Liveness census — every "someone must act" point, 2026-08-29

One question, applied to every lifecycle stage of every family and the market spine:

Who must act for value or state to progress here, what happens if nobody does, and is the actor paid?

This is CYCLE 3 charter item 3 — permissionless completion universalized. The protocol's one-sentence differentiator is no liveness dependency on any identified party, and this register is the point-by-point proof or the precisely named gap. Method follows SEAM_AUDIT_2026_08_29.md: routes read, not docs; every claim carries a file:line; verdicts are per-row.

Classification

Two composition rules used throughout:

1. A role-gated healthy path + a funded permissionless fallback is the protocol's designed shape (never trust a keeper, fund a bounty). The healthy leg is scored ORANGE on its own row; the system row for the stage is GREEN if the fallback is funded and reachable from every state the healthy leg can abandon.
2. YELLOW is not "almost GREEN". The tree itself states the doctrine: "Gen-2's consideration was permissionless and UNPAID, which makes a verb permissible rather than live: a valid candidate nobody cranked before the selection window closed never competed at all" (crates/dclutch-general-adapter-contract/src/candidate_v1.rs:290-295). A YELLOW row is a named gap, not a rounding error.

The three proven GREEN exemplars (the standard every row is held to)

1. The funded failure walk — crates/dclutch-svm-harness/tests/relayed_mainnet_state.rs. The bounty is a manifest quote, not a walk-time argument (:171-179): disclosed before the market opened, prepaid into the resolution funding ledger's Failure compartment (:385-397), paid to whoever walks the pre-disclosed failure outcome after the deadline (:3023-3066), spent exactly once (:3127-3131, the_bounty_cannot_be_collected_twice :3203), and ResolutionCertificateV2::validate_shape refuses work_paid == 0 — a walk that could not be paid for could not have encoded its certificate.
2. Completion-only founding — the 13:30 ORCH ruling. The one-shot founding permit has NO post-commit refund; the guarantee is a permissionless NON-EXPIRING Open. Stage-1 admission IS the Open-satisfiability guarantee: everything Open consumes is bound at FoundAndPermit, so completion is always available to everyone and value only moves forward.
3. The candidate work escrow — crates/dclutch-general-adapter-contract/src/candidate_v1.rs. Submission is permissionless and unbonded; the submission funds exactly the cranks its own life requires — one per execution row, one consideration, one cleanup (:282-295); every permissionless transition returns a WorkRewardV1 whose compartment has already been debited (:237-249); unspent escrow returns to the solver; the solver signs "only to own the escrow and its refund — not to be authorized. Anyone may submit" (:297-298). **Qualified by ESCROW fdd189ac: this is the canonical description of the property, not a deployed proof of it. WorkRewardV1 occurs nowhere outside its own crate (grep-verified: candidate_v1.rs, escrow_v1.rs, escrow_v1/tests.rs), and GeneralCandidateV1's only consumer outside the crate is a harness test (programs/dclutch-general-accelerator-sbf/program-test/tests/lifecycle.rs:1084) — no program src/ reaches it**. So "the standard every row is held to" has no SBF dispatcher behind it, and a lane told to copy it will find nothing to copy. The tree's one deployed funded permissionless crank is record Abort (R6, c365179c); it is the template, and docs/design/FUNDED_CRANK_V1.md §1 sets out why. First observed by the claim-check design (docs/design/CLAIM_CHECK_COMPACTION_V1.md §6.2) and re-verified here.

The two fix templates for closures in this lane:

• Dealer cleanup beneficiary — crates/dclutch-dealer-codec/src/scenario_checkpoint_v1.rs:709-719: permissionless strictly after expiry, value to a creation-fixed beneficiary the caller cannot redirect. (Conserving; note it pays the beneficiary, not the caller — pairing it with a caller-directed crank fee is what upgrades YELLOW to GREEN.)
• The failure-walk bounty — above.

---

Ranked findings

~90 act-points censused across six territories. Every RED was re-verified at the routes by the census author, not just reported by a sweep.

Clean on their own terms: the funded failure walk (C6, caller paid atomically, relay_transport_v1.rs:1504); Dealer Fill/Unwind (work_reward to the signing ACTOR, dealer-codec lib.rs:1828,1904, dealer-sbf lib.rs:2031 — the tree's second real caller-funded verb); the General candidate work escrow; holder redemption and user admission (GREEN-SELF, owner-signed, signed_delta_v3.rs:516-520, user_position_admission_v1.rs:138,159); and the retirement mechanics (no identified party anywhere — the gap is funding, not permission).

