docs(sofi): 2c-C is four amendments, and the walker has been violating Req 15.3

[cryptskii]

Why 2c-C decomposes

A four-dimension source audit found what was chartered as one amendment carries ~26 open
decisions — 2c-A had seven rulings, 2c-B had four — across four dimensions that are separable in
fact, not merely in presentation. It also found that §2 framework extensions are required before
the economic classes can be expressed at all: 0x001E field 3 is 256 × 32 bytes with no count
prefix, and the registry has no fixed-count-array type.

C1  framework + namespace        §2 extensions, absorb 0x001B–0x0030, burns, stale headers
C2  verification substrate       addressing, SMT, quorum/register resolution, P0–P6
C3  ValidDlvSuccessor            the full V_n -> V_{n+1} predicate
C4  TA_B closure                 assemble into the third-party verification chain

C1 -> C2 -> C3 -> C4

C4 consumes C3, not only C1 and C2 — TA_B verification relies on ValidDlvSuccessor wherever
the accepted successor is a DLV continuation. C2 answers how the primitives work, C3 what a valid
DLV continuation is, C4 how those compose. Different failure modes, so they do not share a review
cycle.

Three rulings

Protobuf bytes never carry protocol identity. The economic register cell's identity, the quorum
comparison operand and AuthorityEvidenceV1's content address are all prost today, which §2.10
forbids. Recorded as nonconformances, not precedent. A CCB identity is mandatory; a new
top-level class is not — an object with independent addressing gets a class, a canonical operand
contained in another object gets its encoding defined there. Clean cut, no dual resolver, and the
transitive identity cut is enumerated rather than avoided. A "canonical transport protobuf" tier was
rejected: it rebuilds the ambiguity §2.10 removed.

One quorum rule, with q committed in authenticated state. Four shipped Rust rules disagree for
every n ≠ 3, and the economic root register's threshold is committed in no signed object — so two
verifiers with different local configuration reach different conclusions about one lineage. The DLV
side already has the pattern: authenticated V_n carries storage_set and quorum. Protocol gets
one rule, authenticated state commits the q this instance used, and beta stays restricted to
n=3, q=2 even after the general function is specified.

Live defects recorded

The foreign-verifier walk violates Requirement 15.3. Rev 15 puts the re-hash obligation on the
consumer — "Every Class K consumer must re-hash returned bytes and compare the result with the
requested canonical address before decoding." peer_lineage.rs re-hashes one of four: the
manifest at :355-358, while the authority evidence (:365), the transition witness (:409) and
the successor evidence (:414) are fetched by address with no comparison. The trait's own doc at
:60-62 claims the opposite — "the walker re-checks the address anyway — a fetcher cannot
substitute bytes." It can, for three of the four. This is a violation of an existing requirement,
not a rule 2c-C invents.

The economic namespace has no declarative burn channel. schema::BURNED and is_burned are
referenced zero times under dsm/src/economic/. The (0x0026,1) / (0x0027,1) burns are
enforced structurally by exact-envelope matching, so the gap is the record, not enforcement — worth
stating precisely, because the first draft of this finding had it backwards.

Two stale scope headers, and one stale test assertion. ccb/mod.rs scopes itself to "exactly
the classes c_n depends on" over a seven-row table while allocating substrate, economic and
reserved numbers; economic/decode.rs:15-18 disclaims the manifest while decoding it. And
dsm/tests/economic_root_primitives.rs:692 still asserts 0x0031 is "the next free class" — a
test, so it fails loudly rather than rotting quietly.

A correction to this programme's own framing

ValidDlvSuccessor is reconciliation, not invention. Rev 15 §6.1 already enumerates the
successor checklist, §8 the encumbrance rules, §13 the iteration-budget decrement, and §4.1 already
forecloses advancing the owner authority position. Earlier framing treated C3 as a blank sheet. C3
now opens with that reconciliation.

Two further corrections are recorded: Req 6.10/6.13 does not contradict the shipped quorum
helper — the disagreement is among four Rust rules — and part of the walk is already normative
in the parent decomposition's §1.2–§1.3, so C4 completes it rather than starting from nothing.

Verification

Every live-defect citation was opened and confirmed before it was written down. Two did not
reproduce as reported and were corrected rather than shipped: the stale-comment path was
dsm/tests/, not dsm/src/economic/, and the ccb/mod.rs scope claim is a section header over a
table rather than a single line. One reported finding was inverted — the economic burns are
enforced, and only the record is missing.

Documentation only. Each sub-amendment states its own two closure statuses; this document claims
neither.