Execution coverage census — 2026-09-08

This is the dated authority for whole-protocol execution coverage at census source revision 4ef5a4eb6a313459395434ec712361090e888981. It keeps four facts separate: current route inventory, finalized native instruction evidence, historical binding claims, and ProgramTest. A compile, fixture, refusal, status sentence, or binding without its transaction evidence is not an accepted route.

Exact result

The repository-owned census enumerates 164 routes, 456 protocol refusal codes, and zero unclassified dispatch positions at the named revision. The checked-in local-validator corpus folds five accepted routes, zero refusal-only routes, and 159 routes without a checked-in exact local-validator observation. Each admitted row has a successful signature and slot, the native instruction bytes, the invoked program address from runtime logs, and a selector that uniquely identifies the route.

The five exact local-validator routes are:

The Dealer campaign carries founding and funding infrastructure. Only these four Dealer instructions are bound here. It does not prove the accelerator arm, settlement, resource retirement, or full Dealer lifecycle retirement.

Why 119 is not the accepted total

Filtering every repository bindings.json to outcome == "executed", joining the declared substrate, and unioning the existing successful devnet witnesses produces 119 historical route claims before Dealer and 123 after the four Dealer routes. The current non-disjoint inputs are 46 devnet routes, 62 local-validator binding routes, and 71 ProgramTest binding routes. Choosing the strongest declared substrate makes those 46 devnet, 36 local-validator, and 41 ProgramTest-only.

That 123-route number is an authored historical claim union. It is not the exact ledger total. After the 50 routes with durable native Agave evidence are removed, 73 claimed successes still lack checked exact evidence here: 32 have a local-validator binding as their strongest remaining claim, and 41 are ProgramTest-only. The dated JSON lists every route in both sets. The old 119 figure therefore cannot be promoted to accepted runtime coverage merely by reading status = witnessed, and the four new Dealer rows do not repair its missing evidence.

The generated docs/reference/route-witnesses.md still classifies any route named by a binding as witnessed before consulting the binding outcome and without consuming the folded ledger. It is useful as a binding register, but it is not the acceptance census. The exact reporter is dclutch-route-census over out/ledger.json.

Current campaign disposition

Routes with no historical successful claim

There are 41, comprising 23 status-report, 7 unwired, 6 structural, 3 unrecorded and 2 repointing rows. There are zero refusal-only routes in this historical claim comparison. The machine-readable store contains one owner row per route; this table groups the same complete set for execution.

Reproduction and final-source closure

Run the dated offline verifier from the repository root:

docs/evidence/execution-coverage-2026-09-08/verify.sh \
  /private/tmp/dclutch-execution-coverage-20260908 \
  4ef5a4eb6a313459395434ec712361090e888981

It exports that commit, enumerates the inventory, folds both checked-in native captures, renders CENSUS.md, checks the exact five-route ledger, and writes HISTORICAL_BINDING_CLAIMS.json. The accepted run produced exact-ledger SHA-256 f5f1d29961ccf7f4cbd0b0ce2c1bffaff0e37d789bbf3906dda9511861a0b145. The Dealer evidence subset is 0e7b5eb80b5ef780696de621c7d897a18945adae7e03e42af300774efe4b534c.

Final-source replay uses the same authority rather than translating results into another report:

1. Commit the complete final source and run tools/gate census --commit REV --work ABS_WORK once.
2. Build all eight ELFs from that exact commit and start a fresh checked local validator. Run each family campaign with its census switch and DCLUTCH_GAUNTLET_WORK=ABS_WORK. Journey, tier 1, ladder, relayed, lineage, General, Dealer and economics already have a census path; missing family runners are the owners listed above.
3. Preserve each campaign's program map, native transaction evidence, poststate report and source/artifact hashes. census observe must accept the binding against the final inventory; a binding file by itself contributes zero exact coverage.
4. Render tools/gate census --commit REV --work ABS_WORK --no-tests. Closure requires every intended route to read EXECUTED from accepted finalized instructions. Keep ProgramTest, devnet, historical source-split and refusal-only totals separate.

The dated verifier deliberately asserts the 164-route shape above. If final source adds or removes a route, it refuses, forcing a new dated inventory and owner delta instead of silently changing this record.

Stored artifacts