C1-DRYRUN-EXECUTION 04 — C1 Manifest / Resolver & Hash Proof — 2026-06-22

Gate: REGISTRATION_HOLD · CAN_PROCEED = NO · 0 runtime mutations.

---

1. Resolver R_C1 (carried from PATCH2 file 04 — design, deterministic)

The authoritative value source is apr_action_types' own governed columns (action_code, risk_level, handler_ref, _dot_origin provenance), with act_type as a constant for the C1 vocabulary. The PATCH1 enrichment join to process_axis_action_vocabulary is dropped as broken.

Live confirmation this session (read-only): apr_total=14, pav_total=12, joined_on_action_code=0. The join is empty — the two namespaces are disjoint (apr uses create_item, authorize_build_step, …; pav uses APPROVE_BIRTH_ADMISSION, …). This reproduces R8 and confirms the dropped-join correction is correct.

2. What is recomputable now vs. blocked

Item	Status
Canonical serialization cser-v1 (JCS-style canonical JSON, UTF-8 NFC, sorted keys, explicit null)	defined (PATCH2 file 09); recompute command published
Sample value digest (PATCH2): SHA-256 2ab1f90b… over the cser-v1 bytes of one value	recomputable from the published bytes + command
Frozen manifest_digest over the admitted set	BLOCKED — requires the curated, Gate-B-admitted value set, which can only be admitted through DOT_C1_VALUE_ADMIT (absent, file 03)

3. Why the manifest cannot be frozen here

A manifest digest is meaningful only over the actual admitted rows. Admitting rows requires the governed value-admission handler and the C1 table — both absent (file 02/03). Producing a digest over an invented set would be exactly the "values curated later / provenance ≠ authority" defect Codex flagged (review §5.3). Therefore the manifest stays an authority/runtime residual, not a closed artifact, in this package — unchanged from PATCH2.

4. Classification & boundary attestation

RESOLVER_DETERMINISTIC (design closed) + MANIFEST_FREEZE_BLOCKED_PENDING_CONTRACT (residual). No values admitted, no digest registered. REGISTRATION_HOLD retained; CAN_PROCEED = NO; 0 runtime mutations.