Census register

One row per act-point, grouped by lifecycle territory:

• A. Founding, permits, record publication, Series — below
• B. Activation, admission, registry caches after upgrades — below
• C. Provider capture, resolution, terminal admission — below
• D. Payout, redemption, retirement, rent recovery — below
• E. Dealer, Custody delivery, checkpoint cleanup — below
• F. Trade spine — below

A. Founding, permits, records, Series

B. Activation, admission, registry caches (sweep + direct verification of every RED)

Territory-B systemic note: every live expiry route pays a creation-fixed beneficiary, never the caller (B12, B14, B16, B17; dealer checkpoint cleanup is the same shape). Bounded and conserving — the Dealer-cleanup template — but altruism-dependent. The tree's one caller-funded payout construct was B6, and it was unreachable until this lane's closure below.

F. Trade spine (walked directly)

Notes on the two YELLOW rows: the unwind verbs are conserving (the Dealer cleanup shape — value to creation-fixed destinations, caller cannot redirect) but unpaid, and they sit on the retirement critical path: DirectRootStateV1::require_closable (crates/dclutch-direct-codec/src/successor.rs:616-623) refuses physical root closure until phase is Retiring AND open_maker_root_count == 0, and a maker root only closes when its last live record does (close_live, :2209). So a vanished maker's expired record blocks the Direct child's closure — and with it market retirement — until a stranger cranks an unwind nobody pays for. Fix shape: a per-record crank fee carved from rent_principal at registration (maker-funded, exactly the candidate_v1 work-escrow pattern); the close plan already computes unclassified_donation/total_rent_credit (successor.rs:2230-2238), so the fee has a natural ledger seat. Costed as Q10 in the queue below.

C. Provider capture, resolution, terminal admission

D. Payout, redemption, retirement, rent recovery

E. Dealer, Custody delivery, checkpoint cleanup

Closures landed in this lane

Two RED gaps were small-and-unowned enough to close in place; the rest are design rulings or larger reshapes, queued below.

1. R5 / a16d1b0b — core: make the allocated founding permit completion-only. Deleted the one conjunct (current_slot > intent.expiry_slot() in authenticate_permit, generic_founding_v1.rs) that made the 13:30 ruling's non-expiring Open still expire in code. The pre-allocation refund family (series_permit_expiry) is disjoint by account state, so no route pair can race; the consumed-permit replay refusal is untouched and still pinned by SPLIT's d60fbfb9 hostile. Control: cargo check; core-sbf unit tests 24/24; touched file clippy-clean.

1. R6 / c365179c — registry: dispatch record Abort (action 4) — the funded cleanup. Wired the contract's complete-but-undispatched prepare_abort_v1 into the registry dispatcher. This is the only caller-funded payout construct in the tree, prepaid on every publication and previously dead. process_abort observes the accounts, calls the contract, binds every returned obligation to the exact SVM accounts, and applies the two closes with an exact-conservation postcheck; it handles both the early sponsor-signed branch (bounty withheld, actor≡sponsor aliasing) and the expired permissionless branch (bounty to the caller). Control: registry-sbf clippy-clean; 17/17 lib tests single-threaded and under cargo nextest run (the repo's canonical process-per-test runner); cargo build-sbf produces the ELF; two new tests + three hostiles with the pinned Record code. Caveat: cargo test --lib at ≥4 threads SIGSEGVs inside the pre-existing leaked-Box AccountInfo test helper (its resize/assign do runtime pointer math unsafe under in-process parallelism); the added tests only push the record module past that thread-count threshold. nextest is clean.

1. R2 / 12d0deb5 (LIVE-2, on the 16:36 ORCH ruling) — core: refuse to found a market whose failure walk is dead code. Core CreateFund is the action that mints the SourceResolutionStateV2, and that state has no terminal when its material carries a recovery policy: the exhaust transition refuses the material outright and the ordered ladder meant to serve it has its only call site under #[cfg(any())]. The weld is one conjunct on creation only — VerifyFundReady, CloseFund and AdmitTerminal stay admissible, because a weld may not take routes away from a state that already exists. New refusal CoreSbfError::RecoveryWalkUnavailable 0x3011; the off-chain builder mirrors it so the refusal lands at the desk rather than the validator. The predicate recovery_walk_has_a_live_route is the whole of the revert when Q2's build half lands. Control: cargo check; two new hostiles green under nextest — the first re-executes the premise (a no-recovery material walks one second past the deadline, a recovery material is refused there and at i64::MAX) so it goes red the day the ladder becomes live; clippy clean on all four touched files; cargo build-sbf produces the ELF on hbox. Cost stated plainly: a founder who stages this shape now loses the stage-1 outlay at CreateFund rather than discovering at the deadline that the market cannot resolve. A pre-trade founding refusal in place of a post-trade permanent strand is the trade, and it is the point.

