the one thing that vocabulary cannot say. A front door that could headline a finished market would need a fourth DeploymentLivenessV1 verdict beside alive | closed | refused, derived from finalized signatures — which the witness register (docs/evidence/witnesses/cohort-17-discovered.json, 21 corroborated routes) already holds for exactly this market. That is a design step with an owner, and naming it is as far as this lane takes it.