docs(sofi): the sixteen economic classes enter the registry, and their burn is declared in prose but recorded in no table

[cryptskii]

Amendment 2c-C1 — the first of the four sub-amendments the 2c-C decomposition fixed. Normative, encoder-free, documentation only.

What this closes

Sixteen economic CCB classes ship in Rust and appeared in no registry row. The registry claims to be the single namespace, and §2.8 makes a class number permanent on first ship — so a namespace the registry cannot see is a namespace that can be reallocated by accident.

Edit	Content
§3	sixteen class rows 0x001B–0x0030, all substrate, plus the six reserved numbers 0x002A–0x002F, each carrying its named purpose
§5.24–§5.39	the field tables
§2.8	ruling D — every reserved value MUST appear in §3
§4	counts unchanged, and it now says so

Four rulings. One identity form (canonical inner H_dom(N, P) for semantics; the outer storage-object address only at the storage boundary). 0x0028 structurally frozen and BETA REFUSED — its field 4 addresses reserved class 0x002D, which has no field table and no preimage. 0x0029 field 6 admits no zero. Every reserved number appears in the registry.

Encoding closure for fifteen of sixteen. 0x0028 is the exception. Verification closure is C2/C3/C4's and is not claimed.

The burn is declared in prose and recorded in no table

ccb/mod.rs:111-114 declares the 0x0026/0x0027 schema-1 burn (owner ruling 2026-08-28). schema::BURNED carries neither pair, so Cursor::envelope refuses schema-1 bytes as UnknownSchema — a schema I do not recognise — rather than BurnedSchema — a schema permanently retired.

Executed against a clean tree, not read:

is_burned(0x0026, 1) = false
is_burned(0x0027, 1) = false
is_burned(0x0001, 1) = true      <- control, a burn that IS recorded

decode_credit_source(0x0026 schema-1) -> UnknownSchema { got: 1 }
decode_credit_source(0x0027 schema-1) -> UnknownSchema { got: 1 }

decode safety     INTACT.  No schema-1 bytes are accepted on any path.
burn permanence   NOT RECORDED.  §2.8's never-re-assign rule rests on that
                  table, and it does not know these numbers were ever spent.

A later cut bumping 0x0026 to schema 3 adds (0x0026, 2) and finds no record that schema 1 was ever used. the_burned_dlv_source_schemas_are_refused asserts only is_err(), which UnknownSchema satisfies — so it is green under the gap and would stay green if the burn were never recorded at all. An assertion that something fails is not an assertion about why. The table entries and a discriminating test are owed by the first implementation change that adopts this amendment; C1 is docs-only.

Corrections to the merged decomposition

• Its burn finding stands on two of three limbs. A test does exist — it simply cannot tell the two refusals apart.
• Its third ground for the four-way split, "§2 framework extensions REQUIRED", is retracted. §5.2 already establishes that a field table may declare an encoding the framework does not supply, which covers 0x001E field 3's uncounted 256 × digest32 without touching §2. The split stands on its other two grounds.

How a false retraction got written, and why it is recorded

A C1 draft retracted the burn finding outright. That draft was written against a working tree a research subagent had modified mid-audit: it added the pairs to schema::BURNED, added an asserting test, and edited the registry's burned-schema paragraph. A second audit pass then read that state and reported the defect as absent — a workflow reading its own handiwork.

Everything here is re-derived from a clean origin/main, and every runtime claim is executed rather than read. All unauthorized Rust modifications were reverted before any of this was rebuilt; the branch touches no .rs file.

Verification

• Scope — git diff --stat is docs/ only, three files, zero Rust.
• All sixteen field tables re-verified against the clean encoders field-for-field, order and primitive type. This mattered: economic/decode.rs was among the files the subagent had modified, so the tables were re-derived rather than trusted.
• Byte counts check out — 0x001F 44, 0x0020 84, 0x0021 196, 0x0022 68, 0x0029 148, 0x001B 242, 0x001C 138 + 32n.
• 0x001E field 3 confirmed at source — for sibling in &self.siblings with the comment "fixed count, so no length prefix", and check() pins the length to ECONOMIC_SMT_HEIGHT = 256.
• Reserved-set completeness — reserved::ALL is exactly 0x002A–0x002F; §3 carries all six. 0x0032 is unallocated rather than reserved and is left for 2c-D.
• Namespace audit — no duplicate class number in §3.
• A gap C1 found and does not close — 0x001B–0x001E have no independent-encoder conformance test, so the layouts frozen here are pinned by nothing but the encoder/decoder pair. The adopting implementation change must add a conformance vector per class, or §2.8 freezes a layout no test defends.

Next: 2c-C2 (verification substrate), 2c-C3 (ValidDlvSuccessor), 2c-C4 (the TA_B closure walk).