1. Y3b / 04f00387 (LIVE-2) — resolution: a live market's evidence is not a stranger's to delete. RetireRecord is permissionless and CLOSES the account; it admitted Sealed. A sealed record is one permissionless ConsumeRecord from resolving the market successfully, and consumption is reachable only through that success path, so one transaction fee bought the deletion of the honest outcome and forced the market onto the bounty-paying failure walk. Retiring a non-Consumed record now requires the Market to carry a terminal receipt — a fact already in the RetireRecord frame and already decoded for its rent beneficiary, so no frame or ABI moved. New refusal ResolutionError::RecordStillConsumable 0x8016. This is where the two welds compose: the refusal is "not yet", and what makes it "not yet" rather than "never" is that every market terminalizes — which is true precisely because R2's weld removed the one shape that could not. Control: the contract hostile performs the attack on both live phases, asserts no bytes were written, and walks both ways out; the real-SVM campaign the_record_transport_runs_create_append_seal_and_retire was performing this attack as its happy path and now asserts the refusal by code on the compiled adapter before terminalizing and running its unchanged lamport conservation.

All four rode cohort-7 territory (Core founding permit edit is the ruling's named one-conjunct change; registry rides cohort-7 per the 14:43 freeze; 12d0deb5 and 04f00387 are flagged cohort-critical in their commit messages and posted to SPINE-2) — none is on the devnet cut's critical path, and trading-sbf and the successor founding path were untouched throughout.

The pattern behind the YELLOW rows — P1

Every genuine expiry/cleanup/retirement route in the tree is permissionless but pays a creation-fixed beneficiary, never the caller. The verb is therefore permissible rather than live — the tree's own words (candidate_v1.rs:290-295). The protocol has exactly three caller-funded verbs that make a permissionless act actually live: the funded failure walk (C6), the General candidate work escrow, and — now — the record cleanup bounty (R6). Every other permissionless route is a donation of a transaction fee, which the gauntlet states outright (journey/stages.rs:748-758).

The fix template is two shapes, not one, and the choice between them is forced rather than stylistic — ruled and sized in docs/design/FUNDED_CRANK_V1.md, which supersedes this paragraph's earlier claim that the template was "uniform and already proven three times".

• Prepaid-at-creation — carve a small, fully-refundable work escrow at the value's creation, sized to the exact cranks its lifecycle needs, each drawing one pre-debited reward to whoever performs it, the remainder refunding to the funder. This shape may refuse for underfunding, which is safe only because creation force-prepays it. Available only where a creation act already signs, already pays rent, and can be made to refuse — which an existing route being converted after the fact almost never can.
• Residual-at-close — the reward is a capped slice of lamports already leaving: min(floor, residual). It can never refuse, which is mandatory rather than nice: a crank that refuses for money is an unturned crank, i.e. the same defect through the funding door. Every conversion in the Y1 set is this shape.

Two corrections to what this paragraph claimed. (1) WorkRewardV1 (candidate_v1.rs:237-249) is the canonical description of the property but has no deployed SBF dispatcher — its only non-crate consumer is a harness test — so it is not one of the three proofs. The tree's one deployed funded permissionless crank is record Abort, and it is the template. (2) The floor must be derived from the Rent sysvar, never written as a literal — the deployed route does exactly this (registry-sbf record_v1.rs:348,362), and the one literal in the tree is COMPACTION_CRANK_REWARD_LAMPORTS_V1 (claims-svm claim_check_v1.rs:108), 14.8× below it.

Applying either shape turns a YELLOW into GREEN without drawing on any Hoard. The per-route sizing — measured, not estimated — is in FUNDED_CRANK_V1.md §9, and its headline is that none of the Y1 sites is mechanical: each sits behind a different gate.

Costed queue — the RED and YELLOW gaps not closed in this lane

Ordered by whether they are a ruling (a policy decision only ember/ORCH can make), a weld (refuse a currently-reachable unsafe state), or a build (a bounded implementation). File:line evidence is in the ranked table above.

Priority read: Q2 (weld) and Q6/Q8 (small builds) are cheap and unblock or de-risk immediately. Q3 and Q1 are the two that most directly contradict the charter's one-sentence differentiator — a market that cannot retire and a market that an upgrade bricks are both identified-/no-party liveness dependencies with permanent stranding — and both need a ruling before a build. ~~Q4 (Dealer) is the largest and least urgent (Dealer is not on the devnet cut).~~ Amended 08-30: Q4's brick is closed (d49ddda3) and its force-exit was ruled against rather than built. What is left of it is not "largest" but least reachable — the Dealer family has no on-chain entry route at all, so nothing is stranded because nothing is founded. That is also why the fix was free, and it carries the one ordering constraint this census now imposes on another lane: build Dealer entry only after the exit-affordability invariant, or the free-tightening window closes and a genuine migration is needed.